Patent ID: 11943243
Assignee: PANASONIC INTELLECTUAL PROPERTY CORPORATION OF AMERICA
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 9:
10. An anomaly detection device that, in a communication network system, determines whether a frame, which is contained in observation data constituted by a collection of frames transmitted and received over the communication network system and observed in a predetermined period, is anomalous, and outputs an anomalous part of a payload in a frame determined to be anomalous, the anomaly detection device comprising:
a reference model holder that holds a data distribution of a plurality of feature amounts pertaining to a part of the payload included in the frame, the part being at least one bit;
an anomaly detector that determines whether or not the frame contained in the observation data is anomalous;
an anomalous part outputter that, when the anomaly detector has detected an anomalous frame, calculates an anomaly contribution level for the plurality of feature amounts that have been extracted from the anomalous frame, and outputs an anomalous payload part, the anomalous payload part being at least one part contained in the frame and corresponding to a feature amount for which the anomaly contribution level is at least a predetermined value; and
a controller that determines an anomaly type,
wherein the reference model holder holds the data distribution for a collection of frames that are transmitted and received over the communication network system, the collection being obtained at a different timing from a timing at which the observation data is obtained,
the anomaly detector calculates a difference between the data distribution held by the reference model holder and a data distribution of a feature amount extracted from the frame contained in the observation data, and determines that the frame is an anomalous frame when the frame has a feature amount for which the difference is at least a predetermined value, and
the controller specifies an anomalous payload part length based on the anomalous payload part, and determines the anomaly type according to the anomalous payload part length.