Anomaly detection device, anomaly detection method, and anomaly detection program
AssigneeNTT, Inc.
InventorYuki Yamanaka
Life of this patent
Estimating the term…
Abstract
An abnormality detection device includes processing circuitry configured to input a normal packet to a Bidirectional Encoder Representations from Transformers (BERT) model learned using the normal packet, and acquire a size of Attention for each byte portion when encoding of the normal packet is performed, sample an important byte portion of the normal packet based on the size of the Attention of each byte portion of the normal packet acquired, and rewrite the sampled important byte portion to a random byte to generate a pseudo-abnormal packet, and determine a threshold value of an abnormality degree for detecting an abnormal packet based on the abnormality degree of the generated pseudo-abnormal packet group and normal packet group.
Claims6
An abnormality detection device comprising:
- processing circuitry configured to:
- input a normal packet to a Bidirectional Encoder Representations from Transformers (BERT) model learned using the normal packet, and acquire a size of Attention for each byte portion when encoding of the normal packet is performed;
- sample an important byte portion of the normal packet based on the size of the Attention of each byte portion of the normal packet acquired, and rewrite the sampled important byte portion to a random byte to generate a pseudo-abnormal packet;
- and
- determine a threshold value of an abnormality degree for detecting an abnormal packet based on the abnormality degree of the generated pseudo-abnormal packet group and normal packet group.
An abnormality detection method executed by an abnormality detection device, the abnormality detection method comprising:
- inputting a normal packet to a Bidirectional Encoder Representations from Transformers (BERT) model learned using the normal packet, and acquiring a size of Attention for each byte portion when encoding of the normal packet is performed;
- sampling an important byte portion of the normal packet based on the size of the Attention of each byte portion of the normal packet acquired, and rewriting the sampled important byte portion to a random byte to generate a pseudo-abnormal packet;
- and
- determining a threshold value of an abnormality degree for detecting an abnormal packet based on the abnormality degree of the generated pseudo-abnormal packet group and normal packet group.
A non-transitory computer-readable recording medium storing therein an abnormality detection program that causes a computer to execute a process comprising:
- inputting a normal packet to a Bidirectional Encoder Representations from Transformers (BERT) model learned using the normal packet, and acquiring a size of Attention for each byte portion when encoding of the normal packet is performed;
- sampling an important byte portion of the normal packet based on the size of the Attention of each byte portion of the normal packet acquired, and rewriting the sampled important byte portion to a random byte to generate a pseudo-abnormal packet;
- and
- determining a threshold value of an abnormality degree for detecting an abnormal packet based on the abnormality degree of the generated pseudo-abnormal packet group and normal packet group.
Dependencies are inferred from the claim text.