ESTIMATION APPARATUS, ESTIMATION METHOD AND PROGRAM
The estimation apparatus includes: a conversion unit that converts abnormal packet data into abnormal vector data using a model that converts packet data into vector data in which each byte of the packet data is associated with each vector representing a characteristic of a value of each byte; an extraction unit that extracts normal vector data having a relatively high similarity to the abnormal vector data from among a plurality of pieces of normal vector data obtained by converting a plurality of pieces of normal packet data using the model; and an estimation unit that estimates an abnormal byte in the abnormal packet data from a similarity between a vector corresponding to each byte of the abnormal vector data and a vector corresponding to each byte of the extracted normal vector data.
1 . An estimation apparatus comprising:
a conversion unit, comprising one or more processors, configured to convert abnormal packet data into abnormal vector data using a model that converts packet data into vector data in which each byte of the packet data is associated with each vector representing a characteristic of a value of each byte;
an extraction unit, comprising one or more processors, configured to extract normal vector data having a relatively high similarity to the abnormal vector data from among a plurality of pieces of normal vector data obtained by converting a plurality of pieces of normal packet data using the model; and
an estimation unit, comprising one or more processors, configured to estimate an abnormal byte in the abnormal packet data from a similarity between a vector corresponding to each byte of the abnormal vector data and a vector corresponding to each byte of the extracted normal vector data.
2 . The estimation apparatus according to claim 1 ,
wherein the model is generated by learning a value of each byte of a plurality of pieces of normal packet data.
3 . The estimation apparatus according to claim 1 ,
wherein the extraction unit calculates a similarity between a vector of the abnormal vector data and a vector of the normal vector data for each byte of the abnormal vector data to calculate a similarity between the abnormal vector data and the normal vector data from the similarity calculated for each byte.
4 . The estimation apparatus according to claim 1 ,
wherein in a case where a highest similarity among similarities between a vector corresponding to a predetermined byte of the abnormal packet data and a vector corresponding to each byte of the extracted normal vector data is lower than a predetermined threshold, the estimation unit estimates a the predetermined byte as the abnormal byte.
5 . An estimation method comprising the steps of:
converting, abnormal packet data into abnormal vector data using a model that converts packet data into vector data in which each byte of the packet data is associated with each vector representing a characteristic of a value of each byte;
extracting, normal vector data having a relatively high similarity to the abnormal vector data from among a plurality of pieces of normal vector data obtained by converting a plurality of pieces of normal packet data using the model; and
estimating, an abnormal byte in the abnormal packet data from a similarity between a vector corresponding to each byte of the abnormal vector data and a vector corresponding to each byte of the extracted normal vector data.
6 . A non-transitory, computer-readable medium storing one or more instructions executable by a computer to perform operations as the estimation apparatus according to claim 1 .