Packet Anomaly Detection Using NLP Vectors Across Mixed Protocols
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing abnormality detection systems in industrial and building network control systems face challenges in analyzing communication packets due to the use of various protocols, including those with undisclosed specifications, making it difficult to detect unauthorized changes without relying on frame format and protocol parsers.
Innovation Solution
A detection device and learning device that convert packets into fixed-length vectors using natural language processing, enabling abnormality detection through unsupervised learning models like VAE, AE, or LoF, without depending on communication protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If detailed analysis of packet contents is performed to detect unauthorized changes, then detection precision is improved, but device complexity increases due to need for protocol-specific parsers and frame format knowledge
Solution Approach 1:
The patent introduces an intermediary component (the conversion unit) that transforms variable-length packets of various protocols into fixed-length vectors. This mediator enables the detection model to process diverse packet types uniformly without requiring protocol-specific parsers, thereby maintaining high detection precision while reducing system complexity.
Solution Approach 2:
The patent changes the parameter representation of packets from variable-length raw data to fixed-length vectors. This parameter transformation allows the detection system to handle different packet types consistently, eliminating the need for complex protocol analysis while preserving the ability to detect abnormalities in packet contents.
2Measurement precision
If protocol-specific analysis methods are used to detect abnormalities, then detection precision is improved for known protocols, but adaptability deteriorates when encountering undisclosed or new protocols
Solution Approach 1:
The patent creates a universal processing framework where the conversion unit can handle packets from any protocol (known or undisclosed) by transforming them into a common fixed-length vector format. This universal approach maintains detection precision across different protocols while significantly improving adaptability to new or undocumented protocol types.
Solution Approach 2:
The fixed-length vector serves as an intermediary representation that decouples the detection logic from protocol-specific details. This intermediary enables the system to adapt to new protocols without modifying the detection model, as all protocols are transformed into the same vector format before analysis.
3Loss of information
If variable-length packets are processed directly, then information completeness is maintained, but processing efficiency deteriorates due to variable computation requirements
Solution Approach 1:
The patent transforms the parameter structure of packets from variable-length to fixed-length vectors, enabling efficient batch processing and uniform computation. This parameter change standardizes processing requirements while the conversion process preserves essential packet features, balancing information completeness with processing efficiency.
Solution Approach 2:
The patent segments packets into fixed-length vector representations, where each vector captures essential packet characteristics. This segmentation enables efficient parallel processing and reduces computational variability, improving overall processing efficiency while maintaining the necessary information for abnormality detection.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A detection device (20) includes: an encoding unit (252) that converts one packet to be detected into one fixed-length vector by using natural language processing technology; and a detection unit (253) that detects presence or absence of an abnormality in the packet to be detected based on the fixed-length vector converted by the encoding unit (252) using a detection model.