Detection device, detection method, and detection program

A detection method performed by a computer, the detection method comprising:

• converting a target packet into a feature value using a first natural language processing model that has been trained using normal communication packets as learning data;
• assigning a label to the feature value converted using the first natural language processing model, based on the feature value converted using the first natural language processing model, a packet feature value obtained in advance, a label assigned to each packet feature value, and a threshold used in the determination, and;
• determining whether the target packet has an anomaly based on the assigned label.

A non-transitory computer readable storage medium having a detection program stored thereon that, when executed by a processor, causes the processor to perform operations comprising:

• converting a target packet into a feature value using a first natural language processing model that has been trained using normal communication packets as learning data;
• assigning a label to the feature value converted using the first natural language processing model, based on the feature value converted using the first natural language processing model, a packet feature value obtained in advance, a label assigned to each packet feature value, and a threshold used in the determination, and;
• determining whether the target packet has an anomaly based on the assigned label.