# US 2020/0401497 A1 · Sensing device, sensing method, and sensing program > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0401497 A1 - Document ID: US20200401497A1 - Status: Published application - Kind: A1 - Application number: 16/975,410 - Filed: 2019-02-25 - Published: 2020-12-24 - Earliest claimed: 2018-03-01 - Assignees: Nippon Telegraph and Telephone Corporation - Applicants: Nippon Telegraph and Telephone Corporation - Inventors: Takuya SAEKI; Iifan TYOU; Yukio NAGAFUCHI; Masaki TANIKAWA - Web page: https://patentgrep.com/patent/US20200401497A1 ## CPC - G06F 11/3452: {Performance evaluation by statistical analysis} - G06F 11/3447: {Performance evaluation by modeling} - H04L 12/66: Arrangements for connecting between networks having differing types of switching systems, e.g. gateways - H04L 41/16: using machine learning or artificial intelligence - G06F 2201/81: Threshold - G06N 20/00: Machine learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A detecting device includes a memory, and processing circuitry coupled to the memory and configured to collect communication information from a communication device, have a model learn a characteristic of the communication information by the communication device using the communication information collected for each of the communication devices, and input communication information on a detection target to the model, detect whether the communication information on the detection target indicates abnormal communication on the basis of an output result from the model, and have the model relearn at the learning when the number of detected abnormalities about the communication information during a predetermined evaluation period exceeds a first threshold value. ## Claims ### Claim 1 A detecting device comprising: a memory; and processing circuitry coupled to the memory and configured to: collect communication information from a communication device, have a model learn a characteristic of the communication information by the communication device using the communication information collected for each of the communication devices, and input communication information on a detection target to the model, detect whether the communication information on the detection target indicates abnormal communication on the basis of an output result from the model, and have the model relearn at the learning when the number of detected abnormalities about the communication information during a predetermined evaluation period exceeds a first threshold value. ### Claim 2 (depends on 1) The detecting device according to claim 1, wherein the processing circuitry is further configured to: evaluate the model after learning at the learning on the basis of the number of detected abnormalities about the communication information and the number of learning times, set a parameter for a model corresponding to a communication device evaluated at the evaluating to have a smaller number of learning times than a prescribed number and a greater number of detected abnormalities than a second threshold value, the parameter being related to communication information on the communication device to be learned by the model, and have the model relearn according to the parameter set at the setting. ### Claim 3 (depends on 2) The detecting device according to claim 2, wherein the processing circuitry is further configured to set a learning period for the model corresponding to the communication device evaluated at the evaluating to have a smaller number of learning times than the prescribed number and a greater number of detected abnormalities than the second threshold value, the learning period being set according to the number of detected abnormalities about the communication device. ### Claim 4 (depends on 2) The detecting device according to claim 2, wherein the processing circuitry is further configured to classify, as a communication device other than a learning target, the communication device evaluated to have a number of learning times reaching the prescribed number and a greater number of detected abnormalities than the second threshold value and exclude the device from the learning target. ### Claim 5 (depends on 2) The detecting device according to claim 2, wherein the processing circuitry is further configured to set the second threshold value according to a likelihood calculated according to the number of communication patterns and the number of communication occurrences during learning by the model. ### Claim 6 (depends on 5) The detecting device according to claim 5, wherein the processing circuitry is further configured to set the second threshold value to be lower than a prescribed value when the calculated likelihood is lower than a prescribed value. ### Claim 7 A method for detecting by a detecting device, comprising: collecting communication information from a communication device; having a model learn a characteristic of communication information by the communication device using the communication information collected for each of the communication devices; inputting communication information on a detection target to the model and detecting whether the communication information on the detection target indicates abnormal communication on the basis of an output result from the model; and performing relearning by the model when the number of detected abnormalities about the communication information during a determined evaluation period exceeds a first threshold value. ### Claim 8 A non-transitory computer-readable recording medium storing therein a detecting program causing a computer to execute a process comprising: collecting communication information from a communication device; having a model learn a characteristic of communication information by the communication device using the communication information collected for each of the communication devices; inputting communication information on a detection target to the model and detecting whether the communication information on the detection target indicates abnormal communication on the basis of an output result from the model; and performing relearning by the model when the number of detected abnormalities about the communication information during a determined evaluation period exceeds a first threshold value.