US 12,244,623 B2
Abnormality sensing device and abnormality sensing method
Masami Izumi, Tokyo (JP); Tomoyasu Sato, Tokyo (JP); Takeshi Nakatsuru, Tokyo (JP); Takuya Minami, Tokyo (JP); and Naoto Fujiki, Tokyo (JP)
Assigned to NIPPON TELEGRAPH AND TELEPHONE CORPORATION, Tokyo (JP)
Filed by NIPPON TELEGRAPH AND TELEPHONE CORPORATION, Tokyo (JP)
Filed on Jul. 14, 2023, as Appl. No. 18/222,340.
Application 18/222,340 is a continuation of application No. 17/255,897, previously published as PCT/JP2019/024928, filed on Jun. 24, 2019.
Claims priority of application No. 2018-121953 (JP), filed on Jun. 27, 2018.
Prior Publication US 2023/0362182 A1, Nov. 9, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06N 20/00 (2019.01); H04L 43/065 (2022.01)
CPC H04L 63/1425 (2013.01) [G06N 20/00 (2019.01); H04L 43/065 (2013.01); H04L 63/1416 (2013.01)] 3 Claims
OG exemplary drawing
 
1. An anomaly detection device comprising:
a memory; and
a processor coupled to the memory and programmed to execute a process comprising:
generating a first detection model using a learning communication log of the communication apparatus as first learning data, wherein the learning communication log represents a log of normal operations of the communication apparatus;
detecting anomaly of the communication apparatus using the first detection model, wherein the anomaly of the communication apparatus is based on an event that does not match a behavior pattern of the normal operations of the communication apparatus as indicated in the log of normal operations in the first learning data;
acquiring, in response to detecting the anomaly as a trigger by the first detection model, a second communication log of the communication apparatus, wherein the second communication log is generated during a predetermined period after a first communication log is generated, and the first communication log corresponds to the learning communication log of the normal operations used to generate the first detection model; and
instructing to generate a second detection model using the second communication log as second learning data based on difference information, wherein the difference information represents a difference between respective contents of the first communication log and the second communication log.