Detecting apparatus, training apparatus, detecting method, training method, detecting program, and training program
A detection device includes: an encoding unit that converts one packet to be detected into one fixed-length vector by using natural language processing technology; and a detection unit that detects presence or absence of an abnormality in the packet to be detected based on the fixed-length vector converted by the encoding unit using a detection model.
1 . A detection device, comprising:
a memory; and
a processor coupled to the memory and programmed to execute perform a process comprising:
applying a pretrained language model to a packet to be detected to produce a fixed-length vector that represents features of an internal byte sequence in the packet to be detected; and
detecting presence or absence of an abnormality in the packet to be detected by applying a pretrained detection model to the fixed-length vector, wherein:
the pretrained detection model is one of a variational auto encoder (VAE), an auto encoder (AE), and a local outlier factor (LoF);
training data for the pretrained detection model is a set of normal fixed-length vectors; and
the normal fixed-length vectors are produced by applying the pretrained language model to normal packets.
2 . The detection device of claim 1 , wherein the detecting presence or absence of an abnormality in the packet to be detected includes detecting the abnormality of the packet to be detected when a pattern of the fixed-length vector is different from patterns of the normal fixed-length vectors.
3 . The detection device of claim 1 , wherein the detecting presence or absence of an abnormality in the packet to be detected includes (i) obtaining an abnormality degree with respect to the fixed-length vector and (ii) detecting an abnormality of the packet to be detected when the abnormality degree exceeds a predetermined threshold value.
4 . A detection method executed by a detection device, the detection method comprising:
applying a pretrained language model to a packet to be detected to produce a fixed-length vector that represents features of an internal byte sequence in the packet to be detected; and
detecting presence or absence of an abnormality in the packet to be detected based by applying a pretrained detection model to the fixed-length vector, wherein:
the pretrained detection model is one of a variational auto encoder (VAE), an auto encoder (AE), and a local outlier factor (LoF);
training data for the pretrained detection model is a set of normal fixed-length vectors; and
the normal fixed-length vectors are produced by applying the pretrained language model to normal packets.
5 . A computer-readable recording medium storing computer executable instructions which, when executed by a processor, cause the processor to perform a process comprising:
applying a pretrained language model to a packet to be detected to produce a fixed-length vector that represents features of an internal byte sequence in the packet to be detected; and
detecting presence or absence of an abnormality in the packet to be detected based by applying a pretrained detection model to the fixed-length vector, wherein:
the pretrained detection model is one of a variational auto encoder (VAE), an auto encoder (AE), and a local outlier factor (LoF);
training data for the pretrained detection model is a set of normal fixed-length vectors; and
the normal fixed-length vectors are produced by applying the pretrained language model to normal packets.