Nippon Telegraph and Telephone Corporation

Ntt Corporation

Masanori Yamada

Yuki Yamanaka

Tomokatsu Takahashi

Erina Takeshita

Yasuhiro Teramoto

Yuminobu Igarashi

Tomohiro Nagai

An estimation device includes processing circuitry configured to generate a feature quantity by performing invertible transformation on a payload of a packet character by character with respect to each packet determined to be abnormal or normal by an abnormality detector, and give a determination result as to whether a packet is abnormal or normal to the generated feature quantity, learn a model that classifies whether the packet is abnormal or normal by machine learning using the feature quantity of the payload of the packet and the determination result as to whether the packet is abnormal or normal as teacher data, extract a number of dimensions of the feature quantity in which a contribution degree to classification is equal to or greater than a predetermined value in the learned model, and estimate a cause part of abnormality in the payload of the packet determined to be abnormal.

Estimation device, estimation method, and estimation program

A learning apparatus includes: a first estimation unit—configured to learn normal communication data, estimate probability density of the normal communication data, and update a parameter of a model; a clustering unit configured to cluster the normal communication data according to the probability density estimated by the first estimation unit; a second estimation unit configured to perform learning for each of clusters resulting from the clustering by the clustering unit, and estimate the probability density of the normal communication data of the cluster and update a parameter of a model representing characteristics of the probability density of the normal communication data of the cluster by using, as an initial value of the parameter, a parameter having already been learned in the first estimation unit; and an integration unit configured to integrate the estimated probability density of the clusters.

Training device, detection system, training method, and training program

An object of the present invention is to provide a band estimation device, a band estimation method, and a program capable of calculating a necessary band of a link of a communication system with high accuracy, and ensure the communication quality and improve the band utilization efficiency. In the present invention, a machine learning model is created by learning a set of an upper limit value (line information) of a communication band of each line and observed traffic data for a communication system in which a plurality of lines is accommodated in a link between communication devices, a probability density function of a traffic amount at each time is estimated on the basis of the generated machine learning model and the line information at each time, and an upper limit value of a confidence interval of the estimated probability density function is set as a necessary band.

Band estimation device, band estimation method, and program

An evaluation device receives input of latent variables of a variational autoencoder, clusters the input latent variables, and assigns, for each cluster, a label indicating the cluster to latent variables belonging to the cluster. After that, the evaluation device performs learning of a classifier so as to accurately classify the latent variables based on the assigned label, performs an adversarial attack resistance evaluation for the classifier after learning, and outputs a result of the resistance evaluation. Thus, the evaluation device can perform an adversarial attack resistance evaluation even for a variational autoencoder that uses unlabeled data as input data.

Evaluation device, evaluation method, and evaluation program

A detecting device obtains a network log and a host log of a device. The detecting device converts the network log into a network feature value in a form which is inputtable to a multimodal generative model which generates output data on the basis of multiple latent variables represented by random variables. The detecting device converts the host log into a host feature value in a form which is inputtable to the generative model. The detecting device also inputs at least one of the network feature value and the host feature value to the generative model and calculates output data. The detecting device detects an abnormality about the device using an anomaly score calculated on the basis of the output data.

Growing community of inventors

Musashino, Japan

Masanori Yamada