# US 12,113,816 B2 · Anomaly detection device, anomaly detection method and anomaly detection program > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,816 B2 - Document ID: US12113816B2 - Status: Granted - Kind: B2 - Application number: 17/626,817 - Filed: 2019-07-23 - Published: 2022-08-18 - Granted: 2024-10-08 - Earliest claimed: 2019-07-23 - Assignees: Nippon Telegraph and Telephone Corporation - Applicants: Nippon Telegraph and Telephone Corporation - Inventors: Naoto Fujiki; Takuya Minami; Masanori Shinohara - Web page: https://patentgrep.com/patent/US12113816B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 41/142: using statistical or mathematical methods - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/16: Threshold monitoring - H04L 12/4625: {Single bridge functionality, e.g. connection of two networks over a single bridge} - H04L 43/08: Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters - H04L 43/0876: Network utilisation, e.g. volume of load or congestion level - H04L 43/103: with adaptive polling, i.e. dynamically adapting the polling rate - H04L 43/50: Testing arrangements - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An acquisition unit acquires a communication feature for normal communication of communication equipment. If a data count or a data acquisition period for the acquired communication feature exceeds a predetermined value, an amplification unit amplifies the data count for the communication feature by a plurality of predetermined schemes in accordance with data counts for respective groups, each group sharing a same 5-tuple. A creation unit creates, for each of the predetermined schemes, reference value information for normal communication of the communication equipment through learning using the amplified communication feature. A determination unit determines accuracy of abnormality detection for each of the predetermined schemes using an anomaly score representing a deviation of test data representing a communication feature for abnormal communication from the reference value information. A selection unit selects the reference value information created by one of the schemes, the determined accuracy for which is highest. ## Claims ### Claim 1 An abnormality detection device comprising: a memory; and a processor coupled to the memory and programmed to execute a process comprising: acquiring a communication feature for normal communication of communication equipment; amplifying, if a data count or a data acquisition period for the acquired communication feature exceeds a predetermined value, the data count for a communication feature by a plurality of predetermined schemes in accordance with data counts for respective groups, each group sharing a same 5-tuple; creating, for each of the predetermined schemes, reference value information for normal communication of the communication equipment through learning using the amplified communication feature; determining accuracy of abnormality detection for each of the predetermined schemes using an anomaly score representing a deviation of test data representing a communication feature for abnormal communication from the reference value information; and selecting the reference value information created by one of the schemes, the determined accuracy for which is highest. ### Claim 2 (depends on 1) The abnormality detection device according to claim 1, wherein the determining determines, as the accuracy, a degree to which a plurality of pieces of test data constituting the test data can be detected to be abnormal on the basis of an anomaly score. ### Claim 3 (depends on 1) The abnormality detection device according to claim 1, wherein the determining uses data for each group sharing the same 5-tuple to generate, as the test data, a data set composed of a plurality of pieces of test data generated by varying a group, for which the communication feature except the 5-tuple is to be varied, and a value of the communication feature. ### Claim 4 (depends on 1) The abnormality detection device according to claim 1, wherein the process further comprises: secondary creating, if the data count or the data acquisition period for the acquired communication feature exceeds a second predetermined value larger than the predetermined value, reference value information for normal communication of the communication equipment through learning using the communication feature; secondary determining accuracy of abnormality detection using an anomaly score representing a deviation of test data representing a communication feature for abnormal communication from the reference value information; and secondary selecting the reference value information created by the secondary creating if the accuracy determined by the secondary determining is not less than a predetermined threshold and changes a data count or a data acquisition period used for learning by the secondary creating if the accuracy is less than the predetermined threshold. ### Claim 5 (depends on 4) The abnormality detection device according to claim 4, wherein if the data count or the data acquisition period for the acquired communication feature exceeds the second predetermined value larger than the predetermined value, and the secondary creating further acquires the communication feature for a predetermined data count or data acquisition period, the secondary creating creates reference value information for normal communication of the communication equipment through learning using a communication feature for the second predetermined value, and the secondary selecting increases the data count or the data acquisition period used for learning by the secondary creating if the accuracy is less than the predetermined threshold. ### Claim 6 (depends on 1) The abnormality detection device according to claim 1, wherein the amplifying determines one of the schemes by combining either one of a scheme for performing amplification while maintaining percentages of the data counts for the respective groups and a scheme for performing amplification so as to equalize the data counts for the respective groups and either one of a scheme for performing amplification by copying a value of the acquired communication feature and a scheme for performing amplification by changing a value of the communication feature except a 5-tuple by a percentage in a predetermined range. ### Claim 7 An abnormality detection method to be executed by an abnormality detection device, the method comprising: an acquiring step of acquiring a communication feature for normal communication of communication equipment; an amplifying step of, if a data count or a data acquisition period for the acquired communication feature exceeds a predetermined value, amplifying the data count for a communication feature by a plurality of predetermined schemes in accordance with data counts for respective groups, each group sharing a same 5-tuple; a creating step of creating, for each of the predetermined schemes, reference value information for normal communication of the communication equipment through learning using the amplified communication feature; a determining step of determining accuracy of abnormality detection for each of the predetermined schemes using an anomaly score representing a deviation of test data representing a communication feature for abnormal communication from the reference value information; and a selecting step of selecting the reference value information created by one of the schemes, the determined accuracy for which is highest. ### Claim 8 A non-transitory computer-readable recording medium having stored an abnormality detection program for causing a computer to execute: an acquiring step of acquiring a communication feature for normal communication of communication equipment; an amplifying step of, if a data count or a data acquisition period for the acquired communication feature exceeds a predetermined value, amplifying the data count for a communication feature by a plurality of predetermined schemes in accordance with data counts for respective groups, each group sharing a same 5-tuple; a creating step of creating, for each of the predetermined schemes, reference value information for normal communication of the communication equipment through learning using the amplified communication feature; a determining step of determining accuracy of abnormality detection for each of the predetermined schemes using an anomaly score representing a deviation of test data representing a communication feature for abnormal communication from the reference value information; and a selecting step of selecting the reference value information created by one of the schemes, the determined accuracy for which is highest.