JP7297860B1 - Information processing device, information processing method and program - Google Patents

Abstract

Kind Code: A1 When arithmetic operations are performed by a learning device based on electric power data, noise included in the electric power data is suppressed while suppressing loss of characteristic information included in the electric power data while suppressing the amount of computation. To provide an information processing device capable of An information processing apparatus includes an acquisition unit that acquires power data transmitted inside a target device, and frequency domain data obtained by Fourier transforming the power data acquired by the acquisition unit as first time domain data. a Fourier transform unit for transforming into a Fourier transform, a digital filter unit for performing digital filter processing for suppressing noise for a predetermined event on the frequency domain data transformed by the Fourier transform unit, and the digital filter processing being performed by the digital filter unit and an inverse Fourier transform unit for transforming the obtained result into second time domain data. [Selection drawing] Fig. 1

Description

The present disclosure relates to an information processing device, an information processing method, and a program.

In the image processing apparatus described in Patent Document 1, smoothing processing is performed on image data using a smoothing filter. For example, an integration filter is used as the smoothing filter (see Patent Document 1).
For example, a smoothing process is realized by performing a moving average process using such an integration filter.

In the information processing apparatus described in Patent Document 2, when signal processing is performed using a neural network, a complex pooling layer serving as a low-pass filter or band-pass filter is used (see Patent Document 2).

JP 2005-101775 A WO2021/049005

For example, it is conceivable to detect an abnormality or the like by performing machine learning calculations based on power data of a target device (target device).
However, in a configuration in which smoothing processing is performed on the power data before the machine learning calculation, if smoothing processing using a moving average is used, information necessary for the machine learning calculation is obtained from the power data. It may disappear and the processing load may increase.

In recent years, the internal operations of devices such as communication devices have become more complicated and faster. Such equipment may be equipped with many functions, and may operate multiple applications in a time-sharing manner.
Therefore, the waveform of the power transmitted inside such a device becomes complicated, and the fluctuation of the power caused by the operation of the device may also be a fine fluctuation. Then, the power may contain finer noise than the fine fluctuations caused by the operation of the device.

In this way, in addition to fine fluctuations caused by the internal operation of the device, power data may contain noise that fluctuates more finely than such fluctuations. When performing machine learning calculations on such power data, it is necessary to suppress noise that causes finer fluctuations while retaining characteristic information resulting from the operation of the device. However, such noise cannot be suppressed with high accuracy by smoothing processing using a moving average.

As described above, with the smoothing processing technique described in Patent Document 1, there are cases where the feature amount of the power data cannot be extracted with high accuracy in a configuration in which machine learning of the power data is performed.
Furthermore, in the smoothing processing technique described in Patent Literature 1, the moving average may repeat the averaging processing multiple times for the same data portion, which may increase the processing load.
Note that the technique related to machine learning described in Patent Literature 2 does not pay attention to such problems and does not solve such problems.

Here, the smoothing process and feature value extraction in machine learning have been described above as an example, but the present invention is not limited to this. It has been desired to increase the accuracy and reduce the amount of computation.

In view of such circumstances, the embodiments of the present disclosure suppress the loss of characteristic information included in the power data while suppressing the amount of computation when the learning unit performs calculations based on the power data. An information processing apparatus, an information processing method, and a program capable of suppressing noise included in the power data are provided.

One aspect of the present disclosure is an acquisition unit that acquires power data transmitted inside a target device, and the power data acquired by the acquisition unit is converted into frequency domain data by Fourier transform as first time domain data. a Fourier transform unit that performs digital filter processing for suppressing noise for a predetermined event on the frequency domain data transformed by the Fourier transform unit; and the digital filter unit that performs the digital filter processing. an inverse Fourier transform unit that transforms a result into second time domain data; A computing unit that performs at least one of computation for learning and computation by a learned learner that performs computation for acquiring information about the predetermined event; sequentially switch to different characteristics, acquire the value obtained by the calculation of the calculation unit when switching to each characteristic, and determine a good characteristic among these multiple characteristics based on the acquired value and a digital filter characteristic adjustment unit that adjusts the characteristics of the digital filter processing by setting the digital filter to be used as a digital filter .

In one aspect of the present disclosure, an acquisition unit acquires power data transmitted inside a target device, and a Fourier transform unit performs Fourier transform on the power data acquired by the acquisition unit as first time domain data. to frequency domain data, a digital filter section performs digital filter processing for suppressing noise for a predetermined event on the frequency domain data converted by the Fourier transform section, and an inverse Fourier transform section performs the digital filter section transforms the digitally filtered result into second time domain data, and a computing unit receives the second time domain data transformed by the inverse Fourier transform unit to obtain information about the predetermined event performs at least one of an operation for learning by a learner that performs an operation to acquire, or an operation by a learned learner that performs an operation to acquire information about the predetermined event, and a digital filter characteristic adjustment unit, sequentially switching the characteristics of the digital filtering process of the digital filter unit to a plurality of different characteristics, obtaining the values obtained by the calculation of the calculation unit when switching to each characteristic, and based on the obtained values and adjusting the characteristics of the digital filtering process by determining and setting to use a favorable characteristic among the plurality of characteristics.

According to one aspect of the present disclosure, a computer has an acquisition function for acquiring power data transmitted inside a target device; a Fourier transform function for converting data into data; a digital filter function for applying digital filter processing to suppress noise for a predetermined event on the frequency domain data transformed by the Fourier transform function; An inverse Fourier transform function for transforming the applied result into second time domain data, and the second time domain data transformed by the inverse Fourier transform function are input to perform an operation for acquiring information about the predetermined event. an arithmetic function that performs at least one of an arithmetic operation for learning by a learning device and an arithmetic operation by a learned learner that performs an arithmetic operation for acquiring information about the predetermined event; The characteristic is switched to a plurality of different characteristics in order, the value obtained by the calculation of the arithmetic function when switching to each characteristic is obtained, and based on the obtained value, a good characteristic among the plurality of characteristics is obtained. A program for realizing a digital filter characteristic adjustment function that adjusts the characteristics of the digital filtering process by determining characteristics and setting them to be used.

According to the information processing device, the information processing method, and the program described above, when the learning device performs calculations based on power data, the amount of calculation is suppressed, and loss of characteristic information contained in the power data is suppressed. while suppressing noise contained in the power data.

1 is a diagram illustrating a schematic configuration example of an information processing system according to an embodiment; FIG. 1 is a diagram illustrating a schematic configuration example of an information processing apparatus according to an embodiment; FIG. It is a figure which shows an example of the hardware constitutions of the information processing apparatus which concerns on embodiment. It is a figure which shows an example of the machine-learning process which concerns on embodiment. It is a figure which shows an example of the smoothing process which concerns on embodiment. It is a figure which shows the structural example of the part of the feature-value extraction part regarding the electric power data which concerns on embodiment, and machine-learning modeling. It is a figure showing an example of an information processing system containing a power supply concerning an embodiment. It is a figure which shows an example of the electric power data resulting from AES which concerns on embodiment. It is a figure which shows an example of the result of having smoothed the electric power data resulting from AES which concerns on embodiment. It is a figure which shows an example of the electric power data resulting from DD which concerns on embodiment. It is a figure which shows an example of the result of having smoothed the electric power data resulting from DD which concerns on embodiment. It is a figure which shows an example of the power data resulting from HTTP which concerns on embodiment. It is a figure which shows an example of the result of the smoothing process of the power data resulting from HTTP which concerns on embodiment. It is a figure which shows an example of the electric power data resulting from TFTP which concerns on embodiment. It is a figure which shows an example of the result of having smoothed the electric power data resulting from TFTP which concerns on embodiment. It is a figure which shows an example of the smoothing process which concerns on a comparative example. FIG. 10 is a diagram showing an example of a result of smoothing power data caused by AES according to a comparative example; FIG. 10 is a diagram showing an example of a result of smoothing power data caused by DD according to a comparative example; FIG. 10 is a diagram showing an example of a result of smoothing power data caused by HTTP according to a comparative example; FIG. 10 is a diagram showing an example of a result of smoothing power data caused by TFTP according to a comparative example;

Embodiments of the present disclosure will be described in detail with reference to the drawings.

[Information processing system]
FIG. 1 is a diagram showing a schematic configuration example of an information processing system 1 according to an embodiment.
The information processing system 1 includes an information processing device 11 , a target device 12 and a connection line 13 .
The information processing device 11 performs a process of acquiring information about a predetermined event based on power data transmitted inside the target device 12 . That is, the target device 12 is a device on which the processing is performed by the information processing device 11 .

The target device 12 may be any device in which power is transmitted within the target device 12 .
As a specific example, the target device 12 may be any electronic device such as a communication device, a computer, or a home appliance.

The information processing device 11 and the target device 12 are connected via a connection line 13 .
In this embodiment, the information processing apparatus 11 receives a signal related to power transmitted inside the target device 12 via the connection line 13 and acquires data on the power.

The connection line 13 is not particularly limited, and may be, for example, a power line or a communication line having a function of transmitting power.
In this embodiment, the connection line 13 is wired, but as another configuration example, a wireless connection may be used instead of the wired connection line 13 .
As a specific example, a configuration may be used in which the information processing apparatus 11 receives wireless signals generated due to power transmitted inside the target device 12 and acquires data on the power. The signal may be, for example, an electric field signal or a magnetic field signal.

[Information processing device]
FIG. 2 is a diagram showing a schematic configuration example of the information processing device 11 according to the embodiment.
The information processing device 11 is configured using a computer, for example.
The information processing device 11 includes an input unit 111, an output unit 112, a storage unit 113, a communication unit 114, an acquisition unit 131, a Fourier transform unit 132, a digital filter unit 133, an inverse Fourier transform unit 134, A calculation unit 135 and a digital filter characteristic adjustment unit 136 are provided.
The calculation unit 135 includes a feature quantity extraction unit 151 and a learning device 152 .

The input unit 111 inputs information from the outside. The input unit 111 has, for example, an operation unit that receives an operation performed by an operator (for example, a person), and inputs information according to the operation received by the operation unit.
The operation unit may have, for example, a function of accepting operations of a touch panel, or may have a function of accepting operations of physical keys. Also, the operation unit may have a function of receiving an operation by voice (for example, an operator's voice).
Also, the input unit 111 may be connected to an external device to input information output from the external device.
The external device may be, for example, a portable recording medium.

The output unit 112 outputs information. The output unit 112 has, for example, a display unit, and displays (outputs) information on the screen of the display unit. The screen may have a touch panel function.
Also, the output unit 112 may be connected to an external device and output information to the external device.
The external device may be, for example, a portable recording medium.
The output unit 112 may output information in a form other than display, such as outputting audio.
Here, although the input unit 111 and the output unit 112 are shown as separate functional units in this embodiment, the input unit 111 and the output unit 112 may be configured as a common functional unit (input/output unit). .

Storage unit 113 stores information.
The communication unit 114 communicates information.
Here, in the present embodiment, the communication unit 114 is shown as a functional unit separate from the input unit 111 and the output unit 112. Also, the transmission function of the communication unit 114 may be considered to be included in the function of the output unit 112 .

The acquisition unit 131 acquires power data transmitted inside the target device 12 .
Here, in the present embodiment, the acquisition unit 131 acquires power data transmitted inside the target device 12 via the connection line 13 .

The connection line 13 may be connected to any part of the target device 12, for example, a terminal for inputting power to the target device 12 from the outside, or a terminal for outputting power from the target device 12 to the outside. may be connected to
Here, it may be arbitrarily designed as to which location inside the target device 12 the acquisition unit 131 acquires the data of the power transmitted.

Further, the connection line 13 may be connected to any part of the information processing device 11, for example, a terminal for outputting power to the outside (in this embodiment, the target device 12), or an external (in this embodiment, the target device 12). Then, it may be connected to a terminal for inputting power output from the target device 12).
Note that such terminals in the information processing apparatus 11 are, for example, a terminal for inputting by the input unit 111 (a terminal for inputting from the outside), a terminal for outputting by the output unit 112 (a terminal for outputting to the outside). terminal), or one or more of terminals for performing communication by the communication unit 114 (terminals for communicating with the outside) may be used.

The Fourier transform unit 132 transforms the power data acquired by the acquisition unit 131 into data in the time domain (also referred to as first time domain for convenience of explanation) by Fourier transform.
Here, the Fourier transform unit 132 treats the power data acquired by the acquisition unit 131 as time-series data. In the present embodiment, time-series power data is originally used as the power data. may be regarded as time-series data, and the processing after the Fourier transform unit 132 may be performed.

Note that time-series power data includes, for example, power data obtained as a result of acquiring data values at regular time intervals, or predetermined processing (for example, level adjustment processing, etc.) performed on the power data. However, as another example, power data obtained as a result of obtaining data values at irregular time intervals (that is, non-constant time intervals), or predetermined processing on the power data Data obtained as a result of (for example, level adjustment processing, etc.) may be used.

For example, time information (for example, time stamp) representing the time corresponding to each data value may be added to the data values that constitute the time-series power data. In this case, the information processing device 11 may determine the time corresponding to each data value based on the time information. The time information may represent the time when the data value corresponding to the time information is detected.
Here, the acquisition unit 131 of the information processing device 11 may add the time information to the data value when acquiring each data value.
As another example, the time information may not be attached to the data value. In this case, the information processing apparatus 11 treats the data values, for example, assuming that they are data values arranged at regular time intervals in the order in which the data values constituting the power data acquired by the acquisition unit 131 are arranged. good too.

In this embodiment, the acquisition unit 131 of the information processing device 11 acquires time-series power data from the target device 12 in real time. may acquire power data stored in a storage unit (not shown).
That is, in the present embodiment, the power data to be processed by the information processing apparatus 11 may not necessarily be real-time power data, and may be power data once stored in an arbitrary storage unit, for example. .

As the Fourier transform, for example, a fast Fourier transform (FFT) may be used.

The digital filter section 133 performs predetermined digital filter processing on the frequency domain data transformed by the Fourier transform section 132 . This converts the time series data into frequency band data.
In this embodiment, the digital filtering process is digital filtering process for suppressing noise for a predetermined event.

Here, various events may be used as the predetermined event.
For example, the predetermined event may be an event related to an abnormality, and as a specific example, it may be an attack on security.
The attack may be, for example, a side-channel attack.
The attack may be, for example, a malware attack. Malware is malicious software (programs, etc.).
Also, the predetermined event may be, for example, an event related to a failure of the target device 12 .

For example, a machine learning arithmetic algorithm is used to determine that an abnormality has occurred when a specific state (for example, a state including a specific feature amount) occurs in the power data of the target device 12. may be The specific state (for example, the state including the specific feature amount) may be a state that does not occur in the power data in the target device 12 during normal operation.

It should be noted that the power state during normal operation and the power state when an abnormality occurs in the target device 12 may differ for each device used as the target device 12, for example.
A parameter for detecting the specific state (for example, a state including the specific feature amount) may be arbitrarily set in the information processing device 11 for each device used as the target device 12 . This setting may be performed, for example, by a person (user) operating the device (for example, the information processing device 11), or automatically by the device (for example, the information processing device 11) in a predetermined manner. may be done.

In this embodiment, for example, a component that is considered to degrade the accuracy of the information about the predetermined event acquired by the learning device 152 of the calculation unit 135 is regarded as noise and suppressed by digital filtering.
Further, for example, a component that does not degrade the accuracy of information related to a predetermined event acquired by the learning device 152 of the calculation unit 135 but is considered to be irrelevant to the information may be regarded as noise.
Note that the noise may be set based on other criteria.

Here, the waveform of the power data (power waveform) in the target device 12 includes, for example, a steady power waveform, a specific process power waveform, and a noise waveform, which are superimposed.
The steady-state power waveform in the target device 12 is the power data waveform (here, except for the noise waveform) when power is being supplied to the target device 12 (energized) but no specific processing is being performed. ).
The specific process may be any process, and may be, for example, a process performed in response to the operation of the target device 12 by a person (user). In this case, the power when the target device 12 is not operated by a person is the constant power (here, the noise waveform is excluded). The steady-state power may be, for example, power resulting from the operating system (OS: Operating System) of the target device 12 operating.
Note that the steady power does not necessarily have to be constant power, and may be power that fluctuates around a predetermined power value, for example.

Normally, when a specific process is performed, the value of power data rises with respect to steady power.
Specific processing power represents a waveform of power generated in the power data due to power used when a specific process is being performed (eg, a waveform of power included in constant power). The specific process is a process of generating power other than steady-state power in the power data.
The specific processing is, for example, processing when a predetermined application or the like is activated and executed in response to a human (user) operation, and specific examples include predetermined communication processing and predetermined information editing processing. Alternatively, it may be processing for operating a camera.

Also, the noise is not particularly limited, and may be various noises.
Although noise does not have to exist in the power data, it usually exists in reality.

Further, for example, when the target device 12 is attacked and performs abnormal processing, a power waveform resulting from the abnormal processing is generated in the power data.
In this embodiment, for example, an event that such an abnormal process occurs is detected as a predetermined event by the learning device 152 of the calculation unit 135 .
As a specific example, the calculation unit 135 causes the target device 12 in a normal state to be attacked based on the power data acquired from the target device 12 (in this embodiment, power data obtained by digitally filtering the power data). It may be detected that an abnormal process is performed as a result of equalization. In this case, the stationary power component included in the power data may be suppressed (for example, removed) before the calculation by the calculation unit 135, for example.

Here, in this embodiment, the case where an abnormal event is used as the predetermined event is shown, but as another example, a normal event may be used as the predetermined event. , normal processing) may be used.
As a specific example, the calculation unit 135 may detect (for example, predict) the next process (here, normal process) to be performed in the target device 12 based on the power data acquired from the target device 12. good. In this case, the stationary power component included in the power data may be suppressed (for example, removed) before the calculation by the calculation unit 135, for example.

Further, regarding the processing performed in the target device 12, for example, normal processing and abnormal processing may or may not be distinguished.
As an example, normal processing and abnormal processing performed in the target device 12 may be distinguished, and each of these processing may be regarded as a specific processing.
As another example, normal processing and abnormal processing performed in the target device 12 are distinguished, normal processing is regarded as specific processing, and processing other than the specific processing is regarded as abnormal processing. may
As another example, normal processing and abnormal processing performed in the target device 12 may not be distinguished, and each of these processing may be regarded as a specific processing.

Note that, in the present embodiment, the terms "specific processing" and "specific processing power" are terms for explanation, and may be expressed in other terms.
Further, here, for convenience of explanation, the elements such as the waveform of steady power, the waveform of specific processing power due to specific processing, the waveform of noise, normal processing, and abnormal processing have been described. Some or all of the elements may not necessarily be recognized. In other words, in the information processing apparatus 11, it is sufficient that the desired result is obtained by the learning device 152, and the details of the power data need not be clearly recognized. Normally, in machine learning, when the parameters of the learning device 152 are fixed, the output data corresponding to the input data is determined, so it is not necessary to grasp the details of the input data.

The digital filter processing of the digital filter unit 133 may be, for example, smoothing processing.
The digital filter processing of the digital filter unit 133 may be, for example, processing of a digital low-pass filter (LPF: Low Pass Filter).

As another configuration example, the type of digital filter processing of the digital filter unit 133 does not necessarily have to be low-pass filter processing. Pass Filter) processing or band elimination filter (BEF: Band Elimination Filter) processing may be used.
Also, the digital filter processing of the digital filter unit 133 may include, for example, two or more types of filter processing.

Various characteristics may be used as characteristics (filter characteristics) in the digital filtering process of the digital filter unit 133 .
The characteristics (filter characteristics) in the digital filtering process of the digital filter unit 133 may be set based on, for example, at least one of a normal component included in the power data of the target device 12 and an assumed abnormal component. good.
Further, the characteristics (filter characteristics) in the digital filtering process of the digital filter unit 133 may be set based on the components (principal components) of the power data applied to the learning model of the learner 152 in the calculation unit 135, for example. The principal component may be, for example, a component to be analyzed (analysis for extracting feature amounts) in feature amount extraction.
The characteristic (the filter characteristic) may be, for example, the characteristic of the relationship between the frequency of the signal passing through the filter and the pass rate (in other words, the reduction rate) of the signal.

Here, when low-pass filter processing is used as digital filter processing, as a method of setting characteristics (filter characteristics) in digital filter processing, for example, the frequency band in which data is used in frequency band data (for example, the most characteristic A method of determining an upper limit value (or a value near the upper limit value) of the determined frequency band as the cutoff frequency of the low-pass filter may be used.
The cutoff frequency serves as a delimiter for passing or blocking (reducing) a signal by low-pass filtering. That is, in the low-pass filter process, data values of frequencies equal to or higher than the cutoff frequency are replaced with 0 (zero).

The inverse Fourier transform unit 134 transforms the result of the digital filtering performed by the digital filter unit 133 into data in the time domain (also referred to as a second time domain for convenience of explanation).
As the inverse Fourier transform, for example, an inverse fast Fourier transform (IFFT: Inverse FFT) may be used.
In this embodiment, the inverse Fourier transform unit 134 performs the inverse transform of the Fourier transform performed by the Fourier transform unit 132 .

Here, the range of electric power data (range serving as a unit of the processing) for performing a series of processes of Fourier transform, digital filter processing, and inverse Fourier transform may be arbitrary. In the present embodiment, the same range as the power data range for which feature quantity extraction and learning) is performed may be used.
Such a range may be set arbitrarily. For example, a range of a predetermined time (predetermined period), or a range in which a predetermined number of continuous data values constituting power data are used. may As the predetermined time range, for example, when the power data has cycles, a time range corresponding to a predetermined number of cycles may be used.

The calculation unit 135 receives the second time domain data transformed by the inverse Fourier transform unit 134 and processes the data.
In this embodiment, in the calculation unit 135, the feature amount extraction unit 151 performs processing for extracting feature amounts, and the learning unit 152 performs predetermined calculations related to machine learning based on the result of the processing.

Here, in this embodiment, the feature quantity extraction unit 151 is shown as a functional unit separate from the learning device 152, but as another configuration example, the function of the feature quantity extraction unit 151 is integrated with the learning device 152. Any configuration may be used. In other words, the feature amount extraction process and the process of performing the calculation of the learning device 152 based on the extracted feature amount may be used in a different manner, or may be mixed without being distinguished. may

Also, in this embodiment, the function of extracting the feature amount (the function of the feature amount extraction unit 151) is shown, but a configuration that does not have the function of extracting the feature amount may be used.
For example, the learning device 152 changes the setting value of one or more parameters (usually, a plurality of parameters), and finally sets the setting value to an appropriate value (or a value close to the appropriate value). In the processing, the parameters may include a parameter for feature amount extraction or may not include a parameter for feature amount extraction.

The feature quantity extraction unit 151 extracts a feature quantity based on the second time domain data input to the calculation unit 135 .
Here, any method may be used as the method for extracting the feature amount.

The learning device 152 performs a predetermined calculation based on the feature amount extracted by the feature amount extraction unit 151, and obtains the result of the calculation. The result corresponds to the result of detection or the like by machine learning.
In addition, in a configuration in which the function of the feature quantity extraction unit 151 is integrated with the learning device 152, or in a configuration in which the function of the feature quantity extraction unit 151 is not provided, the learning device 152 is input to the calculation unit 135, for example. A predetermined calculation is performed based on the data in the second time domain.

In this embodiment, the learning device 152 performs calculations for learning in a state in which learning has not been completed (unlearned state). In this case, such calculations for learning correspond to calculations for learning of a learning device that performs calculations for acquiring information about a predetermined event.
In addition, in the present embodiment, the learning device 152 performs calculations with a learned learning device in a state where learning has been completed (learned state). This calculation corresponds to calculation by a learned learner (the learner 152 in this embodiment) that performs calculations for acquiring information about a predetermined event.

The learner 152 may include, for example, the function of a determiner in the final stage (or any other stage). In this case, the decision device outputs a decision result (an example of a result of detection or the like by machine learning) based on the data input to the learning device 152 .
As a specific example, when the learner 152 makes a determination regarding an abnormality, the determination result is information representing the probability (possibility) of occurrence of an abnormality, information representing the type of abnormality, or information of both of these. etc. may be generated. The information indicating the type of abnormality may include, for example, two or more types of abnormality and a type indicating that no abnormality has occurred (“no abnormality”).

Here, in the present embodiment, a case will be described in which the calculation unit 135 performs both calculations in the unlearned state of the learning device 152 and calculations in the already-learned state of the learning device 152 . A configuration in which only any one of is performed may be used.
In other words, the configuration and operation of the information processing apparatus 11 according to the present embodiment are applied to any one of calculations in a state in which the learning device 152 has not been trained and calculations in a state in which the learning device 152 has been trained. or it may apply to both.

The digital filter characteristic adjustment unit 136 acquires a value (for example, the result of detection by machine learning) obtained by changing the characteristics of the digital filter processing of the digital filter unit 133 and the acquired Adjust the property based on the value.

For example, the digital filter characteristic adjustment unit 136 sequentially switches the characteristics of the digital filtering process of the digital filter unit 133 to a plurality of different characteristics, and based on the values obtained when switching to each characteristic, adjusts the characteristics of these plurality of characteristics. A good characteristic (for example, the best characteristic) may be determined (selected) from among them, and the determined characteristic may be set to be used. Here, any method may be used as a method for determining a good characteristic (for example, the best characteristic) based on the obtained values.
In this case, as the characteristic of the digital filtering process, for example, information of a frequency (for example, a cutoff frequency or the like) that defines the characteristic of the digital filtering process may be used.
Further, in this case, as the characteristics of the digital filtering process, for example, the range of power data in which a series of processes such as Fourier transform, digital filtering, and inverse Fourier transform are performed may be used.

As an example, the digital filter characteristic adjustment unit 136 fixes the setting state (for example, the setting state of the variable parameter) of the feature amount extraction unit 151 and the learning device 152 to a constant value, and performs the digital filter processing of the digital filter unit 133. may be varied to determine good properties (eg, best properties).
As another example, the digital filter characteristic adjustment unit 136 adjusts the setting state of one or both of the feature quantity extraction unit 151 and the learning device 152 (for example, the setting state of variable parameters) and the digital filter processing of the digital filter unit 133. and may be varied to determine a good property (eg, best property) for both the set state and the property.

Here, as a method of learning performed by the learning device 152 of the calculation unit 135, for example, a supervised learning method or an unsupervised learning method may be used.
For example, the computation unit 135 may perform computation for unsupervised learning, or may perform computation by an unsupervised learned learner (in this embodiment, the learner 152), or You can do both.

<Hardware Configuration of Information Processing Device>
FIG. 3 is a diagram showing an example of the hardware configuration of the information processing device 11 according to the embodiment.
In the example of FIG. 3, the information processing device 11 includes a processor 1011, an operation unit 1012, a display unit 1013, a storage device 1014, a memory 1015, an input/output interface 1016, and a network interface 1017, which are connected to each other. and a bus 1021 .
Note that the information processing apparatus 11 does not necessarily include all the processing units shown in FIG. 3, and arbitrary processing units not shown in FIG. 3 may be added.

The processor 1011 includes a CPU (Central Processing Unit) and the like, and executes a program to perform processing specified by the program.
An operation unit 1012 includes one or more input devices such as a keyboard and a mouse, and receives operations performed by a person or the like.
The display unit 1013 has a screen, and displays and outputs information on the screen.

The storage device 1014 is a non-volatile storage unit, configured by, for example, a hard disk, and stores information.
The memory 1015 is a volatile storage unit and includes a RAM (Random Access Memory) or the like, and temporarily stores information. As the RAM, for example, a DRAM (Dynamic Random Access Memory) may be used.
Storage device 1014 or memory 1015 may store, for example, information on programs executed by processor 1011 and information on various parameters.

The input/output interface 1016 is an interface that connects with an external recording medium or the like.
A network interface 1017 is an interface that connects to an external network.

Here, the information processing apparatus 11 may include one processor as the processor 1011, or may include two or more processors. As an example, the information processing apparatus 11 may be provided with a plurality of CPUs, each of which may execute its own processing, and the plurality of CPUs may work together to realize the overall processing.

Here, the functions of the input unit 111 shown in FIG. 2 may be configured using the operation unit 1012 and the input/output interface 1016 shown in FIG. 3, for example.
The functions of the output unit 112 shown in FIG. 2 may be configured using the display unit 1013 and the input/output interface 1016 shown in FIG. 3, for example.
Storage unit 113 shown in FIG. 2 may be configured using storage device 1014 and memory 1015 shown in FIG. 3, for example.
The communication unit 114 shown in FIG. 2 may be configured using the network interface 1017 shown in FIG. 3, for example.
Acquisition unit 131, Fourier transform unit 132, digital filter unit 133, inverse Fourier transform unit 134, calculator 135, and digital filter characteristic adjustment unit 136 shown in FIG. and the functions of the storage device 1014 and the memory 1015 for storing necessary information.

Note that the configuration of the information processing apparatus 11 shown in FIG. 2 is merely an example. It does not have to be

[Example of machine learning process]
FIG. 4 is a diagram illustrating an example of a machine learning process according to an embodiment;
In the machine learning process of this example, the smoothing process by the data screening unit 211, the feature amount extraction process by the feature amount extraction unit 212, and the machine learning process by the machine learning modeling 213 (may be called a machine learning model). and including.
Here, in this embodiment, a smoothing method is used as a method of data screening performed by the data screening unit 211 of this example. That is, the data screening corresponds to smoothing in this embodiment.

In the information processing apparatus 11 shown in FIG. 2, the functions of the Fourier transform unit 132, the digital filter unit 133, and the inverse Fourier transform unit 134 constitute the function of the data screening unit 211, and the function of the feature amount extraction unit 151 extracts the feature amount. The function of the unit 212 is configured, and the function of the machine learning modeling 213 is configured by the function of the learner 152 .

In the machine learning process of this example, data d (raw data in this example) consisting of data from n (n is an integer of 2 or more) data sources d1 to dn arranged in time series is acquired, Data d is input to the data screening unit 211 .
Here, in this embodiment, the data of the n data sources d1 to dn are power data transmitted inside the target device 12 . The power data is acquired from the target device 12 .

The data of each data source d1-dn may be scalar data, for example. The value (numerical value) of the data indicates both an integer and a floating point, for example. Any format may be used as a format for representing the value of the data.
Vector data may be used as the data, for example.
In the present embodiment, data values observed from the outside of the electronic device that is the target device 12 are used as the data values.

The data screening unit 211 performs smoothing processing on the input data d. In this example, in the smoothing process, Fourier transform, digital filtering, and inverse Fourier transform are performed in order.
In this embodiment, the processing of the data screening unit 211 corresponds to the processing of input data that is performed before the machine learning calculation.

The feature amount extraction unit 212 extracts a predetermined feature amount based on the data resulting from the smoothing processing performed by the data screening unit 211 .
The machine learning modeling 213 inputs the feature amount extracted by the feature amount extraction unit 212, performs predetermined machine learning calculation, and outputs the result of the calculation. The result corresponds to the result of detection or the like by machine learning.
In the example of FIG. 4, the result of the detection or the like is shown as the learning/inference result e1.

<Example of smoothing process>
FIG. 5 is a diagram illustrating an example of a smoothing process according to the embodiment;
The smoothing process is an example of the smoothing process performed by the data screening unit 211 .
The smoothing process of this example includes Fourier transform processing by the Fourier transform unit 231 , digital filter processing by the digital filter unit 232 , and inverse Fourier transform processing by the inverse Fourier transform unit 233 .

Here, the Fourier transform unit 231 is an example of the Fourier transform unit 132 shown in FIG. 2, the digital filter unit 232 is an example of the digital filter unit 133 shown in FIG. 2, and the inverse Fourier transform unit 233 is shown in FIG. An example of an inverse Fourier transform unit 134 is shown.

The Fourier transform unit 231 obtains frequency domain data F(ω), which is the result of the Fourier transform, by performing Fourier transform processing on the time domain (first time domain) data f(t) to be filtered. do. Note that f(t) represents a function in the domain of time t, and F(ω) represents a function in the domain of frequency ω.
Here, the frequency domain data F(ω) may be called, for example, a power spectrum. The characteristics (filter characteristics) of the digital filtering process performed by the digital filter section 232 may be set in advance based on the analysis result of the power spectrum. The characteristic (the filter characteristic) may be a characteristic related to the range of frequency bands to be passed (or the range of frequency bands to be blocked).

The digital filter unit 232 obtains data F′(ω) as a result of the digital filter processing by performing digital filter processing on the data F(ω) in the frequency domain. Note that F'(ω) represents a function of the domain of frequency ω.
In the example of FIG. 5, the characteristics of low-pass filtering are shown in a graph in which the horizontal axis represents frequency (f) and the vertical axis represents gain (G).

In the example of FIG. 5, the characteristic (filter characteristic) of the low-pass filter processing is such that the gain is G1 (G1 is a positive value) in a frequency range lower than the vicinity of a predetermined frequency f1, value), the gain is 0 (zero). In the example of FIG. 5, the gain changes continuously over a predetermined frequency width in the vicinity of the frequency f1. It may be switched continuously.
The cutoff frequency (f1) in such low-pass filtering serves as a delimiter for passing or blocking (reducing) signals by low-pass filtering.
In this example, the frequency band that is suppressed (eg, zeroed) by the digital filter unit 232 is considered to be a noise frequency band for the computation of the computation unit 135 .

The inverse Fourier transform unit 233 performs inverse Fourier transform processing on the data F′(ω) resulting from the digital filtering process, thereby obtaining data f′ in the time domain (second time domain) that is the result of the inverse Fourier transform. (t) is obtained. f'(t) represents a domain function of time t.

[Configuration example of machine learning modeling]
FIG. 6 is a diagram showing a configuration example of the feature amount extraction unit 212 and machine learning modeling 213 related to power data according to the embodiment.
In the example of FIG. 6 , the feature quantity extraction unit 212 and the machine learning modeling 213 are composed of a first machine learning modeling 311 (which may be referred to as a first machine learning model), a subtractor 312, and a second machine learning model. learning modeling 313 (which may be referred to as a second machine learning model);

The first machine learning modeling 311 performs machine learning calculations for predicting (detecting) a value corresponding to the steady-state power in the target device 12 based on the result of the power data smoothed by the data screening unit 211. conduct.
The subtractor 312 subtracts the value corresponding to the stationary power predicted by the first machine learning modeling 311 from the power data smoothed by the data screening unit 211 .
The second machine learning modeling 313 performs a machine learning operation for detecting anomalies based on the subtraction result from the subtractor 312 .

In the example of FIG. 6, as an example, the function of the feature amount extraction unit 212 may be included in the functions of the first machine learning modeling 311 and the subtractor 312. In this case, the first machine learning modeling 311 and the subtractor 312 , feature quantity extraction processing is performed. In this case, the feature quantity extraction process may be mixed with, for example, the process of predicting the value corresponding to the stationary power.

As another example, the function of the feature amount extraction unit 212 may be included in the function of the second machine learning modeling 313, and in this case, the feature amount extraction processing is performed in the second machine learning modeling 313. In this case, the feature quantity extraction process is performed after the process of predicting the value corresponding to the stationary power.

As another example, the function of the feature quantity extraction unit 212 may be included in the functions of the first machine learning modeling 311, the subtractor 312, and the second machine learning modeling 313. In this case, the first machine learning modeling 311 , the subtractor 312 and the second machine learning modeling 313, the feature quantity extraction process is performed. In this case, the feature quantity extraction process may be mixed with, for example, the process of predicting the value corresponding to the stationary power.

In the information processing device 11, as shown in FIG. 6, machine learning is performed based on power data in which the steady-state power component is suppressed (for example, removed), so that the steady-state power is included as it is. Compared to a configuration in which machine learning is performed based on power data, it is possible to improve the accuracy of acquiring information on a predetermined event.

In this example, in the information processing device 11, by performing a series of processes such as Fourier transform, digital filter processing, and inverse Fourier transform on the power data, for example, compared to the case where the process is not performed, It is possible to increase the accuracy of suppressing (eg, removing) the steady-state power component that is applied. That is, in this example, by performing a series of processes such as Fourier transform, digital filtering, and inverse Fourier transform on the power data, it is possible to accurately find the stationary power component contained in the power data.

Note that the method of suppressing (for example, removing) the steady-state power component included in the power data is not limited to the method shown in FIG. 6, and any method may be used.
The example of FIG. 6 shows the case of predicting the steady-state power using the machine learning function unit (first machine learning modeling 311). may be used.

For example, a configuration may be used in which the processing of each functional unit is performed in the order of the data screening unit 211, steady power subtraction unit (not shown), feature amount extraction unit 212, and machine learning modeling 213.
In this case, the steady-state power subtraction unit performs a process of subtracting the steady-state power included in the power data (here, the result of the smoothing process) input from the data screening unit 211, and outputs the result of the subtraction to the feature amount extraction unit. 212.
The steady-state power subtraction unit may have a machine learning function, for example, as in the example of FIG. may be subtracted from the input data.

<When multiple data are used for machine learning>
Here, in the present embodiment, in order to simplify the description, the calculation by the calculation unit 135 (in the present embodiment, the feature amount extraction unit 151 and calculation by the learning device 152) are performed, but as another configuration example, the calculation unit 135 performs A computation may be performed.

At least one of the plurality of data is power data transmitted inside the target device 12, and the other data may be arbitrary data.
Two or more data out of the plurality of data may be power data transmitted inside the target device 12 . In this case, the two or more pieces of data are, for example, power data transmitted inside the target device 12, and power data obtained from different locations (for example, different terminals may be used) of the target device 12. There may be.

In the present embodiment, at least one of the plurality of data is power data transmitted inside the target device 12, and a series of Fourier transforms, digital filtering, and inverse Fourier transforms according to the present embodiment is performed. Although the processing is performed, there is no particular limitation on the processing performed before the calculation by the calculation unit 135 is performed on the other data.
For each of the other data, for example, a series of processing such as Fourier transform, digital filter processing, and inverse Fourier transform may be performed as in the present embodiment, or smoothing processing using a moving average may be performed. may be processed, or other processing may be performed. As another example, each of the other data may be input to the calculation unit 135 without being processed.

Note that when a series of processes such as Fourier transform, digital filter processing, and inverse Fourier transform are performed on two or more pieces of data, for example, these multiple pieces of data are processed by a common processing unit (in the example of this embodiment, , Fourier transform unit 132, digital filter unit 133, and inverse Fourier transform unit 134), or these plurality of data may be processed in parallel by different processing units.

When a plurality of data are used, when the feature amount is extracted based on the power data transmitted inside the target device 12, for example, the power data transmitted inside the target device 12 and other A feature amount may be extracted based on a combination with one or more data. For example, feature amounts may be extracted based on all combinations of these multiple pieces of data.

For example, feature amounts may be extracted separately based on each of a plurality of data, and computation by the learning device 152 may be performed based on these feature amounts. In this case, each feature amount may be extracted based on each component (for example, principal component) of the plurality of data.
For example, a plurality of data may be divided into two or more groups, feature amounts may be extracted for each group, and calculations may be performed by the learning device 152 based on these feature amounts. In this case, each group is assigned one or more of the plurality of data, and at least one group is assigned two or more data.

[Example of information processing system including power supply]
FIG. 7 is a diagram illustrating an example of an information processing system 401 including a power supply 412 according to an embodiment.
An information processing system 401 shown in FIG. 7 is an example of the information processing system 1 shown in FIG.
In the example of FIG. 7, for convenience of explanation, the same components as those shown in FIG. 1 are denoted by the same reference numerals, and detailed explanation thereof is omitted.

The information processing system 401 shown in FIG. 7 includes an information processing device 411 , a target device 12 similar to that shown in FIG. 1 , and a power supply 412 .
The information processing device 411 is an example of the information processing device 11 shown in FIG.

In the example of FIG. 7, the information processing device 411 generally includes functional units similar to those of the information processing device 11 shown in FIG.
In the example of FIG. 7, for simplification of illustration, only the acquisition unit 431, which is an example of the acquisition unit 131 shown in FIG. omitted.

Acquisition unit 431 includes power supply and power measurement unit 451 .
In the example of FIG. 7 , the power supply 412 and the power supply/power measurement unit 451 are connected via the power line 413 . Also, the power supply and power measurement unit 451 and the target device 12 are connected via a connection line 414 .
The power line 413 is a line that transmits power.
Connection line 414 is an example of connection line 13 shown in FIG. The connection line 414 may also be regarded as a power line that transmits power.
In the example of FIG. 7, the connection line 414 is connected to the power terminal of the target device 12 . The power terminal may be, for example, a power terminal of a computer board of the target device 12 .

Power supply 412 provides power.
Here, the power source 412 may be any power source, such as a commercial power source or a battery. The battery may be, for example, a primary battery or a secondary battery.

The power supply 412 supplies power to the target device 12 via the power supply/power measurement unit 451 of the information processing device 411 .
The power supply and power measurement unit 451 may, for example, input power output from the power supply 412 via the power line 413 and supply the power directly to the target device 12 via the connection line 414, or Power output from the power source 412 via the power line 413 may be input, and after performing predetermined processing on the power, the processed power may be supplied to the target device 12 via the connection line 414. . The predetermined processing may be, for example, voltage conversion.
Note that the information processing device 411 may use, for example, power supplied from the power source 412 as power for operating itself (the information processing device 411), or It may not be used as power for operation.

Also, the power supply/power measurement unit 451 obtains data of power transmitted inside the target device 12 through the connection line 414 by measurement.
As a specific example, the power supply and power measurement unit 451 acquires (measures) a value related to the internal impedance of the target device 12 connected via the connection line 414, and acquires power data based on the value. You may
As the value related to the impedance, for example, the impedance value, the impedance changed value, or both of these values may be used.

In the example of FIG. 7, the information processing apparatus 411 acquires power data observed from the outside of the target device 12 as power data obtained from the target device 12 to be measured. Abnormalities related to the target device 12 are detected, etc., based on changes in the value of the power data.
As an example, an anomaly detector (in the example of FIG. 7, the part of the anomaly detection function of the information processing device 411) is provided between the power supply terminal (not shown) of the target device 12 and the power supply 412 (for example, an external power supply). Be prepared. The anomaly detector observes the power supplied from the power supply 412 to the target device 12, performs learning by the learning device 152 using the data of the observed power, and based on the learning result, determines the power of the target device 12. Detect anomalies.

Here, the configuration of the information processing system 401 including the power supply 412 shown in FIG. 7 is an example, and other configurations may be used.
For example, the function of the power source 412 may be provided inside the information processing device 411 , that is, a configuration in which the information processing device 411 supplies power to the target device 12 may be used.
Further, for example, a configuration in which power is supplied from the power source 412 to the target device 12 without passing through the information processing device 411 may be used. In this case, in the example of FIG. 7 , the information processing apparatus 11 is provided with, for example, a power measurement unit instead of the power supply and power measurement unit 451 , and the power measurement unit detects the target device via the connection line 414 . 12 to obtain data on the power transmitted inside.
Further, the target device 12 is not necessarily limited to a device to which power is supplied from the outside. For example, a configuration in which the function of the power supply 412 is provided inside the target device 12 may be used.

[Specific example of smoothing processing according to the embodiment]
8 to 15 show specific examples of the smoothing process performed by the information processing apparatus 11 according to the embodiment.
In the graphs shown in each of FIGS. 8 to 15, the horizontal axis represents time and the vertical axis represents level (eg, signal strength).
Note that the waveform examples shown in FIGS. 8 to 15 are examples for explanation, and are not necessarily strict and are not limited to this example.

<Example of AES according to the embodiment>
An example in which AES (Advanced Encryption Standard) processing is performed in the target device 12 is shown.
FIG. 8 is a diagram showing an example of power data (including stationary power and noise in this example) resulting from AES according to the embodiment. In the example of FIG. 8, the five peak waveform portions appearing on the initial side of the horizontal axis (time axis) are the portions caused by AES, and the portions thereafter are caused by steady power (and noise). is.
FIG. 8 shows an example of the waveform 2011 of the power data. In one example of the present embodiment, the power data is acquired by the acquisition unit 131 of the information processing device 11 .
The waveform 2011 of the power data (the five peaks of the waveform described above) represents the waveform of the signal generated in the power when the target device 12 is executing the AES process.

FIG. 9 is a diagram illustrating an example of a result of smoothing power data resulting from AES according to the embodiment. In this embodiment, the smoothing process is a process of reducing noise by Fourier transform, digital filtering, and inverse Fourier transform.
FIG. 9 shows an example of a waveform 2021 resulting from the smoothing process.
Also, the vertical axis shown in FIG. 9 indicates the steady power P1. Note that the steady-state power P1 is a schematic representation of an approximate value, and is not necessarily exact.

<Example of DD according to the embodiment>
An example in which DD (Disk Dump) processing is performed in the target device 12 is shown.
FIG. 10 is a diagram showing an example of power data (including stationary power and noise in this example) caused by DD according to the embodiment. In the example of FIG. 10, the five peak waveform portions appearing on the initial side of the horizontal axis (time axis) are the portions caused by DD, and the portions after that are caused by steady power (and noise). is.
FIG. 10 shows an example of the waveform 2111 of the power data. In one example of the present embodiment, the power data is acquired by the acquisition unit 131 of the information processing device 11 .
The waveform 2111 of the power data (the five peaks of the waveform described above) represents the waveform of the signal generated in the power when the target device 12 is executing the DD process.

FIG. 11 is a diagram illustrating an example of a result of smoothing power data caused by DD according to the embodiment. The smoothing process is a process of reducing noise by Fourier transform, digital filtering, and inverse Fourier transform.
FIG. 11 shows an example of a waveform 2121 resulting from the smoothing process.
Also, the vertical axis shown in FIG. 11 indicates the steady power P2. It should be noted that the steady-state power P2 is a schematic representation of an approximate value, and is not necessarily exact.

<Example of HTTP according to the embodiment>
An example in which HTTP (Hyper Text Transfer Protocol) processing is performed in the target device 12 is shown.
FIG. 12 is a diagram illustrating an example of power data (including constant power and noise in this example) caused by HTTP according to the embodiment; In the example of FIG. 12, the five peak waveform portions appearing on the initial side of the horizontal axis (time axis) are the portions caused by HTTP, and the subsequent portions are caused by steady power (and noise). is.
FIG. 12 shows an example of waveform 2211 of the power data. In one example of the present embodiment, the power data is acquired by the acquisition unit 131 of the information processing device 11 .
The waveform 2211 of the power data (the five peaks of the waveform described above) represents the waveform of the signal generated in the power when the target device 12 is executing HTTP processing.

FIG. 13 is a diagram illustrating an example of a result of smoothing power data caused by HTTP according to the embodiment. The smoothing process is a process of reducing noise by Fourier transform, digital filtering, and inverse Fourier transform.
FIG. 13 shows an example of a waveform 2221 resulting from the smoothing process.
Also, the vertical axis shown in FIG. 13 indicates the steady power P3. Note that the steady-state power P3 is a schematic representation of an approximate value, and is not necessarily exact.

<Example of TFTP according to the embodiment>
An example in which TFTP (Trivial File Transfer Protocol) processing is performed in the target device 12 is shown.
FIG. 14 is a diagram showing an example of power data (including stationary power and noise in this example) resulting from TFTP according to the embodiment. In the example of FIG. 14, the five peak waveform portions appearing on the initial side of the horizontal axis (time axis) are the portions caused by TFTP, and the subsequent portions are caused by the constant power (and noise). is.
FIG. 14 shows an example of the waveform 2311 of the power data. In one example of the present embodiment, the power data is acquired by the acquisition unit 131 of the information processing device 11 .
The waveform 2311 of the power data (the five peaks of the waveform described above) represents the waveform of the signal generated in power when the target device 12 is executing TFTP processing.

FIG. 15 is a diagram illustrating an example of a result of smoothing power data resulting from TFTP according to the embodiment. The smoothing process is a process of reducing noise by Fourier transform, digital filtering, and inverse Fourier transform.
FIG. 15 shows an example of a waveform 2321 resulting from the smoothing process.
Also, the vertical axis shown in FIG. 15 indicates the steady power P4. Note that the steady-state power P4 is a schematic representation of an approximate value, and is not necessarily exact.

[Smoothing processing according to comparative example]
Smoothing processing according to the comparative example will be described with reference to FIGS. 16 and 17 to 20. FIG.
FIG. 16 is a diagram illustrating an example of smoothing processing according to a comparative example.
In the smoothing processing according to the comparative example, smoothing processing using a moving average is performed.

FIG. 16 shows data consisting of a sequence of a plurality of data values a1 to a9. The multiple data values a1 to a9 are time-series data. Data values after these data values a1 to a9 may also exist.
In this example, a moving average is performed by averaging three consecutive data values.
In this example, a case is shown in which smoothing processing is performed using an integral filter (integral type filter), which is one of smoothing methods using a moving average.

In the example of FIG. 16, three data values a1 to a3 are averaged to generate one average data A1. Average data A1 corresponds to (data value a1+data value a2+data value a3)/3.
The following three data values a4 to a6 are averaged to generate one average data A2. Average data A2 corresponds to (data value a4+data value a5+data value a6)/3.
The following three data values a7-a9 are averaged to generate one average data A3. Average data A3 corresponds to (data value a7+data value a8+data value a9)/3.

In this way, moving average data 4011 consisting of a plurality of average data A1 to A3 (and subsequent average data may exist) is generated.
In the example of FIG. 16, the nine data values a1 to a9 are averaged three by three, but the total number of data values may be arbitrary. The number may be any number greater than or equal to two.

Here, in the example of FIG. 16, a moving average process for averaging three consecutive data values for a plurality of data values a1 to a9 is performed once. In many cases, similar moving average processing is performed on the sequence of data values resulting from the average processing (a sequence of multiple average data), and such moving average processing may be performed multiple times. There were many.
In other words, in many cases, it was necessary to repeat the calculation using the integral filter many times in order to obtain an ideal smoothing result.

Specifically, in some cases, the second moving average data is generated by applying the same formula as in the first moving average process to the first moving average data 4011. . Further, in some cases, the moving average process is repeated until the output result of the integration filter reaches the expected value.
The moving average processing in such a comparative example is processing that is not based on the appearance of the original data (data values a1 to a9) in time series.
In addition, in the moving average processing in such a comparative example, since the integration filter is uniformly applied to the time-series original data (data values a1 to a9), it is necessary to perform machine learning of power data. In some cases, information for extracting feature amounts is deleted from the original data.

17 to 20 show specific examples of smoothing processing by moving average according to the comparative example.
In the graphs shown in each of FIGS. 17 to 20, the horizontal axis represents time and the vertical axis represents level (eg, signal strength).
It should be noted that the waveform examples shown in FIGS. 17 to 20 are examples for explanation and are not necessarily strict.

<Example of AES according to Comparative Example>
An example of AES according to a comparative example is shown.
Before the smoothing process, the waveform of the power data resulting from AES according to the comparative example is similar to the waveform 2011 shown in FIG.
FIG. 17 is a diagram illustrating an example of a result of smoothing power data caused by AES according to the comparative example. In the comparative example, the smoothing process is a process of reducing noise by moving average.
FIG. 17 shows an example of the waveform 3011 of the power data.

<Example of DD according to Comparative Example>
An example of a DD according to a comparative example is shown.
Before the smoothing process, the waveform of the power data caused by the DD according to the comparative example is similar to the waveform 2111 shown in FIG.
FIG. 18 is a diagram illustrating an example of a result of smoothing power data caused by DD according to the comparative example. In the comparative example, the smoothing process is a process of reducing noise by moving average.
FIG. 18 shows an example of waveform 3111 of the power data.

<Example of HTTP according to the comparative example>
An example of HTTP according to a comparative example is shown.
Before the smoothing process, the waveform of the power data resulting from HTTP according to the comparative example is similar to the waveform 2211 shown in FIG.
FIG. 19 is a diagram illustrating an example of a result of smoothing power data caused by HTTP according to the comparative example. In the comparative example, the smoothing process is a process of reducing noise by moving average.
FIG. 19 shows an example of waveform 3211 of the power data.

<Example of TFTP according to Comparative Example>
An example of a TFTP according to a comparative example is shown.
Before the smoothing process, the waveform of the power data resulting from the TFTP according to the comparative example is similar to the waveform 2311 shown in FIG.
FIG. 20 is a diagram showing an example of a result of smoothing power data caused by TFTP according to a comparative example. In the comparative example, the smoothing process is a process of reducing noise by moving average.
FIG. 20 shows an example of waveform 3311 of the power data.

<Comparison between the smoothing process according to the comparative example and the smoothing process according to the embodiment>
In machine learning frameworks, data smoothing is performed at the first stage of data input. As the smoothing process, a moving average smoothing process is generally performed using an integral filter.
Such moving average processing functions as a simple filter (for example, a digital low-pass filter). In some cases, calculations need to be repeated multiple times, and the deterioration of processing performance has become a problem.

In addition, there have been cases where some information important for machine learning (for example, feature value extraction) is deleted from the data due to the smoothing process using the integral filter.
As a specific example, as a result of removing part of the information contained in the data by the smoothing process, when the data after the smoothing process is processed in a machine learning framework, the part of the information is Unexpected and unnecessary feature values sometimes appeared during feature value extraction due to the deletion. In this case, in the process prior to learning, it may be necessary to process data for such unnecessary feature amounts.
Moreover, in such a comparative example, when the frequency distribution of actually existing data is viewed, it is sometimes inefficient.

With respect to such a problem in the comparative example, the smoothing processing (processing in which Fourier transform, digital filter processing, and inverse Fourier transform are performed in order) in this embodiment can solve the problem.
That is, when the smoothing process in the comparative example is performed, filtering is performed uniformly, so the number of calculations increases, and the features required for machine learning contained in the data are lost. Although there is a possibility, in the smoothing process of the present embodiment, the number of calculations can be suppressed, and the disappearance of features necessary for machine learning included in data can be suppressed (for example, prevented). In the smoothing process of the present embodiment, a series of processes such as Fourier transform, digital filter process, and inverse Fourier transform are performed before machine learning calculations. result can be obtained.

<Specific example of processing of the calculation unit according to the embodiment>
As an example, in the calculation unit 135 in the information processing device 11, the feature amount extraction unit 151 performs processing for extracting feature amounts based on a common threshold. Then, in the computing unit 135, the set of distributed data (data set ), and detect abnormal data based on the data set.
Here, when the local outlier factor method is used, unsupervised learning may be performed by the learner 152, for example.

As an example, the calculation unit 135 in the information processing device 11 may use a random forest algorithm. In this case, the calculation unit 135 obtains the branching result of the decision tree through learning by a decision tree weak learner (a function included in the learner 152 in this embodiment) called a random forest, and determines whether an abnormality is detected based on the branching result. Discover data.

As an example, the calculation unit 135 in the information processing device 11 may use an XGBoost algorithm. In this case, the calculation unit 135 obtains branch results of the decision tree through learning, and detects abnormal data based on the branch results.
XGBoost can be regarded as a derivative of random forest, and has a configuration in which a plurality of random forest decision trees are nested.

As an example, the computing unit 135 in the information processing device 11 may use a neural network (NN) algorithm. In this case, the calculation unit 135 detects abnormal data as a prediction result using the NN (an example of a result of detection by machine learning, etc.).

As an example, the calculation unit 135 in the information processing device 11 may use a recurrent neural network (RNN) algorithm, which is a type of deep learning. In this case, the calculation unit 135 detects abnormal data as a prediction result using the RNN (an example of a result of detection by machine learning, etc.).

As an example, the calculation unit 135 in the information processing device 11 may use a Long Short-Term Memory (LSTM) algorithm, which is a type of recurrent neural network (RNN). In this case, the calculation unit 135 detects abnormal data as a result of prediction using LSTM (an example of a result of detection by machine learning or the like).
Note that the LSTM is implemented, for example, by changing the computing unit of the RNN.

Further, any other machine learning algorithm may be used in the calculation unit 135 in the information processing device 11 .
In the present embodiment, the information processing device 11 performs Fourier transform, digital filter processing, and inverse Fourier transform on the acquired power data in this order. Perform machine learning operations. As a result, the information processing device 11 can perform accurate detection or the like (generate data of results of accurate detection or the like) regarding a predetermined event based on the result of the machine learning operation. Accurate abnormality detection etc. are possible.
Note that detection or the like by machine learning may be called, for example, detection, prediction, estimation, estimation, inference, determination, determination, or identification.

Here, in the present embodiment, for example, instead of the smoothing process by the moving average, by adopting a configuration in which the smoothing process by the digital filter process is performed, compared with the configuration in which the smoothing process by the moving average is performed, the calculation It is possible to reduce the number of trials of

In addition, in a configuration in which smoothing processing is performed using a moving average, the moving average may be excessively performed, so that some important information contained in the power data may be deleted and lost. was there.
On the other hand, in the present embodiment, important information contained in the power data is deleted and lost by performing smoothing processing through a series of processing such as Fourier transform, digital filter processing, and inverse Fourier transform. It is possible to suppress (for example, prevent) stowing.

As described above, in the present embodiment, when smoothing is performed on the power data before the machine learning operation is performed to suppress noise included in the power data, it is possible to suppress the noise included in the power data. By suppressing the loss of such information (for example, preventing the loss of the information), it is possible to accurately detect abnormal data and the like included in the power data.

As a specific example, in the information processing device 11, based on the power data observed from the outside of the electronic device serving as the target device 12, it is possible to detect an attack caused by the insertion of a hardware Trojan into the target device 12. be able to.
Here, the attack to be detected is not particularly limited, and may be applied to, for example, an attack using signal reflection. As an example of such an attack, it may be applied to a side-channel attack.
One type of side channel attack is radio frequency retroreflector attack (RFRA).

As a specific example, the information processing apparatus 11 may first perform unsupervised learning based on power data transmitted inside the target device 12 while the target device 12 is operating normally. After that, the information processing apparatus 11 may detect the abnormality by acquiring information about a predetermined event caused by the occurrence of the abnormality in the target device 12 based on the result of the unsupervised learning. For example, when the target device 12 is new, the information processing apparatus 11 starts monitoring the target device 12 (acquisition of power data and subsequent learning processing), and continues the monitoring. is attacked and an abnormality occurs, the occurrence of the abnormality can be detected.

When such unsupervised learning is performed, the information processing apparatus 11 does not have to identify an abnormality that occurs in the target device 12 in advance, and even if the teacher data is not set in advance, the abnormality can be identified. It can be made possible to detect and the like. When such unsupervised learning is performed, the information processing device 11 can detect anomalies due to unknown security attacks, for example.
As another example, the information processing device 11 may perform supervised learning.

As an example, in the information processing device 11, in the machine learning by the learning device 152, the power data waveforms shown in FIGS. 9, 11, 13, and 15 are learned as waveforms resulting from normal operation, A process of detecting that an abnormality has occurred may be performed when a waveform other than a waveform that is regarded as a normal waveform occurs.
As another example, in the information processing apparatus 11, in the machine learning by the learning device 152, the waveforms of power data as shown in FIGS. 9, 11, 13, and 15 are learned as waveforms caused by predetermined events, The occurrence of these waveforms (the waveform of the predetermined event) may be predicted.

<Modification>
In the information processing device 11 , a predetermined processing section that performs predetermined processing may be provided between the inverse Fourier transform section 134 and the calculation section 135 .
In this case, the predetermined processing unit receives data resulting from the inverse Fourier transform by the inverse Fourier transform unit 134 , performs predetermined processing on the input data, and outputs data resulting from the processing to the computing unit 135 .
Any process may be used as the predetermined process. For example, a process in which a component that is not to be detected by machine learning by the calculation unit 135 is set in advance and the component is subtracted from the input data is used. may be
The component may be, for example, a component resulting from normal processing performed in the target device 12, or an abnormal processing that has already been discovered but is not subject to detection by machine learning by the calculation unit 135. It may be a component, or it may be both.

[Regarding the above embodiments]
As described above, in the information processing system 1 according to the present embodiment, when the information processing device 11 performs calculation of the learning device 152 based on the power data, the calculation amount is suppressed, and Noise contained in the power data can be suppressed while suppressing loss of characteristic information.
For example, when performing machine learning on power data, the information processing device 11 can suppress finer noise components while leaving finer components necessary for machine learning included in the power data.

<Configuration example>
As one configuration example, the information processing device (information processing device 11 in the example of FIG. 1) includes an acquisition unit ( 2, an acquisition unit 131) and a Fourier transform unit (in the example of FIG. 1, the Fourier transform unit 132 ), a digital filter unit (in the example of FIG. 1, the digital filter unit 133) that performs digital filter processing for suppressing noise with respect to a predetermined event to the frequency domain data transformed by the Fourier transform unit, and a digital filter by the digital filter unit An inverse Fourier transform unit (inverse Fourier transform unit 134 in the example of FIG. 1) that transforms the processed result into second time domain data, and the second time domain data transformed by the inverse Fourier transform unit are input. Calculation for learning of the learner (in the example of FIG. 1, the learner 152 before learning) that performs calculation for obtaining information about a predetermined event, or learned learning that performs calculation for obtaining information about a predetermined event. and a calculation unit (calculation unit 135 in the example of FIG. 1) that performs at least one of calculation by the device (in the example of FIG. 1, the learned learner 152).

As one configuration example, in the information processing device, the predetermined event is an event related to an abnormality.
As one configuration example, in the information processing apparatus, the predetermined event is a security attack.
As one configuration example, in the information processing device, the calculation unit performs at least one of calculation for unsupervised learning and calculation by an unsupervised learned learner.
As one configuration example, in the information processing apparatus, the calculation unit includes a feature amount extraction unit (the feature amount extraction unit 151 in the example of FIG. 1) that extracts the feature amount based on the input second time domain data.
As one configuration example, in the information processing apparatus, the digital filter processing of the digital filter unit is smoothing processing.
As one configuration example, in the information processing apparatus, the digital filter processing of the digital filter unit is digital low-pass filter processing.
As one configuration example, in the information processing device, a digital filter that acquires a value obtained by the calculation of the calculation unit by changing the characteristics of the digital filter processing of the digital filter unit and adjusts the characteristics based on the acquired value A characteristic adjustment section (the digital filter characteristic adjustment section 136 in the example of FIG. 1) is provided.

For example, a method (in this embodiment, a method performed by the information processing device 11) may be provided.
As one configuration example, in the information processing method, the acquisition unit acquires data of power transmitted inside the target device. A Fourier transform unit transforms the power data acquired by the acquisition unit into frequency domain data by Fourier transform as first time domain data. A digital filter unit performs digital filter processing for suppressing noise for a predetermined event on the frequency domain data transformed by the Fourier transform unit. An inverse Fourier transform unit transforms the result of the digital filter processing performed by the digital filter unit into second time domain data. A calculation unit inputs the second time domain data transformed by the inverse Fourier transform unit and performs calculation for learning of a learner that performs calculation for obtaining information about a predetermined event, or obtains information about the predetermined event. calculation by a learned learner that performs calculation.

For example, a program (in this embodiment, a program executed by the information processing device 11) may be provided.
As one configuration example, the program may provide a computer with an acquisition function for acquiring power data transmitted inside the target device, and using the power data acquired by the acquisition function as first time domain data, and Fourier transforming the data into frequency domain data. , a digital filter function that applies digital filter processing to suppress noise for a given event on the frequency domain data converted by the Fourier transform function, and the result of the digital filter processing performed by the digital filter function. An inverse Fourier transform function for converting to second time domain data, and an operation for learning a learner that performs an operation for acquiring information about a predetermined event by inputting the second time domain data transformed by the inverse Fourier transform function. , or an arithmetic function that performs at least one of an arithmetic operation by a learned learner that performs an arithmetic operation for acquiring information about a predetermined event.

It should be noted that a program for realizing functions of an arbitrary component in an arbitrary device may be recorded in a computer-readable recording medium, and the program may be read and executed by a computer system. It should be noted that the "computer system" here includes an operating system and hardware such as peripheral devices. In addition, "computer-readable recording medium" refers to portable media such as flexible discs, magneto-optical discs, ROMs, CD (Compact Disc)-ROMs, and storage devices such as hard disks built into computer systems. . In addition, "computer-readable recording medium" means a volatile memory (RAM) inside a computer system that acts as a server or client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. , includes those that hold the program for a certain period of time. The recording medium may be, for example, a non-transitory recording medium.

Moreover, the above program may be transmitted from a computer system storing this program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in a transmission medium. Here, the "transmission medium" for transmitting the program means a medium having a function of transmitting information, such as a network such as the Internet or a communication line such as a telephone line.
Also, the above program may be for realizing part of the functions described above. Furthermore, the above program may be a so-called difference file, which can realize the functions described above in combination with a program already recorded in the computer system. A difference file may be referred to as a difference program.

Also, the functions of any component in any device may be implemented by a processor. For example, each process in this embodiment may be realized by a processor operating based on information such as a program and a computer-readable recording medium storing information such as the program. Here, in the processor, for example, the function of each section may be implemented by separate hardware, or the function of each section may be implemented by integrated hardware. For example, a processor may include hardware, which may include at least one of circuitry for processing digital signals and circuitry for processing analog signals. For example, a processor may be configured using one or more circuit devices and/or one or more circuit elements mounted on a circuit board. An IC (Integrated Circuit) or the like may be used as the circuit device, and a resistor, capacitor, or the like may be used as the circuit element.

Here, the processor may be, for example, a CPU. However, the processor is not limited to a CPU, and various processors such as a GPU (Graphics Processing Unit) or a DSP (Digital Signal Processor) may be used. The processor may also be a hardware circuit based on, for example, ASIC (Application Specific Integrated Circuit). Also, the processor may be composed of, for example, a plurality of CPUs, or may be composed of hardware circuits composed of a plurality of ASICs. Also, the processor may be configured by, for example, a combination of multiple CPUs and multiple ASIC hardware circuits. The processor may also include one or more of, for example, amplifier circuits or filter circuits that process analog signals.

Although the present disclosure has been described using the embodiments, the technical scope of the present disclosure is not limited to the above embodiments. It will be apparent to those skilled in the art that various changes and alternatives can be adopted without departing from the spirit and scope of this disclosure.

DESCRIPTION OF SYMBOLS 1, 401... Information processing system 11, 411... Information processing apparatus 12... Target apparatus 13, 414... Connection line 111... Input part 112... Output part 113... Storage part 114... Communication part 131, 431... Acquisition unit 132, 231... Fourier transform unit 133, 232... Digital filter unit 134, 233... Inverse Fourier transform unit 135... Calculation unit 136... Digital filter characteristic adjustment unit 151... Feature quantity extraction unit, 152... Learning device, 211... Data screening unit, 212... Feature quantity extraction unit, 213... Machine learning modeling, 311... First machine learning modeling (steady power prediction), 312... Subtractor, 313... Second machine learning modeling ( Abnormality detection), 412 power supply, 413 power line, 451 power supply and power measurement unit, 1011 processor, 1012 operation unit, 1013 display unit, 1014 storage device, 1015 memory, 1016 input/output interface, 1017 network interface 1021 bus d1 to dn data source d data e1 learning/inference result ... waveform, 4011 ... moving average data

Claims (9)

an acquisition unit that acquires power data transmitted inside the target device;
a Fourier transform unit that transforms the power data acquired by the acquisition unit into frequency domain data by Fourier transform as first time domain data;
a digital filter unit that performs digital filter processing to suppress noise for a predetermined event on the frequency domain data transformed by the Fourier transform unit;
an inverse Fourier transform unit that transforms the result of the digital filtering performed by the digital filter unit into second time domain data;
Inputting the second time domain data transformed by the inverse Fourier transform unit and performing computation for learning of a learner that performs computation for acquiring information related to the predetermined event, or acquiring information related to the predetermined event an operation unit that performs at least one of: an operation by a learned learner that performs an operation;
sequentially switching the characteristics of the digital filtering process of the digital filter unit to a plurality of different characteristics, obtaining the values obtained by the calculation of the calculation unit when switching to each characteristic, and based on the obtained values , a digital filter characteristic adjustment unit that adjusts the characteristic of the digital filtering process by determining and setting to use a favorable characteristic among the plurality of characteristics;
Information processing device. The predetermined event is an event related to an abnormality,
The information processing device according to claim 1 . the predetermined event is an attack in security;
The information processing apparatus according to claim 2. The computing unit performs at least one of computation for unsupervised learning and computation by an unsupervised learned learner,
The information processing apparatus according to any one of claims 1 to 3. The computing unit includes a feature quantity extraction unit that extracts a feature quantity based on the input second time domain data,
The information processing apparatus according to any one of claims 1 to 4. The digital filter processing of the digital filter unit is smoothing processing,
The information processing apparatus according to any one of claims 1 to 5. The digital filter processing of the digital filter unit is digital low-pass filter processing,
The information processing apparatus according to any one of claims 1 to 6. An acquisition unit acquires power data transmitted inside the target device,
a Fourier transform unit transforming the power data acquired by the acquisition unit into frequency domain data by Fourier transform as first time domain data;
a digital filter section performing digital filter processing for suppressing noise for a predetermined event on the frequency domain data transformed by the Fourier transform section;
an inverse Fourier transform unit transforming the result of the digital filtering performed by the digital filter unit into second time domain data;
A calculation unit receives the second time domain data transformed by the inverse Fourier transform unit and performs calculations for learning of a learner that performs calculations for acquiring information about the predetermined event, or calculations for learning about the predetermined event perform at least one of operations by a learned learner that performs operations to acquire information,
A digital filter characteristic adjustment unit sequentially switches the characteristics of the digital filtering process of the digital filter unit to a plurality of different characteristics, and acquires and acquires a value obtained by the calculation of the calculation unit when switching to each characteristic adjusting the characteristics of the digital filtering by determining and setting to use a good characteristic among the plurality of characteristics based on the values obtained;
Information processing methods. to the computer,
an acquisition function for acquiring power data transmitted inside the target device;
a Fourier transform function that transforms the power data acquired by the acquisition function into frequency domain data by Fourier transform as first time domain data;
a digital filter function that performs digital filter processing to suppress noise for a predetermined event on the frequency domain data transformed by the Fourier transform function;
an inverse Fourier transform function for transforming the result of the digital filter processing performed by the digital filter function into second time domain data;
Inputting the second time domain data transformed by the inverse Fourier transform function and performing computation for learning of a learner that performs computation for acquiring information on the predetermined event, or acquiring information on the predetermined event an arithmetic function that performs at least one of: an arithmetic operation by a learned learner that performs an arithmetic operation;
sequentially switching the characteristics of the digital filtering process of the digital filtering function to a plurality of different characteristics, obtaining values obtained by calculation of the calculation function when switching to each characteristic, and based on the obtained values , a digital filter characteristic adjustment function that adjusts the characteristics of the digital filtering process by determining and setting to use a favorable characteristic among these plurality of characteristics;
program to make it happen.

Images