ESTIMATION DEVICE, ESTIMATION METHOD, AND ESTIMATION PROGRAM
An estimation device includes processing circuitry configured to extract a fixed-length feature amount from a payload of communication data, calculate a similarity between feature amounts of abnormal communication data, and determine that events are of a same type when the calculated similarity is greater than a predetermined threshold.
1 . An estimation device comprising:
processing circuitry configured to:
extract a fixed-length feature amount from a payload of communication data;
calculate a similarity between feature amounts of abnormal communication data; and
determine that events are of a same type when the calculated similarity is greater than a predetermined threshold.
2 . The estimation device according to claim 1 , wherein the processing circuitry is further configured to
extract the fixed-length feature amount by converting the payload into a fixed-length feature vector by Bidirectional Encoder Representations from Transformers (BERT),
calculate a distance between feature vectors as a similarity between the converted feature vectors of the abnormal communication data, and
determine that events are of a same type when the distance between the feature vectors is less than a predetermined threshold.
3 . The estimation device according to claim 1 , wherein the processing circuitry is further configured to detect the abnormal communication data by a model that determines whether the communication data is normal or abnormal using the fixed-length feature amount extracted from the payload of the communication data.
4 . The estimation device according to claim 3 , wherein the processing circuitry is further configured to learn the model by using the fixed-length feature amount extracted from the payload of the communication data.
5 . An estimation method executed by an estimation device, the estimation method comprising:
extracting a fixed-length feature amount from a payload of communication data;
calculating a similarity between feature amounts of abnormal communication data; and
determining that events are of a same type when the calculated similarity is greater than a predetermined threshold.
6 . A non-transitory computer-readable recording medium storing therein an estimation program that causes a computer to execute a process comprising:
extracting a fixed-length feature amount from a payload of communication data;
calculating a similarity between feature amounts of abnormal communication data; and
determining that events are of a same type when the calculated similarity is greater than a predetermined threshold.