Communication Data Clustering for Probability Density Estimation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing probability density estimation apparatuses, such as VAEs, face challenges in accurately learning the probability density of communication data when there is a difference in the number of data pieces between normal communication data, leading to potential underestimation of occurrence probability and excessive detection of normal communication data.
Innovation Solution
A learning apparatus that includes an acquisition unit for normal communication data, a first estimation unit for initial probability density estimation, a clustering unit for clustering data based on estimated probability density, a second estimation unit for refined learning within clusters, and an integration unit for combining probability densities across clusters, allowing for accurate and high-speed learning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If probability density estimation is performed using VAE on communication data with varying data quantities, then learning can be performed on diverse communication protocols, but learning accuracy deteriorates for protocols with small data quantities
Solution Approach 1:
The patent segments the communication data into multiple clusters based on protocol types and characteristics. Each cluster is processed separately through dedicated VAE models, allowing protocols with small data quantities (like NTP) to be handled independently from those with large data quantities (like HTTP). This segmentation prevents dominant protocols from overwhelming minor protocols during training.
Solution Approach 2:
The patent applies local quality by training separate VAE models for each data cluster rather than using a single global model. Each local model is specialized for its specific protocol type, adapting its parameters to the unique characteristics and data distribution of that protocol. This allows accurate probability density estimation for each protocol type regardless of overall data quantity variations.
2Reliability
If learning is performed on all communication data together, then comprehensive model training is achieved, but learning time increases
Solution Approach 1:
The patent divides the training process into multiple parallel stages, where data is first clustered and then processed by multiple VAE models simultaneously. This parallel processing approach reduces overall learning time compared to sequential training on the entire dataset, while still achieving comprehensive coverage of all communication protocols through the ensemble of specialized models.
Solution Approach 2:
The patent performs preliminary clustering of communication data before the main probability density estimation training. This preliminary action organizes the data into meaningful groups, enabling more efficient subsequent training of specialized models for each cluster. The clustering step prepares the data structure to accelerate the overall learning process.
3Device complexity
If probability density estimation is performed without clustering, then device complexity is reduced, but detection accuracy deteriorates for protocols with small data quantities
Solution Approach 1:
The patent introduces clustering as a preprocessing step that segments data into protocol-specific groups. This segmentation enables the use of multiple specialized VAE models, each optimized for its cluster. The added complexity of clustering is justified by the significant improvement in detection accuracy for protocols with small data quantities, as each model can learn from relevant protocol-specific patterns rather than being diluted by diverse data.
Solution Approach 2:
The patent changes the parameters of multiple VAE models based on their respective data clusters. Each model's parameters are optimized for its specific protocol type through separate training on clustered data. This parameter specialization allows accurate detection for each protocol type, with the ensemble of models providing comprehensive coverage across all communication protocols.
Data Source
AI summary
A learning apparatus includes: a first estimation unit—configured to learn normal communication data, estimate probability density of the normal communication data, and update a parameter of a model; a clustering unit configured to cluster the normal communication data according to the probability density estimated by the first estimation unit; a second estimation unit configured to perform learning for each of clusters resulting from the clustering by the clustering unit, and estimate the probability density of the normal communication data of the cluster and update a parameter of a model representing characteristics of the probability density of the normal communication data of the cluster by using, as an initial value of the parameter, a parameter having already been learned in the first estimation unit; and an integration unit configured to integrate the estimated probability density of the clusters.