Packet Payload Abnormality Estimation With Invertible Features
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing abnormality detectors using deep learning often perform non-invertible transformations, making it difficult to determine the cause of abnormality in the original data, specifically which part of the packet payload is responsible for the abnormality determination.
Innovation Solution
An estimation device that performs invertible transformation on packet payloads character by character, uses machine learning with high interpretability models like decision trees to classify packets as abnormal or normal, and extracts dimensions with significant contribution to classification, estimating the cause of abnormality in the payload.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If non-invertible transformation is used to convert original data into feature quantity for deep learning, then the abnormality detection capability is improved, but the ability to trace back to the cause part in original data is lost
Solution Approach 1:
The patent applies inversion by using invertible transformation instead of non-invertible transformation. This allows the feature quantity to be transformed back to the original payload data, enabling traceability of abnormality causes while maintaining deep learning functionality. The invertible nature of the transformation resolves the contradiction by allowing information to be preserved in both directions.
2Measurement precision
If deep learning models are used for abnormality detection, then detection accuracy is improved, but interpretability of the determination result deteriorates
Solution Approach 1:
The patent introduces an intermediary explanation model that receives feature quantities from the deep learning model and generates human-readable explanations. This intermediary layer maintains the high detection accuracy of deep learning while providing interpretable results about which parts of the payload caused the abnormality determination, thus resolving the contradiction between accuracy and interpretability.
3Productivity
If feature quantity dimensions are reduced for simpler analysis, then processing speed is improved, but the precision of cause identification deteriorates
Solution Approach 1:
The patent extracts only the specific feature quantity dimensions that have high contribution to the abnormality determination, rather than analyzing all dimensions. This extraction of relevant features maintains cause identification precision while reducing processing speed requirements, as only the most important dimensions are analyzed for explanation generation.
Data Source
AI summary
An estimation device includes processing circuitry configured to generate a feature quantity by performing invertible transformation on a payload of a packet character by character with respect to each packet determined to be abnormal or normal by an abnormality detector, and give a determination result as to whether a packet is abnormal or normal to the generated feature quantity, learn a model that classifies whether the packet is abnormal or normal by machine learning using the feature quantity of the payload of the packet and the determination result as to whether the packet is abnormal or normal as teacher data, extract a number of dimensions of the feature quantity in which a contribution degree to classification is equal to or greater than a predetermined value in the learned model, and estimate a cause part of abnormality in the payload of the packet determined to be abnormal.