# US 2019/0173902 A1 · Information processing device, information processing method, and recording medium storing program

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0173902 A1
- Document ID: US20190173902A1
- Status: Published application
- Kind: A1
- Application number: 16/255,877
- Filed: 2019-01-24
- Published: 2019-06-06
- Earliest claimed: 2016-12-06
- Assignees: Panasonic Intellectual Property Corporation of America
- Applicants: Panasonic Intellectual Property Corporation of America
- Inventors: RYOTA TAKAHASHI; TAKAMITSU SASAKI
- Web page: https://patentgrep.com/patent/US20190173902A1

## CPC

- G07C 5/008: {communicating information to a remotely located station (transmission systems for measured values G08C)}
- G06F 18/10: Pre-processing; Data cleansing
- G06F 18/213: Feature extraction, e.g. by transforming the feature space; Summarisation; Mappings, e.g. subspace methods
- G06F 18/217: {Validation; Performance evaluation; Active pattern learning techniques}
- G06F 18/24323: {Tree-organised classifiers}
- G06F 18/2433: Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection
- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 21/554: {involving event detection and direct action}
- G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
- G06N 20/00: Machine learning
- G06N 20/20: Ensemble learning
- G06N 99/00: Subject matter not provided for in other groups of this subclass
- H04L 12/40: Bus networks
- H04L 41/142: using statistical or mathematical methods
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- G07C 2009/00555: {comprising means to detect or avoid relay attacks}
- H04L 43/0823: Errors, e.g. transmission errors
- H04L 2012/40215: {Controller Area Network CAN}
- H04L 2012/40273: {the transportation system being a vehicle}
- G07C: TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Provided is an information processing device that includes a processor and has a capability to detect abnormalities on an in-vehicle network that may be caused by an attack. The processor receives input of data elements to be used as training data, normalizes the training data so as to be distributed within a first region, divides a multi-dimensional second region that encompasses the first region into third regions that are hypercubes of equal sizes, obtains S data elements that are contained by each of the third regions, and for each third region that includes a number of data elements that is less than a first threshold value T, adds noise elements that are vectors with a uniform distribution to the third regions, generates noise-added training data including the vectors in the second region, and generates and outputs Isolation Forest learning model data by using the generated noise-added training data.

## Claims

### Claim 1

An information processing device, comprising:
a processor; and
a memory that includes at least one set of instructions that, when executed by the processor, causes the processor to execute operations including:
obtaining training data for an Isolation Forest algorithm, the training data including N data elements, N being an integer that is greater than or equal to two, and each of the N data elements being an M-dimensional vector, M being an integer that is greater than or equal to two,
normalizing the training data so as to be distributed within an M-dimensional first region,
dividing a second region into LM third regions of equal sizes, L being an integer that is greater than or equal to four, and the second region being an M-dimensional region that is larger than the first region and encompasses the first region, each of the LM third regions being an M-dimensional hypercube,
obtaining S data elements included in each of the LM third regions, S being an integer that is greater than or equal to zero,
adding, to each of one or more third regions from among the LM third regions within which a value of S is less than a first threshold value T, T being an integer that is greater than or equal to one, D first noise elements in a uniform distribution, D being equal to a difference between T and S, and each of the D first noise elements being an M-dimensional vector,
generating noise-added training data that includes each of the N data elements and each of the D first noise elements, and
generating and outputting Isolation Forest learning model data by using the noise-added training data.

### Claim 2 (depends on 1)

The information processing device according to claim 1,
wherein the operations further include:
determining whether or not N is greater than or equal to a predetermined second threshold value, and
executing, when N is determined not to be greater than or equal to the predetermined second threshold value, the dividing and the adding, and thereafter executing the generating the noise-added training data and the generating and outputting the Isolation Forest learning model data.

### Claim 3 (depends on 2)

The information processing device according to claim 2,
wherein the operations further include:
adding, when N is determined to be greater than or equal to the predetermined second threshold value, K second noise elements with a uniform distribution within the second region, K being a natural number that is greater than or equal to zero and less than N, each of the K second noise elements being an M-dimensional vector,
and wherein the generating and outputting the Isolation Forest learning model data is executed after executing the adding of the K second noise elements.

### Claim 4 (depends on 2)

The information processing device according to claim 2,
wherein the operations further include:
when N is determined not to be greater than or equal to the predetermined second threshold value,
obtaining data for testing for the Isolation Forest algorithm, and
determining whether or not N is greater than or equal to a predetermined third threshold value,
when N is determined not to be greater than or equal to the predetermined third threshold value,
executing a set of operations that includes the dividing, the adding, the generating the noise-added training data, and the generating the Isolation Forest learning model data, a plurality of times using L different values, and outputting a respective set of learning model data for each executed set of operations,
executing an anomaly detection operation on the data for testing using each respective set of learning model data,
evaluating each respective set of learning model data based on a result of the executing the anomaly detection operation,
selecting a best set of learning model data from among the sets of learning model data based on a result of the evaluating, and
and when N is determined to be greater than or equal to the predetermined third threshold value,
executing the set of operations one time in the dividing, using L of a predetermined value.

### Claim 5 (depends on 4)

The information processing device according to claim 4,
wherein the operations further include:
determining, when N is determined not to be greater than or equal to the predetermined third threshold value, a number of different values of L, so as to have a negative correlation with the value of N.

### Claim 6 (depends on 1)

The information processing device according to claim 1,
wherein the operations further include:
determining a value of the first threshold value T as being equal to any number that is less than a median value of numbers of data elements included in each of the third regions within the first region.

### Claim 7 (depends on 3)

The information processing device according to claim 3,
wherein the operations further include:
when N is determined to be greater than or equal to the predetermined second threshold value,
obtaining data for testing for the Isolation Forest algorithm, and
determining whether or not N is greater than or equal to a predetermined fourth threshold value,
when N is determined not to be greater than or equal to the predetermined fourth threshold value,
executing a set of operations that includes the adding the K second noise elements, the generating the noise-added training data, and the generating the Isolation Forest learning model data, a plurality of times using K different values, and outputting a respective set of learning model data for each executed set of operations,
executing an anomaly detection operation on the data for testing using each respective set of learning model data,
evaluating each respective set of learning model data, and
selecting a best set of learning model data from among the sets of learning model data based on a result of the evaluating,
and when N is determined to be greater than or equal to the predetermined fourth threshold value,
executing the set of operations one time using K of a predetermined value.

### Claim 8 (depends on 7)

The information processing device according to claim 7,
wherein the operations further include:
determining, when N is determined not to be greater than or equal to the predetermined fourth threshold value, a number of different values of K, so as to have a negative correlation with the value of N.

### Claim 9 (depends on 1)

The information processing device according to claim 1,
wherein, the first region being defined by a hypercube of [0, 1]M in an M-dimensional space,
the second region is a region defined by a hypercube of [−0.5, 1.5]M in the space.

### Claim 10

An anomaly detection system comprising:
an information processing device connected to a network; and
an anomaly detection device connected to the network,
wherein the information processing device includes:
a first processor; and
a first memory that includes at least one set of instructions that, when executed by the first processor, causes the first processor to execute first operations including:
obtaining training data for an Isolation Forest algorithm, the training data including N data elements, N being an integer that is greater than or equal to two, and each of the N data elements being an M-dimensional vector, M being an integer that is greater than or equal to two,
normalizing the training data so as to be distributed within an M-dimensional first region,
dividing a second region into LM third regions of equal sizes, L being an integer that is greater than or equal to four, and the second region being an M-dimensional region that is larger than the first region and encompasses the first region, each of the LM third regions being an M-dimensional hypercube,
obtaining S data elements included in each of the LM third regions, S being an integer that is greater than or equal to zero,
adding, to each of one or more third regions from among the LM third regions within which a value of S is less than a first threshold value T, T being an integer that is greater than or equal to one, D first noise elements in a uniform distribution, D being equal to a difference between T and S, and each of the D first noise elements being an M-dimensional vector,
generating noise-added training data that includes each of the N data elements and the each of the D first noise elements, and
generating and outputting Isolation Forest learning model data by using the noise-added training data,
the anomaly detection device including:
a second processor,
a second memory that stores the learning model data output from the information processing device, and
a third memory that includes at least one set of second instructions that, when executed by the second processor, causes the second processor to execute second operations including:
obtaining data that flows through the network, and
executing an anomaly detection operation of the obtained data based on the learning model data stored in the second memory.

### Claim 11 (depends on 10)

The anomaly detection system according to claim 10,
wherein the network is an in-vehicle Controlled Area Network.

### Claim 12

An information processing method for an information processing device having a processor, the method comprising:
obtaining training data for an Isolation Forest algorithm, the training data including N data elements, N being an integer that is greater than or equal to two, and each of the N data elements being an M-dimensional vector, M being an integer that is greater than or equal to two;
normalizing the training data so as to be distributed within an M-dimensional first region;
dividing a second region into LM third regions of equal sizes, L being an integer that is greater than or equal to four, and the second region being an M-dimensional region that is larger than the first region and encompasses the first region, each of the LM third regions being an M-dimensional hypercube;
obtaining S data elements included in each of the LM third regions, S being an integer that is greater than or equal to zero;
adding, to each of one or more third regions from among the LM third regions within which a value of S is less than a first threshold value T, T being an integer that is greater than or equal to one, D first noise elements in a uniform distribution, D being equal to a difference between T and S, and each of the D first noise elements being an M-dimensional vector;
generating noise-added training data that includes each of the N data elements and each of the D first noise elements; and
generating and outputting Isolation Forest learning model data by using the noise-added training data.

### Claim 13

A computer-readable non-transitory recording medium storing a program for an information processing device having a processor,
wherein, when executed by the processor, the program causes the processor to implement a method including:
obtaining training data for an Isolation Forest algorithm, the training data including N data elements, N being an integer that is greater than or equal to two, and each of the N data elements being an M-dimensional vector, M being an integer that is greater than or equal to two,
normalizing the training data so as to be distributed within an M-dimensional first region,
dividing a second region into LM third regions of equal sizes, L being an integer that is greater than or equal to four, and the second region being an M-dimensional region that is larger than the first region and encompasses the first region, each of the LM third regions being an M-dimensional hypercube,
obtaining S data elements included in each of the LM third regions, S being an integer that is greater than or equal to zero,
adding, to each of one or more third regions from among the LM third regions within which a value of S is less than a first threshold value T, T being an integer that is greater than or equal to one, D first noise elements in a uniform distribution, D being equal to a difference between T and S, and each of the D first noise elements being an M-dimensional vector,
generating noise-added training data that includes each of the N data elements and each of the D first noise elements, and
generating and outputting Isolation Forest learning model data by using the noise-added training data.