JP7343137B2 - Condition determination device and condition determination method - Google Patents

Description

The present disclosure relates to a state determination device and a state determination method.

Although the accuracy of determining the status of a target system or device using a single parameter decreases, the accuracy of determining the status can be improved by comprehensively using multiple parameters obtained from the target. In that case, analysis using multidimensional data generated from a plurality of parameters is required (see, for example, Patent Document 1). Analyzing such multidimensional data generally requires experts called data scientists who have specialized analytical skills. However, not only is the cost of becoming a data scientist high, but the supply of human resources is limited, so there is a need for a device that allows even people without specialized analysis skills to easily determine the state of a target.

WO2017/217069

The present disclosure aims to provide a device that allows even a person without specialized analytical skills to determine the state of an object.

The state determination device of the present disclosure includes:
Generate multidimensional vector data whose dimensions include parameters related to the state to be determined,
Create a reference vector data population by collecting the vector data for a certain period of time,
Find a multidimensional subspace formed by the reference vector data population in a multidimensional space equal to the number of dimensions of the reference vector data population,
If the newly generated vector data is located inside the multidimensional subspace, the determination target is determined to be the same as the state corresponding to the reference vector data population, and if the newly generated vector data is located outside the multidimensional subspace, the determination target is determined to be the same as the state corresponding to the reference vector data population. It is determined that the determination target is different from the state corresponding to the reference vector data population.

The state determination method of the present disclosure includes:
Generate multidimensional vector data whose dimensions include parameters related to the state to be determined,
Create a reference vector data population by collecting the vector data for a certain period of time,
Find a multidimensional subspace formed by the reference vector data population in a multidimensional space equal to the number of dimensions of the reference vector data population,
If the newly generated vector data is located inside the multidimensional subspace, the determination target is determined to be the same as the state corresponding to the reference vector data population, and if the newly generated vector data is located outside the multidimensional subspace, the determination target is determined to be the same as the state corresponding to the reference vector data population. It is determined that the determination target is different from the state corresponding to the reference vector data population.

The present disclosure can provide a device that allows even a person without specialized analytical skills to determine the state of a target to be determined.

1 is a schematic configuration diagram showing an example of a system according to an embodiment. An example of determination by the state determination unit is shown. A first example of a multidimensional shape according to the second embodiment is shown. A second example of a multidimensional shape according to the second embodiment is shown. An example of a multidimensional shape according to a third embodiment is shown. An example of a multidimensional shape according to the fourth embodiment is shown. An example of a multidimensional shape according to the fifth embodiment is shown. A first example of determining the degree of the condition is shown. A second example of determining the degree of the condition is shown.

Embodiments of the present disclosure will be described in detail below with reference to the drawings. Note that the present disclosure is not limited to the embodiments described below. These implementation examples are merely illustrative, and the present disclosure can be implemented with various changes and improvements based on the knowledge of those skilled in the art. Note that components with the same reference numerals in this specification and the drawings indicate the same components.

(First embodiment)
FIG. 1 is a schematic configuration diagram showing an example of a system according to this embodiment. The state determination device 10 according to this embodiment includes a vector data generation section 11, a multidimensional shape generation section 12, a multidimensional subspace definition section 13, a state determination section 14, and a data collection section 21. The state determination device 10 according to the present embodiment is realized by making a computer function as a vector data generation section 11, a multidimensional shape generation section 12, a multidimensional subspace definition section 13, a state determination section 14, and a data collection section 21. You may.

The data collection unit 21 collects arbitrary data that can be parameters related to the determination target, and stores it in the storage unit 22 . The vector data generation unit 11 extracts parameters from the data stored in the storage unit 22 and generates multidimensional vector data having each parameter as a dimension.

The vector data generation unit 11 stores the created vector data in the storage unit 22. The state determination device 10 creates a reference vector data population by collecting data and accumulating vector data for a certain period of time. Here, the fixed period is a period during which the determination target is in a fixed state. The constant state is, for example, a state in which the determination target is normal. Preferably, the fixed state and fixed period can be set by the user of the state determining device 10. This allows the user to set a plurality of vector data populations corresponding to various states to be determined.

The multidimensional shape generation unit 12 obtains a multidimensional shape _SMD that includes the reference vector data population and circumscribes at least one vector data included in the reference vector data population. A specific example of deriving the multidimensional shape _SMD will be described later. A multidimensional space is a space equal to the number of dimensions of the reference vector data population. For example, if the number of dimensions of vector data is 1000, it is a 1000-dimensional space.

The multidimensional subspace definition unit 13 determines a multidimensional subspace S _SUB formed by the reference vector data population in the multidimensional space. FIG. 2 shows an example of a multidimensional shape S _MD and a multidimensional subspace S _SUB . The multidimensional subspace S _SUB is obtained by performing correction on the multidimensional shape S _MD according to the determination criteria. For example, if there is a possibility that vector data in which the determination target is in a constant state is distributed in the range of β (β≧1) due to an error in the vector data created by the vector data generation unit 11, the multidimensional part The space definition unit 13 performs processing to enlarge the multidimensional shape _SMD by β times. In addition to enlarging the multidimensional shape S _MD , the correction may also include correction to reduce the multidimensional shape S _MD . The multidimensional subspace definition unit 13 may perform different corrections depending on the dimension. In that case, the correction coefficient β will be different for each dimension, and in that case, it will be expressed as β _i (i indicates the dimension).

After calculating the multidimensional subspace S _SUB , when the data collection unit 21 collects data and stores it in the storage unit 22, the vector data generation unit 11 extracts parameters from the new data stored in the storage unit 22. , convert each parameter into vector data with dimensions. The state determination unit 14 determines the state of the determination target using the multidimensional subspace S _SUB generated by the multidimensional subspace definition unit 13 .

For example, like ND1 shown in FIG. 2, when the vector ND1 of new data is within the range of the multidimensional subspace S _SUB , the state determining unit 14 determines that the state to be determined corresponding to the new data is If it is determined that the state is the same as the state corresponding to the vector data population, and the vector ND2 of the new data is outside the range of the multidimensional subspace _SSUB , as shown in ND2 shown in FIG. It is determined that the state is different from the state corresponding to the reference vector data population.

As explained above, in this embodiment, the multidimensional subspace S _SUB in the multidimensional space that includes the reference vector data population when the determination target is in a constant state is determined. Thereby, in this embodiment, the state of the determination target corresponding to new data can be determined depending on whether the new data is inside or outside the multidimensional subspace S _SUB .

Here, the multidimensional subspace S _SUB is automatically defined from the reference vector data population by a certain calculation, and whether new data is located inside or outside the multidimensional subspace is automatically defined. By making the determination, it becomes possible to automatically determine the state of the determination target corresponding to the new data. Therefore, the present disclosure can provide a device that allows even a person without specialized analytical skills to determine the state of a target to be determined.

(Second embodiment)
In this embodiment, the multidimensional shape generation unit 12 obtains a multidimensional sphere that circumscribes at least one of the vector data included in the reference vector data population as the multidimensional shape _SMD . The multidimensional subspace S _SUB is defined from the multidimensional shape S _MD using a correction coefficient β.

FIG. 3 shows an example of a multidimensional shape according to this embodiment. The multidimensional shape generation unit 12 converts the vector data in the reference vector data population into vector data with the center of gravity G _MD of the reference vector data population as a new origin _PO . The reference vector data population having the new origin P _O obtained in this way is hereinafter referred to as a "secondary reference vector data population." A vector with the maximum vector length is found from the vector data included in the secondary reference vector data population, and a multidimensional sphere having a radius φ equal to this vector length is found. This sphere is assumed to be a multidimensional shape _SMD . All vector data in the reference vector data population is included in this multidimensional shape _SMD . The multidimensional subspace S _SUB is defined as a multidimensional sphere having a radius β*φ using a correction coefficient β.

Furthermore, in the present embodiment, the origin of the multidimensional space is the center of gravity G _MD of the reference vector data population, which is the center of the sphere, but the new origin P _O of the present disclosure is not limited to the center of gravity, but is An arbitrary point found from the population can be set as the origin. For example, as shown in Figure 4, for all data in the reference vector population, find the intermediate value of the dimension value (the value between the maximum value and the minimum value) for each dimension, and then calculate the intermediate value of all dimensions. The point with this may be set as the origin _PO . In this case, a sphere centered at the origin _PO and having a radius φ of the maximum value of the vector data included in the reference vector data population is determined as the multidimensional shape _SMD . The multidimensional subspace S _SUB becomes a multidimensional sphere having a radius βφ (β is a correction coefficient).

In this embodiment, the sphere containing the reference vector data population is a multidimensional subspace S _SUB . The definition of the multidimensional subspace S _SUB of this embodiment and the determination of the state to be determined can be obtained by simply comparing the vector lengths of the reference vector data population and new vector data. Therefore, in this embodiment, the state to be determined can be determined with a small amount of calculation.

(Third embodiment)
In this embodiment, the multidimensional shape generation unit 12 obtains a rectangular parallelepiped in a multidimensional space that circumscribes at least one of the vector data included in the reference vector data population as the multidimensional shape _SMD .

FIG. 5 shows an example of the multidimensional shape _SMD according to this embodiment in a three-dimensional space. The multidimensional shape generation unit 12 calculates the maximum value and minimum value for each dimension of all vector data included in the reference vector data population. For example, the first dimension value is extracted from all vector data included in the reference vector data population, and the maximum and minimum values of the first dimension are determined. The maximum and minimum values for other dimensions are found in the same way. Then, the multidimensional shape generation unit 12 obtains a rectangular parallelepiped in a multidimensional space delimited by the range of the maximum value and minimum value of each dimension.

_For example, when the number of dimensions of the vector data is three, as shown in _FIG . Y _max and y _min are determined by determining the two-dimensional maximum and minimum values, and z _max and z _min are determined by determining the third-dimensional maximum and minimum values. As a result, (x _min , y _min , z _min ), (x _min , y _min , z _max ), (x _min , y _max , z _min ), (x _min , y _max , z _max ), (x _max , y _min , z _min ), (x _max , y _min , z _max ), (x _max , y _max , z _min ), and (x _max , y _max , z _max ) as vertices. This three-dimensional rectangular parallelepiped becomes the multidimensional shape _SMD . The multidimensional subspace S _SUB similarly has the shape of a multidimensional rectangular parallelepiped, and can be easily determined from the multidimensional shape S _MD using the correction coefficient β _i .

As explained above, in this embodiment, a rectangular parallelepiped in a multidimensional space containing a reference vector data population is defined as a multidimensional subspace S _SUB . In this embodiment, the multidimensional subspace S _SUB can be determined by determining the maximum value and minimum value for each dimension of vector data. Therefore, in this embodiment, the state to be determined can be determined with a small amount of calculation.

Note that in FIG. 5, for ease of understanding, an example is shown in which the multidimensional shape _SMD is a three-dimensional rectangular parallelepiped, but in the present disclosure, the multidimensional shape SMD may be a rectangular parallelepiped with any number of dimensions equal to the number of dimensions of vector data. .

(Fourth embodiment)
In this embodiment, the multidimensional shape generation unit 12 obtains a surface circumscribing a plurality of vector data located at the outer edge of the reference vector data population as a multidimensional shape _SMD .

FIG. 6 shows an example of the multidimensional shape _SMD according to this embodiment. Let the center of gravity _GMD of all the vector data included in the reference vector data population be the origin _P0 of the multidimensional coordinates, and let all the vector data included in the reference vector data population be _Ai . Here, i in "A _i " is i=1, 2, 3, . . . , the total number of data in the reference vector data population. Assuming that the vector connecting the origin P _O and one point on the surface of the multidimensional shape is R, and its unit vector is r, the surface of the multidimensional shape of the reference vector data population can be expressed by the following equation.

(Number 1)
R=Max _i {<r, A _i >}・r (1)
Here, <r, A _i > is the inner product of vector r and A _i , and Max _i {<r, A _i >} is the maximum value of the inner product <r, A _i > for all values of i. By determining R shown in equation (1), the multidimensional shape _SMD can be determined.

In this embodiment, the surface of the multidimensional subspace S _SUB can be expressed by vector notation Q=β*R=β*Max _i {<q, A _i >}·q. Here, q is a unit vector constituting Q, and the correction coefficient β is assumed to be constant regardless of the dimension etc. for simplicity. Therefore, in response to new data, the state to be determined can be determined as follows.

In the case of |Q|<|β*Max _i {<q, A _i >}・q|, that is, when Q is located inside the multidimensional subspace S _SUB , the state determination unit 14 uses the reference vector population as It is determined that the state is the same as the state of the corresponding determination target.
In the case of |Q|>|β*Max _i {<q, A _i >}・q|, that is, when Q is located outside the multidimensional subspace S _SUB , the state determination unit 14 uses the reference vector population as It is determined that the state is different from the state of the corresponding determination target.

The multidimensional subspace definition unit 13 of this embodiment can determine the state of the determination target by performing the calculation process of β*Max _i {<q, A _i >}·q. Here, β is generally set to β≧1, but is not necessarily limited. Furthermore, the value of the correction coefficient can be weighted depending on the direction of the new vector.

Note that in the above, the center of gravity _GMD of all vector data included in the reference vector data population is set as the origin _PO of the multidimensional coordinates, but the present disclosure is not limited thereto. As described with reference to FIG. 4 in the second embodiment, for example, for all data in the reference vector population, the intermediate value of the dimension value (the intermediate value between the maximum value and the minimum value) for each dimension. , and the point having the intermediate values of all dimensions may be set as the origin _PO .

As described above, in this embodiment, the multidimensional shape _SMD and the multidimensional subspace _SSUB that include the reference vector data population can be easily obtained from the reference vector data population in vector notation. Therefore, in this embodiment, determination using the reference vector data population can be performed with a small amount of calculation.

(Fifth embodiment)
In the above-described embodiment, the case where there is one multidimensional subspace S _SUB has been described, but there may be two or more multidimensional subspaces S _SUB .

For example, when switching from the first mode to the second mode depending on the time period during a certain period of accumulating vector data, the multidimensional shape generation unit 12 changes the multidimensional shape of the first mode to the second mode, as shown in FIG. A dimensional shape S _MD 1 and a second mode multidimensional shape S _MD 2 are generated.

As a method for generating the multidimensional shapes S _MD 1 and S _MD 2, the methods described in the second to fourth embodiments can be used. For _example , as explained above in FIG _. Find a sphere with a radius greater than or equal to the maximum value of the vector data. Thereby, the multidimensional shapes S _MD 1 and S _MD 2 and the multidimensional subspaces S _SUB 1 and S _SUB 2 of each mode can be obtained.

In this embodiment, an example of switching between two modes has been described, but the number of modes may be three or more. By generating a multidimensional shape _SMD and a multidimensional subspace _SSUB for each mode, it is possible to determine the state of each mode.

Note that if there is no need to determine the state for each mode, or if the state can be determined as a common multidimensional subspace S _SUB , a common multidimensional shape can be used even if there are two or more modes. It may also be _SMD and multidimensional subspace _SSUB .

(Sixth embodiment)
The state determination unit 14 of this embodiment determines the degree of the state in addition to the state to be determined. The operations of the data collection unit 21 and the vector data generation unit 11 after determining the multidimensional subspace S _SUB are similar to those in the first embodiment.

For example, as shown in FIG. 8, when vector data of a vector _Pk is newly generated outside the multidimensional subspace _SSUB , the state determining unit 14 determines that the vector data of the vector Pk is newly generated outside the multidimensional subspace _SSUB in the same direction as the vector _Pk . , and compare |P _k | and |Q _{k |} . For example, when |P _k |>|Q _k |, it is possible to determine how much the determination target differs from a constant state. The comparison can be exemplified by, for example, the difference or ratio between |P _k | and |Q _k |.

As shown in FIG. 9, when vector data of the vector P _k is newly generated outside the multidimensional subspace S _SUB , the state determination unit 14 compares |P _k | and the radius β*φ. For example, in the case of |P _k |>β*φ, it is possible to determine how much the determination target differs from a constant state. The comparison may be, for example, the difference or ratio between |P _k | and the radius β*φ.

(Seventh embodiment)
In the present disclosure, any data can be used as parameters as long as the vector data generation unit 12 can vectorize it. Hereinafter, specific examples of data collected by the data collection unit 21 and determination examples of the state determination unit 14 will be described.

(Determination of packet abnormality)
The data collection unit 21 collects header information of packets. The vector data generation unit 11 extracts parameters from header information, packet traffic volume, etc., and generates multidimensional vector data with each parameter as a dimension. The conversion into vector data in the vector data generation unit 11 may be performed in units of packets, or may be performed by combining a plurality of packet data. The state determining unit 14 uses vector data to determine whether or not there is an abnormality in the packet.

For example, in the case of a terminal infected with a remote control virus, the operation will be completely different from that used by a regular user. For example, it operates during times when authorized users are not using it, or it sends large amounts of data that authorized users are not using. The vector data in this case is completely different from the reference vector data population. Therefore, the status determination unit 14 can detect that the packet has been sent and received by a third party different from the authorized user.

Examples of the header information include time, source information, destination information, protocol, packet size (positive integer), and accompanying information (text). The source information and destination information include information on an IP (Internet Protocol) address, a MAC (Media Access Control) address, a domain, and a zone in the domain. Examples of protocols include HTTP (Hypertext Transfer Protocol), TCP (Transmission Control Protocol), TLS (Transport Layer Security), and DNS (Domain Name Examples include Message Queue Telemetry Transport (MQTT) and Message Queue Telemetry Transport (MQTT).

As a method of converting the destination IP address into vector data, for example, a method of setting the dimension value corresponding to the destination IP address of each packet data to 1 can be considered. As a method for converting a protocol into vector data, for example, a method can be considered in which the protocol is used as a dimension and the dimension value corresponding to the protocol of individual packet data is set to 1.

Preferably, the header information includes a protocol. Packet data sent by a virus may use a different protocol than normal packet data. Therefore, by converting the protocol into vector data, the probability of detecting packet data that may have been sent by a virus increases.

The information to be converted into vector data may be statistical information calculated using header information. The statistical information includes the number of packets or packet size that pass per unit time that does not depend on information written in the header, and the number of packets or packet size of packet data having specific characteristics. The unit time may be set arbitrarily.

For example, when a DDoS (Distributed Denial of Service attack) attack occurs, a large amount of packet data is transmitted to the same destination. Therefore, by converting the number of packets per unit time or the total packet size for each destination into vector data, the probability of capturing the characteristics of a DDoS attack against any destination is improved. In this case, the vector data generation unit 11 calculates the number of packets per unit time or the total packet size for each destination. Then, the vector data generation unit 11 converts the number of packets per unit time or the total packet size into vector data.

(Determination of device abnormality)
The data collection unit 21 collects log information of devices and systems to be determined. The vector data generation unit 11 extracts parameters from the log information and generates multidimensional vector data having each parameter as a dimension. The log information may include sensor information detected using a sensor. The sensor information may include audio data and image data.

If the data collected by the data collection unit 21 includes audio data or image data, the vector data generation unit 11 converts the audio data into a temporal frequency spectrum, converts the image data into a spatial frequency spectrum, Each frequency component included in the spectrum is converted into vector data whose dimension is the amplitude of each frequency component and whose value is the amplitude of each frequency component.

The present disclosure can be applied to the information and communication industry.

10: State determination device 11: Vector data generation unit 12: Multidimensional shape generation unit 13: Multidimensional subspace definition unit 14: State determination unit 21: Data collection unit 22: Storage unit

Claims (6)

Find a multidimensional subspace formed by the reference vector data population in a multidimensional space equal to the number of dimensions of the reference vector data population in which multidimensional vector data whose dimensions include parameters related to the state to be determined are collected. ,
If new vector data different from the reference vector data population is located inside the multidimensional subspace, it is determined that the determination target is in the same state as that corresponding to the reference vector data population, and the new vector data is is located outside the multidimensional subspace, determining that the determination target is different from the state corresponding to the reference vector data population;
A state determination device,
The surface of the multidimensional subspace is expressed by the following equation in a system whose origin is one point obtained from the reference vector data population.
Condition determination device.
Q=β*Max _i {<q, A _i >}・q
However, A _i is all vector data, Q is a vector connecting the origin and one point on the surface of the multidimensional subspace, vector q is a unit vector of Q, and <q, A _i > is vector q and A _i , and Max _i {<q, A _i >} is the maximum value of the inner product <q, A _i > of the reference vector q and all reference vector data A _i included in the population. In a multidimensional space equal to the number of dimensions of the reference vector data population in which multidimensional vector data whose dimensions include parameters related to the state to be determined are collected, the reference vector data population is included and the reference vector data population is Find a multidimensional subspace having a multidimensional shape circumscribing at least one vector data included in the group ,
If new vector data different from the reference vector data population is located inside the multidimensional subspace, it is determined that the determination target is in the same state as that corresponding to the reference vector data population, and the multidimensional subspace If the determination target is located outside of the reference vector data population, it is determined that the determination target is different from the state corresponding to the reference vector data population;
In a system whose origin is one point obtained from the reference vector data population, the size of the new vector data and the distance from the origin in the same direction as the new vector data to the outer peripheral surface of the multidimensional subspace. and determining the extent to which the state differs from the state corresponding to the reference vector data population to be determined, using
Condition determination device. In a multidimensional space equal to the number of dimensions of the reference vector data population in which multidimensional vector data whose dimensions include parameters related to the state to be determined are collected, the maximum and minimum values of each dimension of the reference vector data population. Find a multidimensional subspace having a multidimensional rectangular parallelepiped with vertices,
If new vector data different from the reference vector data population is located inside the multidimensional subspace, it is determined that the determination target is in the same state as that corresponding to the reference vector data population, and the new vector data is is located outside the multidimensional subspace, determining that the determination target is different from the state corresponding to the reference vector data population;
Condition determination device. A state determination device calculates the multidimensional vector data formed by the reference vector data population in a multidimensional space equal to the number of dimensions of the reference vector data population in which multidimensional vector data whose dimensions are parameters related to the state to be determined. Find the dimensional subspace,
a state determination device determines that the state of the determination target is the same as the state corresponding to the reference vector data population if new vector data different from the reference vector data population is located inside the multidimensional subspace; If the new vector data is located outside the multidimensional subspace, determining that the determination target is different from the state corresponding to the reference vector data population;
A method for determining a condition ,
The surface of the multidimensional subspace is expressed by the following equation in a system whose origin is one point obtained from the reference vector data population.
Condition determination method.
Q=β*Max _i {<q, A _i >}・q
However, A _i is all vector data, Q is a vector connecting the origin and one point on the surface of the multidimensional subspace, vector q is a unit vector of Q, and <q, A i > is _vector q and A _i , and Max _i {<q, A _i >} is the maximum value of the inner product <q, A _i > of the reference vector q and all reference vector data A _i included in the population. The state determination device includes the reference vector data population in a multidimensional space equal to the number of dimensions of the reference vector data population in which multidimensional vector data whose dimensions include parameters related to the state to be determined is collected . and determining a multidimensional subspace having a multidimensional shape circumscribing at least one vector data included in the reference vector data population ,
a state determination device determines that the state of the determination target is the same as the state corresponding to the reference vector data population if new vector data different from the reference vector data population is located inside the multidimensional subspace; If the new vector data is located outside the multidimensional subspace, determining that the determination target is different from the state corresponding to the reference vector data population ;
A state determining device determines the size of the new vector data and the direction of the multidimensional subspace from the origin in the same direction as the new vector data in a system with the origin at one point obtained from the reference vector data population. determining the degree of difference from the state corresponding to the reference vector data population of the determination target using the distance to the outer circumferential surface;
Condition determination method. In a multidimensional space equal to the number of dimensions of the reference vector data population in which multidimensional vector data whose dimensions include parameters related to the state to be determined are collected, the state determination device determines each of the reference vector data populations . Find a multidimensional subspace having a multidimensional rectangular parallelepiped with the maximum and minimum dimensions as vertices ,
a state determination device determines that the state of the determination target is the same as the state corresponding to the reference vector data population if new vector data different from the reference vector data population is located inside the multidimensional subspace; If the new vector data is located outside the multidimensional subspace, determining that the determination target is different from the state corresponding to the reference vector data population;
Condition determination method.

Images