US 2026/0254728 A1 · LEARNING DEVICE, LEARNING METHOD, AND LEARNING PROGRAM

Abstract

A learning device acquires over-detection alerts in an anomaly detector. Then, the learning device clusters the acquired over-detection alerts into a plurality of clusters by using a Gaussian Mixture Model. Next, the learning device sorts, for each of the clusters, over-detection alerts belonging to the cluster in time series, and specifies a period of the sorted over-detection alerts. Then, the learning device samples the over-detection alerts from the cluster with the specified period. Thereafter, the learning device performs over-detection feedback for the anomaly detector by using the over-detection alerts sampled from each cluster.

Claims7

Dependent claims

A learning device comprising:

a memory;
and
a processor coupled to the memory and programmed to execute a process comprising:
acquiring communication feature values of communication over-detected in an anomaly detector that detects an anomaly in communication;
clustering the acquired communication feature values into a plurality of clusters;
sorting, for each of the clusters, communication feature values belonging to the cluster in time series, specifying a period of the sorted communication feature values, and sampling the communication feature values with the specified period;
and
performing additional learning for over-detection feedback on the anomaly detector by using the communication feature values sampled from each of the clusters.

5 more elements

Dependencies are inferred from the claim text.

Learning device, learning method, and learning program

Life of this patent

Learning device, learning method, and learning program

Life of this patent

Abstract

Claims7