Back to results
US 11,962,479 B2Granted
Abnormality detection method and abnormality detection device
AssigneePanasonic Intellectual Property Corporation of America
InventorTatsumi Oba
Life of this patent
Estimating the term…
Abstract
In an abnormality detection method, for a detection target packet stream made up of a plurality of detection target packets that are consecutive, a plurality of distances between the plurality of detection target packets are calculated, a feature amount of the detection target packet stream is extracted using the plurality of distances calculated, and information about the degree of abnormality in the detection target packet stream is calculated using the extracted feature amount.
Claims12
An abnormality detection method, comprising:
- calculating, for a detection target packet stream made up of a plurality of detection target packets that are consecutive, a plurality of distances between the plurality of detection target packets;
- extracting a feature amount of the detection target packet stream using the plurality of distances calculated;
- and
- calculating information about a degree of abnormality in the detection target packet stream using the feature amount extracted, wherein
- in the calculating of the plurality of distances, a Levenshtein distance between payloads of the plurality of detection target packets is used to calculate the plurality of distances,
- the Levenshtein distance between the payloads of the plurality of detection target packets is calculated for each pair of detection target packets that are N packets apart from each other in the detection target packet stream, and the calculation is applied in units of M bits to at least a portion of bit strings included in the payloads, N being an integer greater than or equal to 1, M being an integer between 1 and 16, inclusive,
- in the calculating of the plurality of distances, a distance for each pair of detection target packets that are N packets apart from each other in the detection target packet stream is calculated to calculate the plurality of distances, and
- in the extracting of the feature amount, for each of one or more windows made up of W consecutive detection target packets in the detection target packet stream, a frequency distribution of the plurality of distances calculated for pairs of detection target packets belonging to the window is calculated, and the frequency distribution calculated is extracted as the feature amount, W being an integer greater than or equal to 2.
5 more elements
An abnormality detection device, comprising:
- a processor;
- and
- memory including at least one set of instructions that, when executed by the processor, causes the processor to perform operations including:
- calculating, for a detection target packet stream made up of a plurality of detection target packets that are consecutive, a plurality of distances between the plurality of detection target packets;
- extracting a feature amount of the detection target packet stream using the plurality of distances calculated;
- and
- calculating information about a degree of abnormality in the detection target packet stream using the feature amount extracted, wherein
- in the calculating of the plurality of distances, a Levenshtein distance between payloads of the plurality of detection target packets is used to calculate the plurality of distances,
- the Levenshtein distance between the payloads of the plurality of detection target packets is calculated for each pair of detection target packets that are N packets apart from each other in the detection target packet stream, and the calculation is applied in units of M bits to at least a portion of bit strings included in the payloads, N being an integer greater than or equal to 1, M being an integer between 1 and 16, inclusive,
- in the calculating of the plurality of distances, a distance for each pair of detection target packets that are N packets apart from each other in the detection target packet stream is calculated to calculate the plurality of distances, and
- in the extracting of the feature amount, for each of one or more windows made up of W consecutive detection target packets in the detection target packet stream, a frequency distribution of the plurality of distances calculated for pairs of detection target packets belonging to the window is calculated, and the frequency distribution calculated is extracted as the feature amount, W being an integer greater than or equal to 2.
8 more elements
Dependencies are inferred from the claim text.