JP6476143B2 - Anomaly detection device, anomaly detection system, anomaly detection method, and program - Google Patents

Description

  The present invention relates to an abnormality detection device, an abnormality detection system, an abnormality detection method, and a program.

  Terminals connected to the network have been diversified in recent years. For example, so-called M2M (Machine-to-Machine) terminals called strain sensors and actuators such as robot arms have been connected to the network until now. It has become so. The features of the M2M terminal compared to the computers and smartphones we normally use are as follows: (1) Remote operation / information acquisition via the network, (2) Human interface (display, keyboard, etc.) on the terminal itself There are three points, that it is not provided, and (3) that a large number of the same terminals may be installed for realizing the service.

  Since it is conceivable that the M2M terminal is installed in a place out of the eyes of the user, a mechanism for remotely detecting the removal of the terminal, the occurrence of a failure or the like is necessary. In addition, connection detection of a terminal impersonating a regular terminal is also required.

  Conventionally, many e-mail clients have implemented a spam mail filtering technique for determining whether a sent e-mail is a junk mail unrelated to the recipient (for example, non-patent literature). 1).

  In such filtering, the contents of the e-mail addressed to the recipient are analyzed, and whether or not the e-mail is actually destined for the recipient is determined based on the appearance frequency of the word or the like included in the mail body. In addition, a process of giving a “spam mail” label is performed.

  The recipient determines whether the email is spam or not, and if the email client makes a mistake, deletes or adds the “spam email” label.

  A feature of this method is that the filter is updated based on the determination result of the recipient. Since the determination by the filter and the feedback by the recipient are performed each time the mail is received, at the beginning, even if there are many erroneous determinations, improvement in determination accuracy can be expected as the number of times is increased.

  The reason for performing such learning as well as the determination based on the preset threshold value is that the content of the mail received by the recipient is assumed to vary greatly depending on the recipient and the usage method. At first, even if there is no knowledge about the receiver, the learning makes it possible to make an appropriate determination for the receiver.

  Further, risk-based authentication performs additional authentication (one-time password, secret question, etc.) when access to a service is performed from an environment different from normal (for example, Non-Patent Document 2).

  This is a technique mainly used for login of a Web service, and user information that can be acquired by a service provider when a user logs in, for example, a connection source IP address and a connection time zone, and a browser User-Agent information. If the connection provider device's history is accumulated on the service provider side and compared with the past user information, it may differ from the previous connection environment when logging in (for example, users who normally access from Japan) Suspected fraudulent login, stronger authentication (send a one-time password with a disposable one-time password to the user, and authenticate using this one-time password) Etc.).

  With this technology, only simple ID / password authentication can be performed in a normal usage environment, and stronger (and time-consuming) authentication can be performed for a login that is estimated to have a high risk of unauthorized login. Thereby, security can be improved without impairing user convenience.

Paul Graham, "Countermeasures against spam --- A Plan for Spam", [online], August 2002, Internet <URL: http://practical-scheme.net/trans/spam-j.html> “VeriSign Launches“ Symantec (tm) Validation & ID Protection ”for Easy Use of“ One-Time Password Authentication ”and“ Risk-Based Authentication ””, Internet <https://www.jp.websecurity.symantec. com / press / 2011 / pr_20111116.html>

  In order to detect an abnormality of the M2M terminal, when a GW (Gateway) device that accommodates the terminal acquires a communication characteristic value (data amount, communication interval, etc.) of the terminal and the value exceeds a preset threshold value It is conceivable to determine that it is abnormal.

  At this time, the threshold is set by a service provider that provides a service using a terminal. This is because the communication characteristics of the terminal are prescribed to some extent by the service, and it is considered that an appropriate threshold can be set by a service provider.

  However, in practice, it is difficult to obtain an appropriate threshold value for each service, and it is considered that the setting of the threshold value is a burden for the service provider particularly when trying to realize highly accurate abnormality detection.

  As a method of reducing the burden of threshold setting by the service provider, introduction of automatic threshold updating by learning can be mentioned. This creates a distribution model (communication model) of communication characteristics that can be taken by a terminal based on past communication with the terminal, and regards anything that deviates greatly from the model as abnormal. The advantage of the learning method is that the above-mentioned appropriate threshold setting is automatically performed, so that the burden on the service provider can be reduced. On the other hand, as a problem, in order to actually set the threshold appropriately, it is necessary to refine the model based on a sufficient amount of communication information of regular terminals, and in addition, learning of devices in the network Therefore, an increase in the processing amount is a burden. For example, a method in which all communication of terminals is sequentially gathered in one place, learning, and determination is a problem from the viewpoint of scalability for an M2M service in which a large number of terminals are assumed to be connected.

  As described above, when using anomaly detection based on a threshold in a network in which a large number of M2M terminals having similar communication characteristics are connected, automatic updating of the threshold by learning is performed from the viewpoint of reducing the burden on the service provider. Although introduction is conceivable, in order to determine a threshold with high accuracy, the processing load on the devices in the network due to learning of the communication model of the terminal is large, and there is a problem in terms of scalability.

  The present invention has been made in view of the above points, and an object thereof is to improve the efficiency of detecting an abnormality of a terminal connected to a network.

In order to solve the above problem, an abnormality detection device that detects an abnormality of a terminal connected via a network has an acquisition unit that acquires a characteristic value related to communication with the terminal, and the acquisition unit acquires the characteristic value. Each time, based on the history of characteristic values acquired with respect to communication with the terminal at a plurality of timings, a generation unit that generates the distribution model of the characteristic values, and the generation unit generated at every predetermined interval the distribution model, a transmission unit for transmitting to the aggregation device connected via a network, said a the distribution model transmitted by the transmitting unit, the abnormality detection before Symbol distribution model about the terminal that is not connected to the device A receiving unit that receives the distribution model of the characteristic value generated by the aggregation device based on the distribution model, a distribution model received by the receiving unit, and after the distribution model is received Based on the comparison between the characteristic value for communication with the terminal, the distribution model possess a detection unit for detecting an abnormality of the terminal via a network, wherein the predetermined interval is said aggregation device generates Lengthens with convergence .

  It is possible to improve the efficiency of detecting an abnormality of a terminal connected to the network.

It is a figure which shows the structural example of the abnormality detection system in embodiment of this invention. It is a figure which shows the hardware structural example of GW in embodiment of this invention. It is a sequence diagram for demonstrating an example of the process sequence in a learning phase. It is a sequence diagram for demonstrating an example of the process sequence in an abnormality detection phase. It is a figure which shows the relationship between the convergence condition of the standard error of communication model information, and a transmission interval.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a diagram illustrating a configuration example of an abnormality detection system according to an embodiment of the present invention. In FIG. 1, the anomaly detection system 1 includes an aggregation entity (hereinafter referred to as “PF (Platform) 20”) and a plurality of terminal accommodation devices (hereinafter referred to as “GW 10 (Gateway)”) that are distributed. Including. The PF 20 is connected to a plurality of GWs 10 via a network. Each GW 10 is connected to a plurality of terminals via a network (for example, a wireless line).

  The terminal is, for example, an M2M (Machine-to-Machine) terminal. Each terminal is geographically distributed and transmits data (for example, measurement values) used for any service to a GW that accommodates the terminal. Each terminal is accommodated in any one GW 10. In other words, each GW 10 is connected to a different terminal. Moreover, all the terminals shown in FIG. 1 may be used for the same service, or terminals used for different services may be mixed. However, it is desirable that terminals used for the same service are connected to a plurality of GWs 10. A service refers to a service provided using a terminal.

  Each GW 10 is a device (for example, a computer) that accommodates a plurality of terminals via a network. In FIG. 1, the GW 10 includes a terminal accommodating unit 11, a communication characteristic obtaining unit 12, a distributed learning unit 13, a distributed information transmitting unit 14, an aggregate information receiving unit 15, a communication control unit 16, and the like. Each of these units is realized by processing that one or more programs installed in the GW 10 cause the CPU of the GW 10 to execute. The GW 10 also uses the distributed information storage unit 17 and the comparison information storage unit 18. Each of these storage units can be realized using, for example, an auxiliary storage device of the GW 10 or the like.

  The terminal accommodating unit 11 terminates communication (for example, wireless communication) with the terminal. The communication characteristic acquisition unit 12 monitors communication with each terminal by each terminal accommodating unit 11 and acquires information indicating communication characteristics in data communication of each terminal (hereinafter referred to as “communication characteristic value”). The communication characteristic acquisition unit 12 stores the acquired communication characteristic value in the distributed information storage unit 17 for each service. For example, the history of communication characteristic values acquired from a plurality of terminals having a common service is stored in a common table. The communication characteristic value is, for example, a traffic pattern (communication interval), an average packet length, a communication frequency, a communication amount, or the like. Or the content (measurement value etc.) of the data transmitted may be made into a communication characteristic value. In the present embodiment, it is assumed that the communication characteristic values of terminals used for at least the same service are the same.

Based on the communication characteristic values acquired at a plurality of timings by the communication characteristic acquisition unit 12, the distributed learning unit 13 sets information (hereinafter referred to as “communication model information”) indicating a distribution model of communication characteristic values for each service. Generate. Communication model information generated for each service is stored in the distributed information storage unit 17. In the present embodiment, the communication model information is a parameter that characterizes (identifies or defines) the distribution of communication characteristic values. For example, if the distribution follows the normal distribution N (μ, σ ² ), the average μ, the variance σ ² , the number n of communication characteristic values forming the distribution, and the like correspond to the communication model information.

  The shared information transmission unit 14 transmits the information stored in the shared information storage unit 17 (hereinafter referred to as “shared information”) to the PF 20 at regular intervals, for example.

  The aggregate information receiving unit 15 receives the communication model information generated by the PF 20 from the PF 20 by integrating the communication characteristic values or the communication model information included in the distributed information transmitted from each GW 10 for each service. Receive. The aggregate information receiving unit 15 stores the received communication model information in the comparison information storage unit 18. The comparison information storage unit 18 stores communication model information used for detecting an abnormality of the terminal.

The communication control unit 16 detects an abnormal terminal by comparing the communication model information stored in the comparison information storage unit 18 and a communication characteristic value acquired after receiving the communication model information, and detects the terminal The communication is cut off. An abnormal terminal is, for example, a terminal in which a failure or the like has occurred, or an unauthorized terminal (for example, a terminal that has been legitimately formed).

On the other hand, the PF 20 includes a distributed information receiving unit 21, an aggregate learning unit 22, an aggregate information transmitting unit 23, a terminal information managing unit 24, and the like. Each of these units is realized by processing that one or more programs installed in the PF 20 cause the CPU of the PF 20 to execute. The PF 20 also uses the aggregate information storage unit 25 and the terminal information storage unit 26. Each of these storage units can be realized using, for example, an auxiliary storage device of the PF 20 or the like.

  The shared information receiving unit 21 receives shared information transmitted from each GW 10. The aggregation learning unit 22 is based on the communication characteristic values for each service in which the communication characteristic values included in the distributed information received by the distributed information receiving unit 21 are aggregated or integrated in units of services across the GW 10. Communication model information for each service straddling a plurality of GWs 10 is generated. The generated communication model information is stored in the aggregate information storage unit 25.

  The aggregate information transmission unit 23 transmits the communication model information for each service generated by the aggregate learning unit 22 to each GW 10. The terminal information management unit 24 manages terminal information stored in a terminal information storage unit 26 that stores attribute information of each terminal. The terminal information is registered by, for example, a service provider that provides a service using the terminal.

  FIG. 2 is a diagram illustrating a hardware configuration example of the GW according to the embodiment of the present invention. The GW 10 in FIG. 2 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a CPU 104, an interface device 105, and the like that are mutually connected by a bus B.

  A program that realizes processing in the GW 10 is provided by a recording medium 101 such as a CD-ROM. When the recording medium 101 storing the program is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, the program need not be installed from the recording medium 101 and may be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program and also stores necessary files and data. The memory device 103 reads the program from the auxiliary storage device 102 and stores it when there is an instruction to start the program. The CPU 104 executes a function related to the GW 10 in accordance with a program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network. Each of the devices 100 to 105 may have a plurality.

  The PF 20 may also have a hardware configuration as shown in FIG.

  Hereinafter, a processing procedure executed in the abnormality detection system 1 will be described. The processing procedure is classified into two phases, a learning phase and an abnormality detection phase. The learning phase is a phase in which the communication model information is learned based on the notification specific value. The abnormality detection phase is a phase in which abnormality detection is performed based on learned communication model information.

  FIG. 3 is a sequence diagram for explaining an example of a processing procedure in the learning phase. Steps S101 to S103 are executed for each terminal at the start of communication after installation.

  When a certain terminal (hereinafter referred to as “target terminal”) connects to the terminal accommodating unit 11 of the GW 10 and starts communication (S101), the aggregated information receiving unit 15 of the GW 10 sends the terminal information managing unit 24 of the PF 20 to the terminal information managing unit 24. In response, a service resolution request is transmitted (S102). Service resolution refers to clarifying the service supported by the target terminal. The service resolution request includes the identifier of the target terminal (hereinafter referred to as “terminal ID”). Note that the terminal ID is included in the message transmitted from the target terminal in step S101, for example. An example of the terminal ID is a physical address of the terminal.

  When receiving the resolution request, the terminal information management unit 24 of the PF 20 acquires a service ID stored in the terminal information storage unit 26 in association with the terminal ID included in the resolution request. That is, the terminal information storage unit 26 stores the service ID of the service corresponding to each terminal in association with each terminal ID. The service ID is identification information for each service.

  Subsequently, the terminal information management unit 24 determines whether or not the communication model information and the transmission cycle corresponding to the acquired service ID are stored in the aggregate information storage unit 25. When the corresponding communication model information and transmission cycle are stored in the aggregate information storage unit 25, the communication model information and the transmission cycle are acquired. The transmission cycle is synonymous with the transmission cycle transmitted to the GW 10 in step S116 described later.

  Subsequently, the terminal information management unit 24 transmits a response including a service resolution result (a service ID of a service corresponding to the target terminal (hereinafter referred to as “target service”)) to the GW 10 (S103). If the communication model information and the transmission cycle corresponding to the service ID are stored in the aggregate information storage unit 25, the communication model information and the transmission cycle are included in the response in addition to the service resolution result.

  When the communication model information and the transmission interval are included in the response transmitted from the PF 20, the aggregate information receiving unit 15 of the GW 10 corresponds to the service ID included in the response in the communication model information and the transmission interval. In addition, it is stored in the comparison information storage unit 18 (S104). If there is communication model information or the like already associated with the service ID and stored in the comparison information storage unit 18, the communication model information or the like is overwritten by the newly received communication model information or the like. The aggregate information receiving unit 15 also stores the terminal ID of the target terminal in the auxiliary storage device 102 in association with the service ID of the target service, for example.

  Subsequently, the GW 10 shifts the processing phase to the abnormality detection phase for the target service (S200). That is, the processing phase in each GW 10 is distinguished for each service.

  On the other hand, when the communication model information or the like is not included in the response transmitted from the PF 20, the abnormality detection phase (S200) is executed after the execution of steps S111 to S117.

  In step S111, when the target terminal transmits data (for example, a measured value or the like) to the GW 10 (S105), the communication characteristic acquisition unit 12 acquires a communication characteristic value regarding the communication (S106). The communication characteristic acquisition unit 12 stores the communication information in the distributed information storage unit 17 in association with the service ID of the target service.

  Subsequently, the distributed learning unit 13 generates communication model information based on a history of communication characteristic values associated with the service ID and stored in the distributed information storage unit 17, and the communication model information The distributed information storage unit 17 stores the information in association with the ID. Note that the communication model information may be generated for any one of the plurality of types of communication characteristic values, or may be generated for two or more types of communication characteristic values. In the latter case, if there is no correlation between the communication characteristic values, the communication model information may be generated for each communication characteristic value. One communication model information may be generated. The communication characteristic value used for generating the communication model information and the algorithm for learning may be fixedly set in advance or may be selected in advance by the service provider. When the service provider can select in advance, for example, information indicating the selected content may be stored in the terminal information management unit 24 of the PF 20 and the information may be downloaded to each GW 10.

  When steps S111 to S113 are executed m times with respect to the target service (that is, when the number of communication characteristic value histories stored in association with the service ID of the target service in the distributed information storage unit 17 reaches m). ), The distributed information transmission unit 14 of the GW 10 includes a history of communication characteristic values stored in association with the service ID, communication model information generated last with respect to the service ID, and the service ID. Information is transmitted to PF20 (S114). Note that m executions of steps S111 to S113 are counted for each service. That is, when there are a plurality of terminals corresponding to the same service, the execution floors of steps S111 to S113 relating to the plurality of terminals only need to reach m times. The initial value of m is set in advance, for example. The number of communication characteristic value histories to be transmitted may be the latest m. In this case, the history of communication characteristic values transmitted in the past from the GW 10 to the PF 20 may be stored in the PF 20.

  When receiving the shared information, the shared information receiving unit 21 of the PF 20 stores the history of communication characteristic values included in the shared information in the aggregate information storage unit 25 in association with the service ID. Further, the aggregation learning unit 22 of the PF 20 is based on the communication model information associated with the service ID and stored in the aggregation information storage unit 25, and the communication model information included in the received distributed information. New communication model information is generated, and the communication model information associated with the service ID and stored in the aggregate information storage unit 25 is overwritten with the generated communication model information (S115). Depending on the communication model, it may be difficult to integrate the communication model information. In such a case, the intensive learning unit 22 may generate new communication model information based on a history of communication characteristic values associated with the service ID and stored in the intensive information storage unit 25. The intensive learning unit 22 also calculates a transmission cycle according to the convergence state of the communication model information. The transmission period is the value of m in the above. For example, the transmission cycle of the communication model information may be dynamically changed according to the convergence state of the communication model information. The aggregation learning unit 22 stores the calculated transmission cycle in the aggregation information storage unit 25 in association with the service ID.

  Subsequently, the aggregate information transmission unit 23 of the PF 20 transmits the communication model information generated in Step S115, the transmission cycle calculated in Step S115, and the service ID of the target service to the GW 10 (S116). When receiving the communication model information and the transmission cycle, the aggregate information receiving unit 15 of the GW 10 stores the communication model information and the transmission cycle in the comparison information storage unit 18 in association with the received service ID (S117). ). When the learning model information or the transmission cycle associated with the service ID is already stored in the comparison information storage unit 18, the already stored information is overwritten with the newly received information.

  Steps S111 to S117 are repeated until the communication model information generated in step S115 converges. In the repetition process, the number of repetitions (transmission cycle) of steps 111 to S113 is updated by the transmission cycle received in step S116. For example, steps S <b> 112 to S <b> 117 may be repeated until the degree of convergence described below becomes a predetermined value or less. An upper limit may be set for the number of repetitions. The determination as to whether the communication model information has converged may be performed in the PF 20 or may be performed in the GW 10. When the presence / absence of convergence is determined in the PF 20, for example, in step S115, the presence / absence of convergence of the communication model information is determined after the generation of the communication model information, and information indicating the presence / absence of the convergence is transmitted to the GW 10 in step S116. Also good. When the presence or absence of convergence is determined in the GW 10, the GW 10 determines whether or not the communication model information has converged based on the history of communication model information received in the past from the PF 20 including the communication model information received in step S116. You may judge. When the communication model information generated in step S115 converges, the GW 10 proceeds to the abnormality detection phase for the target service (S200).

  In step S103, the communication model information may be transmitted to the GW 10 only when it is determined that the communication model information stored for the service ID of the target service has converged.

  Next, the abnormality detection phase will be described. FIG. 4 is a sequence diagram for explaining an example of a processing procedure in the abnormality detection phase.

  Steps S201, S202, and S204 are the same as steps S111, S112, and S113 in FIG. In the case of the abnormality detection phase (when the data received in step S201 is data related to the service that has shifted to the abnormality detection phase), step S203 is executed between step S202 and step S204.

  In step S203, the communication control unit 16 of the GW 10 uses the communication characteristic value acquired in step S202 as a service (hereinafter referred to as “target terminal”) to which the terminal (hereinafter referred to as “target terminal”) of the data received in step S202 corresponds. Hereinafter, it is referred to as “target service”) and is compared with the communication model information (hereinafter referred to as “target communication model information”) stored in the comparison information storage unit 18 in association with the service ID of the target terminal. For example, the presence or absence of abnormality may be determined by comparing the threshold value β derived from the target communication model information with the communication characteristic value. More specifically, when the distribution of communication characteristic values acquired for the target service follows some probability distribution, it may be determined that the target terminal is abnormal when a communication characteristic value greatly deviating from this model is acquired. .

  When it is determined that there is an abnormality in the target terminal (when an abnormality is detected), the communication control unit 16 may immediately block communication of the target terminal. Alternatively, the communication control unit 16 may transmit information indicating the occurrence of abnormality to the terminal information management unit 24 of the PF 20. In this case, the terminal information management unit 24 may notify the occurrence of an abnormality to a contact address of a preset service provider by e-mail or other communication means. At this time, the service provider can select whether or not communication of the target terminal is necessary, and if it is selected that communication is necessary, the terminal information management unit 24 sends the communication control unit 16 of the GW 10 to the communication control unit 16. Then, the communication control unit 16 may block communication of the target terminal. About the action at the time of abnormality detection, a service provider can select beforehand for every service, and the information which shows the said action may be hold | maintained by the terminal information management part 24 of PF20. In this case, the information may be transmitted to the GW 10 in step S103 of FIG. 3, or the GW 10 may inquire the PF 20 for the information when an abnormality is detected.

  If an abnormality of the target terminal is detected, the communication characteristic value acquired in step S202 is discarded and step S204 is not executed. This is to prevent learning based on an abnormal value. On the other hand, when no abnormality of the target terminal is detected, step S204 is executed.

  When Steps S201 to S204 are repeated m times for the target service, Steps S205 to S208 are executed. In FIG. 4, the initial value of m is the transmission cycle received in step S103 or S116 in FIG. 3 for the target service. A case where an abnormality is detected is not counted m times. That is, the number of times step S204 has been executed (the number of times learning has been performed) is counted m times.

  Steps S205 to S208 are the same as steps S114 to S117 in FIG. After step S208 is executed, step S201 and subsequent steps are repeated. At this time, the value of m is updated by the transmission cycle received in step S207.

  Note that it is also conceivable that the communication characteristic values acquired in step S202 are sequentially collected in the PF 20, and the PF 20 sequentially learns the communication model information. However, in this method, the processing load in the PF 20 and the number of times of communication between the PF 20 and the GW 10 increase, so that there is a particular problem with scalability.

  Therefore, in the present embodiment, the GW 10 learns the communication model information and periodically transmits the communication model information to the PF 20, thereby reducing the number of communication times generated between the GW 10 and the PF 20 and the processing load of the PF 20. doing.

  Further, the number relationship between the PF 20, the GW 10, and the terminal is generally 1: M: N (and 1 << M << N), and is acquired and learned from each of the GWs 10 to the PF 20. The communication characteristic values and communication model information transmitted are aggregated in the PF 20.

  Therefore, in PF20, highly accurate communication model information is produced | generated based on the communication characteristic value of all the terminals linked with the same service across several GW10.

  When communication is performed from the GW 10 to the PF 20, the PF 20 returns the latest communication model information to the GW 10, so that the GW 10 can perform abnormality detection using a highly accurate communication model.

  Compared with the case where the GW 10 sequentially transmits communication characteristic values to the PF 20, the PF 20 performs abnormality determination, and the PF 20 sequentially updates the communication model information, in this embodiment, the communication model information is updated periodically. Since a time lag occurs before the correct update timing is reached, it is necessary to set an appropriate transmission interval. When the transmission interval is small, the number of communications to the PF 20 and the number of processing occurrences at the PF 20 increase, but the update delay of the communication model information is less likely to occur. On the other hand, if the transmission interval is large, the load of the PF 20 is reduced, while the communication model information held by the PF 20 and the communication model information held by each GW 10 may be different.

  As a variation of the timing at which the GW 10 transmits the communication model information and the like, as described above, the GW 10 may perform transmission at a predetermined cycle. From the viewpoint of load smoothing of the PF 20, the PF 20 performs scheduling. The transmission model information may be requested to the GW 10 in order.

  Note that when there is a limitation in processing capability in the GW 10 and it is difficult to perform learning, the GW 10 may periodically transmit the communication characteristic value to the PF 20 without learning the communication model information at all. Even in this case, the effect of reducing the number of communications can be obtained.

  Further, the distributed information reception unit 21, the aggregation learning unit 22, the aggregation information transmission unit 23, the terminal information management unit 24, and the like included in the PF 20 are not necessarily realized by one computer. From the viewpoint of scalability, a specific service with a large load or each functional unit related to all services may be separately arranged on separate physical servers or virtual machines. In this case, in the PF 20 shown in FIG. 1, the association between the identifier of the separated server (IP address / domain name, etc.) and the identifier of the service provider is managed, and this is used to distribute communication with each server. It may be done.

Next, this embodiment will be specifically described in the case where the distribution of communication characteristic values obtained from the terminal follows the normal distribution N (μ, σ ² ).

In the distributed information storage unit 17 of the GW 10, the number n of communication characteristic values acquired so far is stored as communication model information in addition to μ and σ ² as communication model information for each service. Each time a new communication characteristic value data _{n + 1} is acquired by the communication characteristic acquisition unit 12, the distributed learning unit 13 of the GW 10 sequentially obtains new communication model information μ _{n + 1} and σ ² _{n + 1} using the following equations. In the following formula, α = 1 / (n + 1).

ＧＷ１０の分散学習部１３は、送信周期が訪れるまで（送信周期の回数分、通信モデル情報を更新するまで）、上記の式を用いて通信モデル情報を繰り返し更新する。

The distributed learning unit 13 of the GW 10 repeatedly updates the communication model information using the above formula until the transmission cycle arrives (until the communication model information is updated for the number of transmission cycles).

When the transmission cycle for a certain service arrives, the distributed information transmission unit 14 of the GW 10 transmits the communication model information n, μ, and σ ² regarding the service to the PF 20. When the communication model information follows a normal distribution, it is not necessary for the GW 10 to transmit the communication characteristic value history acquired so far, and only the communication model information learned by the GW 10 may be transmitted. On the other hand, when following a communication model in which it is difficult to integrate or aggregate communication model information, it is necessary to transmit a history of communication characteristic values. In this case, the communication model information may not be transmitted, and the communication model information may not be learned in the GW 10.

  When the communication model information from the GW 10 is received in the PF 20, the aggregate learning unit 22 of the PF 20 updates the communication model information using the following formulas (all formulas can be derived from the average and variance formulas). This equation holds when the communication model information based on the communication characteristic value acquired on the GW 10 side and the communication model information held on the PF 20 side are the feature quantities of the samples extracted from the same population (= the same service). ).

ここで、Ｘ_{ＧＷ＋ＰＦ}は、ＧＷ１０側のＸとＰＦ２０側のＸとを統合した結果を示す。なお、上記の式において、Ｘに当てはまる値は、σ^２、μ^２、及びμである。

Here, X _{GW + PF} indicates the result of integrating X on the GW 10 side and X on the _PF 20 side. In the above formula, values that apply to X are σ ² , μ ² , and μ.

Subsequently, the aggregate information transmission unit 23 of the _PF 20 returns the updated communication model information (n = n _GW10 + n _PF , μ _{GW + PF} , σ ² _{GW + PF} ) and the service ID of the service related to the communication model information to the GW 10. To do. Upon receiving the communication model information and service ID, the aggregate information receiving unit 15 of the GW 10 uses the received communication model information to store the communication model information stored in the comparison information storage unit 18 in association with the service ID. Overwrite. As a result, the communication characteristic value related to the subsequent communication (transmission of data from the terminal) with the terminal related to the service related to the service ID is compared with the communication model information newly stored in the comparison information storage unit 18, and It is determined whether or not the terminal is abnormal.

Here, the communication model information represents a normal distribution N (μ, σ ² ) of values that can be taken by the communication characteristic value, and an appearance probability in the case of following this normal distribution is an outlier value. Can be determined. This can be regarded as a problem of simply obtaining a confidence interval. For example, the 95% confidence interval can be expressed by the following equation.

例えば、μ＝２０、σ＝５、ｎ＝３０の場合、信頼区間は、２０±１．９５×５／√３０＝２０±１．７８であり、１８．２２と、２１．７８とが、上記における閾値βとなる。

For example, when μ = 20, σ = 5, and n = 30, the confidence interval is 20 ± 1.95 × 5 / √30 = 20 ± 1.78, and 18.22 and 21.78 are It becomes the threshold value β in the above.

  Next, a method for dynamically changing the transmission cycle (m) will be described.

  When the communication model information follows a normal distribution, the variation (= low accuracy) of the learned communication model information can be expressed by the standard error σ / √n of the communication model.

  As can be seen from this equation, if a sufficient amount of communication characteristic value is acquired, the standard error converges to a small value. In this case, frequent exchange of communication model information between the PF 20 and the GW 10 is not necessary. On the other hand, when the number of acquired communication characteristic values is small, the communication model information needs to be frequently exchanged between the PF 20 and the GW 10 (see FIG. 5).

  Therefore, the degree of convergence of the communication model is defined, and the transmission cycle (the number of times the communication model information is updated in the GW 10 before the communication model information is exchanged between the PF 20 and the GW 10) is changed according to the degree of convergence.

  As an example, the following equation can be considered.

閾値γは、任意に設定される値である。また２番目の式は、１と、（閾値γ／収束度）を整数に丸めた値との大きい方の値が、送信間隔となることを示す（整数に丸める方法は任意であり，小数点以下の切り捨て，切り上げ，四捨五入のいずれでもよい）。

The threshold value γ is a value set arbitrarily. The second expression indicates that the larger value of 1 and the value obtained by rounding (threshold γ / convergence degree) to an integer is the transmission interval (the method of rounding to an integer is arbitrary, the number after the decimal point Can be rounded down, rounded up, or rounded off).

  The magnitude of change in the standard error of the latest k pieces of communication model information is defined as the degree of convergence. As the convergence degree is closer to 0, the convergence is achieved, and as the convergence degree is larger, the convergence is not achieved. This calculation is performed by, for example, the aggregation learning unit 22 of the PF 20, and whenever new communication model information is learned based on the communication model information received from the GW 10, the transmission interval is set to the GW 10 together with the communication model information. Sent.

  When the convergence degree is larger than the threshold γ (not converged), the transmission interval is 1, that is, the communication model information is sequentially exchanged between the PF 20 and the GW 10 every time the communication model information is learned on the GW 10 side. . When the convergence degree is close to 0, the transmission interval becomes long.

  As described above, according to the present embodiment, the GW 10 does not sequentially transmit the communication characteristic value or the communication model information to the PF 20 every time data is received from the terminal, but periodically transmits the communication characteristic value or Communication model information is transmitted to PF20. As a result, the communication frequency between the GW 10 and the PF 20 can be reduced. In addition, the detection of the abnormality of the terminal is performed by using communication model information that is a learning result based on communication characteristic values acquired in a plurality of distributed GWs 10. Therefore, it is possible to achieve both ensuring of scalability in the network and highly accurate terminal abnormality detection using the communication model information. That is, it is possible to improve the efficiency of detecting an abnormality of a terminal connected to the network.

  Moreover, when communication model information is learned in each GW 10, the processing load in the PF 20 can be reduced.

  In the present embodiment, the GW 10 is an example of an abnormality detection device. The communication characteristic acquisition unit 12 is an example of an acquisition unit. The shared information transmission unit 14 is an example of a transmission unit. The aggregate information receiving unit 15 is an example of a receiving unit. The communication control unit 16 is an example of a detection unit. The distributed learning unit 13 is an example of a generation unit according to claim 2. The PF 20 is an example of an aggregation device. The intensive learning unit 22 is an example of a generation unit of claim 4.

  As mentioned above, although the Example of this invention was explained in full detail, this invention is not limited to such specific embodiment, In the range of the summary of this invention described in the claim, various deformation | transformation・ Change is possible.

1 Anomaly detection system 10 GW
11 Terminal accommodation unit 12 Communication characteristic acquisition unit 13 Distributed learning unit 14 Distributed information transmission unit 15 Aggregated information reception unit 16 Communication control unit 17 Distributed information storage unit 18 Comparison information storage unit 20 PF
21 Distributed Information Receiving Unit 22 Aggregate Learning Unit 23 Aggregated Information Transmitting Unit 24 Terminal Information Management Unit 25 Aggregated Information Storage Unit 26 Terminal Information Storage Unit 100 Drive Device 101 Recording Medium 102 Auxiliary Storage Device 103 Memory Device 104 CPU
105 Interface device B bus

Claims (6)

An anomaly detection device for detecting an anomaly of a terminal connected via a network,
An acquisition unit for acquiring characteristic values related to communication with the terminal;
Each time the characteristic value is acquired by the acquisition unit, a generation unit that generates a distribution model of the characteristic value based on a history of characteristic values acquired regarding communication with a terminal at a plurality of timings ;
For each predetermined interval, a transmission unit that transmits the distribution model generated by the generation unit to an aggregation device connected via a network;
Receiving for receiving and the distribution model transmitted by the transmitting unit, the abnormality detection distribution model of the characteristic values were the aggregation device is generated based on the previous SL distribution model about the terminal that is not connected to the device And
A detection unit that detects an abnormality of a terminal connected via a network based on a comparison between a distribution model received by the reception unit and a characteristic value related to communication with the terminal after the distribution model is received; ,
I have a,
The predetermined interval becomes longer according to the convergence of the distribution model generated by the aggregation device.
An abnormality detection device characterized by that. The transmission unit, each time the acquisition of the characteristic value by the acquisition unit reaches the number of times calculated based on the convergence status of the distribution model, the history of the acquired characteristic value, or the history based on the history Transmitting a distribution model of characteristic values to the aggregation device;
The abnormality detection device according to claim 1 . An abnormality detection system including a plurality of abnormality detection devices that detect an abnormality of a terminal connected via a network, and an aggregation device connected to the plurality of abnormality detection devices via a network,
The abnormality detection device is:
An acquisition unit for acquiring characteristic values related to communication with the terminal;
A first generation unit that generates a distribution model of the characteristic value based on a history of characteristic values acquired for communication with a terminal at a plurality of timings each time the characteristic value is acquired by the acquisition unit; ,
A transmission unit that transmits the distribution model generated by the first generation unit to the aggregation device at predetermined intervals ;
A receiving unit that receives the distribution model of the characteristic value generated by the aggregation device;
A detection unit that detects an abnormality of a terminal connected via a network based on a comparison between a distribution model received by the reception unit and a characteristic value related to communication with the terminal after the distribution model is received; Have
The aggregation device is
Have a second generation unit for generating a distribution model of said characteristic values based on the previous SL distribution model that will be transmitted from the plurality of abnormality detection device,
The predetermined interval becomes longer according to the convergence of the distribution model generated by the aggregation device.
An abnormality detection system characterized by that. An anomaly detection device that detects an anomaly in a terminal connected via a network
An acquisition procedure for acquiring characteristic values related to communication with the terminal,
Each time the characteristic value is acquired in the acquisition procedure, a generation procedure for generating a distribution model of the characteristic value based on a history of characteristic values acquired regarding communication with a terminal at a plurality of timings ;
A transmission procedure for transmitting the distribution model generated by the generation procedure to a concentrator connected via a network at predetermined intervals ;
Receiving for receiving and the distribution models that are sent, the distribution model of the abnormality detection the characteristic value the aggregation device is generated based on the previous SL distribution model about the terminal that is not connected to the device in the transmission procedure Procedure and
A detection procedure for detecting an abnormality of a terminal connected via a network based on a comparison between the distribution model received in the reception procedure and a characteristic value related to communication with the terminal after the distribution model is received; ,
The execution,
The predetermined interval becomes longer according to the convergence of the distribution model generated by the aggregation device.
An abnormality detection method characterized by that. An abnormality detection method executed by a plurality of abnormality detection devices that detect an abnormality of a terminal connected via a network, and an aggregation device connected to the plurality of abnormality detection devices via a network,
The abnormality detection device is
An acquisition procedure for acquiring characteristic values related to communication with the terminal,
A first generation procedure for generating a distribution model of the characteristic value based on a history of characteristic values acquired for communication with a terminal at a plurality of timings each time the characteristic value is acquired in the acquisition procedure; ,
A transmission procedure for transmitting the distribution model generated by the first generation procedure to a concentrator connected via a network at predetermined intervals ;
A reception procedure for receiving a distribution model of the characteristic value generated by the aggregation device;
A detection procedure for detecting an abnormality of a terminal connected via a network based on a comparison between the distribution model received in the reception procedure and a characteristic value related to communication with the terminal after the distribution model is received; Run
The aggregation device is
Run the second generation procedure for generating a distribution model of said characteristic values based on the previous SL distribution model that will be transmitted from the plurality of abnormality detection device,
The predetermined interval becomes longer according to the convergence of the distribution model generated by the aggregation device.
An abnormality detection method characterized by that. A program characterized by causing a computer to function as each section according to claim 1 or 2, wherein.

Images