LEARNING DEVICE, LEARNING METHOD, AND LEARNING PROGRAM
A learning device acquires over-detection alerts in an anomaly detector. Then, the learning device clusters the acquired over-detection alerts into a plurality of clusters by using a Gaussian Mixture Model. Next, the learning device sorts, for each of the clusters, over-detection alerts belonging to the cluster in time series, and specifies a period of the sorted over-detection alerts. Then, the learning device samples the over-detection alerts from the cluster with the specified period. Thereafter, the learning device performs over-detection feedback for the anomaly detector by using the over-detection alerts sampled from each cluster.
1 . A learning device comprising:
a memory; and
a processor coupled to the memory and programmed to execute a process comprising:
acquiring communication feature values of communication over-detected in an anomaly detector that detects an anomaly in communication;
clustering the acquired communication feature values into a plurality of clusters;
sorting, for each of the clusters, communication feature values belonging to the cluster in time series, specifying a period of the sorted communication feature values, and sampling the communication feature values with the specified period; and
performing additional learning for over-detection feedback on the anomaly detector by using the communication feature values sampled from each of the clusters.
2 . The learning device according to claim 1 , wherein
the clustering is configured to:
using a Gaussian Mixture Model to cluster the communication feature values into a plurality of clusters.
3 . The learning device according to claim 1 , wherein
the sampling is configured to:
randomly sampling the communication feature values from the communication feature values belonging to the cluster in a case where it has not been possible to specify the period of the communication feature values belonging to the cluster.
4 . The learning device according to claim 1 , wherein the sampling is configured to:
calculating an autocorrelation coefficient of each of the sorted communication feature values, and specifying the period of the communication feature values on the basis of the calculated autocorrelation coefficient.
5 . The learning device according to claim 1 , further comprising:
detecting an anomaly in communication that has been input, by using the anomaly detector after additional learning.
6 . A learning method executed by a learning device, the learning method comprising:
a step of acquiring communication feature values of communication over-detected in an anomaly detector that detects an anomaly in communication;
a step of clustering the acquired communication feature values into a plurality of clusters;
a step of sorting, for each of the clusters, communication feature values belonging to the cluster in time series, specifying a period of the sorted communication feature values, and sampling the communication feature values with the specified period; and
a step of performing additional learning for over-detection feedback on the anomaly detector by using the communication feature values sampled from each of the clusters.
7 . A non-transitory computer readable storage medium having stored therein a learning program that causes a computer to execute a process comprising the steps of:
a step of acquiring communication feature values of communication over-detected in an anomaly detector that detects an anomaly in communication;
a step of clustering the acquired communication feature values into a plurality of clusters;
a step of sorting, for each of the clusters, communication feature values belonging to the cluster in time series, specifying a period of the sorted communication feature values, and sampling the communication feature values with the specified period; and
a step of performing additional learning for over-detection feedback on the anomaly detector by using the communication feature values sampled from each of the clusters.