Estimation device, estimation method, and estimation program
An estimation apparatus includes processing circuitry configured to extract a predetermined number of similar normal pieces of packet data with a relatively high similarity to abnormal packet data from among a plurality of normal pieces of packet data based on a natural language processing model, and extract same-length packet data with the same packet length as the abnormal packet data from the similar normal packet data extracted, and compare the abnormal packet data with the same-length packet data for each byte to estimate an abnormal byte location.
1 . An estimation method, comprising: receiving an abnormal packet data identified as abnormal: extracting N normal pieces of packet data from a plurality of normal pieces of packet data by identifying the N normal pieces of packet data having the highest similarity scores related to the abnormal packet data, wherein the scores are calculated based on a natural language processing model and N is an integer;
determining whether a number of the extracted N normal pieces of packet data have a same packet length as the abnormal packet data and whether the number exceeds a threshold value;
determining that the number exceeds the threshold value;
in response to a determination that the number exceeds the threshold value, extracting same-length packet data having the same packet length as the abnormal packet data from the N normal pieces of packet data and comparing the abnormal packet data with the same-length packet data for each byte to estimate an abnormal byte location; and
determining that the number does not exceed the threshold value;
in response to a determination that the number does not exceed the threshold value, calculating an edit distance between the abnormal packet data and the N similar normal pieces of packet data to estimate an inserted or deleted byte location.
2 . The estimation apparatus according to claim 1 , wherein the processing circuitry is further configured to perform one-dimensional abnormality detection for treating each byte of the abnormal packet data and the same-length packet data as a value and comparing values.
3 . The estimation apparatus according to claim 1 , wherein N similar normal pieces of vector data with highest similarity scores relative to abnormal vector data obtained by converting the abnormal packet data using the natural language processing model are specified from among a plurality of normal pieces of vector data obtained by converting the plurality of normal pieces of packet data using the natural language processing model for converting the packet data into vector data in which each vector representing characteristics of a value of each byte of the packet data is associated with a byte, and the normal packet data before conversion of the N similar normal pieces of vector data is extracted as the N normal pieces of packet data.
4 . The estimation apparatus according to claim 1 , wherein the processing circuitry is further configured to use Bidirectional Encoder Representations from Transformers (BERT) as the natural language processing model.
5 . An estimation method, comprising:
receiving an abnormal packet data identified as abnormal;
extracting N normal pieces of packet data from a plurality of normal pieces of packet data by identifying the N normal pieces of packet data having highest similarity scores relative to the abnormal packet data, wherein the scores are calculated based on a natural language processing model and N is an integer;
determining whether a number of the extracted N normal pieces of packet data have a same packet length as the abnormal packet data and whether the number exceeds a threshold value;
in response to a determination that the number exceeds the threshold value, extracting same-length packet data having the same packet length as the abnormal packet data from the N normal pieces of packet data and comparing the abnormal packet data with the same-length packet data for each byte to estimate an abnormal byte location; and
in response to a determination that the number does not exceed the threshold value, calculating an edit distance between the abnormal packet data and the N similar normal pieces of packet data to estimate an inserted or deleted byte location.
6 . A non-transitory computer-readable recording medium storing therein an estimation program that causes a computer to execute a process comprising:
receiving an abnormal packet data identified as abnormal;
extracting N normal pieces of packet data from a plurality of normal pieces of packet data by identifying the N normal pieces of packet data having highest similarity scores relative to the abnormal packet data, wherein the scores are calculated based on a natural language processing model and N is an integer;
determining whether a number of the extracted N normal pieces of packet data have a same packet length as the abnormal packet data and whether the number exceeds a threshold value;
in response to a determination that the number exceeds the threshold value, extracting same-length packet data having the same packet length as the abnormal packet data from the N normal pieces of packet data and comparing the abnormal packet data with the same-length packet data for each byte to estimate an abnormal byte location; and
in response to a determination that the number does not exceed the threshold value, calculating an edit distance between the abnormal packet data and the N similar normal pieces of packet data to estimate an inserted or deleted byte location.