US 12,438,897 B2
Threshold value calculation device, anomaly detection device, threshold value calculation method, and anomaly detection method
Yusuke Suzuki, Osaka (JP); Moe Yoshida, Osaka (JP); Hiroyasu Terazawa, Osaka (JP); Seiichi Muroya, Osaka (JP); and Toshimasa Takaki, Tokyo (JP)
Assigned to Panasonic Intellectual Property Corporation of America, Torrance, CA (US)
Filed by Panasonic Intellectual Property Corporation of America, Torrance, CA (US)
Filed on Jun. 20, 2023, as Appl. No. 18/211,941.
Application 18/211,941 is a continuation of application No. PCT/JP2021/042362, filed on Nov. 18, 2021.
Claims priority of application No. 2020-214471 (JP), filed on Dec. 24, 2020.
Prior Publication US 2023/0336576 A1, Oct. 19, 2023
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1425 (2013.01) 13 Claims
OG exemplary drawing
 
1. A threshold value calculation device that calculates a threshold value used by an anomaly detection device that detects anomalous communication of a first device that is connected to an in-facility network and provided in a facility in which the in-facility network is installed and a second device that is different from the first device is provided, the threshold value calculation device comprising:
a processor; and
a memory including a computer program that, when executed by the processor, causes the processor to perform functions, the functions including:
acquiring a device state of the first device during a first period;
determining an occupancy state by people in the facility during the first period based on information acquired from the second device;
collecting a communication log generated based on communication transmitted and received by the first device during the first period; and
calculating the threshold value for the communication transmitted and received by the first device during a second period that is after the first period based on the device state, the occupancy state, and the communication log,
wherein the device state includes one or more states of the first device,
the occupancy state includes one or more states of the people, and
the processor calculates the threshold value for each of combinations of the one or more states of the first device and the one or more states of the people.