Patent ID: 11962479
Assignee: PANASONIC INTELLECTUAL PROPERTY CORPORATION OF AMERICA
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. An abnormality detection method, comprising:
calculating, for a detection target packet stream made up of a plurality of detection target packets that are consecutive, a plurality of distances between the plurality of detection target packets;
extracting a feature amount of the detection target packet stream using the plurality of distances calculated; and
calculating information about a degree of abnormality in the detection target packet stream using the feature amount extracted, wherein
in the calculating of the plurality of distances, a Levenshtein distance between payloads of the plurality of detection target packets is used to calculate the plurality of distances,
the Levenshtein distance between the payloads of the plurality of detection target packets is calculated for each pair of detection target packets that are N packets apart from each other in the detection target packet stream, and the calculation is applied in units of M bits to at least a portion of bit strings included in the payloads, N being an integer greater than or equal to 1, M being an integer between 1 and 16, inclusive,
in the calculating of the plurality of distances, a distance for each pair of detection target packets that are N packets apart from each other in the detection target packet stream is calculated to calculate the plurality of distances, and
in the extracting of the feature amount, for each of one or more windows made up of W consecutive detection target packets in the detection target packet stream, a frequency distribution of the plurality of distances calculated for pairs of detection target packets belonging to the window is calculated, and the frequency distribution calculated is extracted as the feature amount, W being an integer greater than or equal to 2.