NETWORK ABNORMALITY DETECTION DEVICE AND NETWORK ABNORMALITY DETECTION METHOD
PROBLEM TO BE SOLVED: To provide technology which is adaptable in network abnormality detection to the periodical fluctuation of a network.SOLUTION: In a network abnormality detection device 100, a matrix generation unit 111 generates a matrix composed of traffic volumes input and output by devices...
Gespeichert in:
Hauptverfasser: | , , |
---|---|
Format: | Patent |
Sprache: | eng |
Schlagworte: | |
Online-Zugang: | Volltext bestellen |
Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
Zusammenfassung: | PROBLEM TO BE SOLVED: To provide technology which is adaptable in network abnormality detection to the periodical fluctuation of a network.SOLUTION: In a network abnormality detection device 100, a matrix generation unit 111 generates a matrix composed of traffic volumes input and output by devices operating in a network, and an eigenvector arithmetic unit 112 calculates an eigenvector of the matrix, where an eigenvector at the present point of time is referred to as the current vector. A reference vector arithmetic unit 113 executes time series prediction arithmetic on eigenvectors in a predetermined past period by taking the periodical fluctuation of a network into account to calculate a reference vector. An abnormality determination unit 114 calculates an abnormality score from an angular difference between the current vector and the reference vector. Then the abnormality determination unit 114 compares the abnormality score and a threshold value and, if the abnormality score is larger than the threshold value, determines that the network has abnormality. A threshold value arithmetic unit 115 executes time series prediction arithmetic on the past abnormality scores or past threshold values to calculate a threshold value. |
---|