When there is the same-length normal packet data with the number of abnormal byte locations smaller than a certain value, the abnormal byte estimation unit 242 selects the normal packet data with the smallest abnormal byte location from among the same-length normal pieces of packet data with the number of abnormal byte locations smaller than the certain value as the final similar normal packet data. Thereafter, the abnormal byte estimation unit 242 estimates the stored abnormal byte location in the final similar normal packet data as the abnormal byte 18.

On the other hand, when the number of abnormal byte locations in all of the acquired the same-length normal pieces of packet data is equal to or greater than the certain value, the abnormal byte estimation unit 242 performs processing as having no final similar normal packet data corresponding to the abnormal packet data 15. Here, the constant value is, for example, a parameter that can designate about ⅓ to ½ of the packet length.

The inserted/deleted byte location estimation unit 243 acquires the abnormal packet data 15 and the predetermined number of normal pieces of packet data from the length comparison unit 241. The inserted/deleted byte location estimation unit 243 compares the acquired normal packet data with the abnormal packet data 15 in order to specify an inserted byte location or deleted byte location of the byte in the abnormal packet data 15.

Specifically, the inserted/deleted byte location estimation unit 243 calculates the edit distance between the abnormal packet data 15 and each normal packet piece of data using dynamic programming. The inserted/deleted byte location estimation unit 243 can calculate the edit distance and specify an inserted byte location suspected of insertion or a deleted byte location suspected of deletion.

When there is normal packet data of which the edit distance is smaller than a certain distance, the inserted/deleted byte location estimation unit 243 selects the normal packet data with the shortest edit distance from among the normal pieces of packet data of which the edit distance is smaller than the certain distance, as the similar normal packet data. The inserted/deleted byte location estimation unit 243 estimates the inserted/deleted byte location 19 using the edit distance of the selected final similar normal packet data.

On the other hand, when the edit distance is equal to or greater than the certain distance in all of the acquired normal pieces of packet data, the inserted/deleted byte location estimation unit 243 processes as having no final similar normal packet data corresponding to the abnormal packet data 15. Here, the certain distance is a parameter that can designate, for example, about ⅓ to ½ of the packet length.

[Processing of Embodiment] FIG. 3 is a flowchart of estimation processing in the estimation apparatus according to an embodiment. Next, a flow of the estimation processing in the estimation apparatus according to the present embodiment will be described with reference to FIG. 3.

The conversion unit 21 converts the abnormal packet data 15 into the abnormal vector data 16 (step S1).

The extraction unit 23 extracts the predetermined number of normal pieces of vector data similar to the abnormal vector data 16 converted in step S1 from the normal vector data group 12 (step S2) to obtain a similar normal vector data group.

Next, the extraction unit 23 acquires, from the normal packet data group 13, the predetermined number of normal pieces of packet data before conversion of the normal vector data included in the similar normal vector data group (step S3), and uses a set of similar normal pieces of packet data as a similar normal packet data group 17.

The length comparison unit 241 of the estimation unit 24 compares the abnormal packet data 15 with each similar normal packet piece of data included in the similar normal packet data group 17 (step S4). The length comparison unit 241 determines whether or not the number of normal pieces of packet data having the same packet length as the abnormal packet data 15 equal to or greater than the determination threshold value are included in the similar normal packet data group 17 (step S5).

When there are the number of the same-length normal pieces of packet data equal to or greater than the determination threshold value (Yes in step S5), the length comparison unit 241 determines that there is the abnormal byte 18. The length comparison unit 241 transmits the abnormal packet data 15 and the same-length normal packet data to the abnormal byte estimation unit 242. The abnormal byte estimation unit 242 acquires the abnormal packet data 15 and the same-length normal packet data, and executes abnormal byte estimation processing (step S6).

On the other hand, when the number of same-length normal packet data is smaller than the determination threshold value (step S5: No), the length comparison unit 241 determines that there is an inserted byte location or a deleted byte location. The length comparison unit 241 transmits all of the abnormal packet data 15 and the predetermined number of similar normal pieces of packet data included in the similar normal packet data group 17 to the inserted/deleted byte location estimation unit 243. The inserted/deleted byte location estimation unit 243 acquires the abnormal packet data 15 and the predetermined number of similar normal pieces of packet data, and executes inserted/deleted byte location estimation processing (step S7).

FIG. 4 is a flowchart of the abnormal byte estimation processing. A flow illustrated in FIG. 4 corresponds to an example of the abnormal byte estimation processing executed in step S6 in FIG. 3.

The abnormal byte estimation unit 242 selects one unselected same-length normal packet piece of data from the same-length normal packet data (step S101).

Next, the abnormal byte estimation unit 242 sets 1 which is a parameter representing the position of the byte to be compared to n (step S102).

Next, the abnormal byte estimation unit 242 compares an n-th byte of the selected same-length normal packet data with an n-th byte of the abnormal packet data 15 (step S103). For example, the abnormal byte estimation unit 242 directly treats a value of the n-th byte of the selected same-length normal packet data as a value between 0 and 255 to calculate the interquartile range. The abnormal byte estimation unit 242 determines whether or not the value of the n-th byte of the abnormal packet data 15 is included in the calculated interquartile range.

Next, the abnormal byte estimation unit 242 determines whether or not the n-th byte is an abnormal byte using a comparison result (step S104). For example, when the value of the n-th byte of the abnormal packet data 15 is included in the calculated interquartile range, the abnormal byte estimation unit 242 determines that the n-th byte is normal. Conversely, when the value of the n-th byte of the abnormal packet data 15 is not included in the calculated interquartile range, the abnormal byte estimation unit 242 regards the n-th byte as an abnormal byte. When the n-th byte is not an abnormal byte (step S104: No), the abnormal byte estimation unit 242 proceeds to step S106.

On the other hand, when the n-th byte is the abnormal byte (Yes in step S104), the abnormal byte estimation unit 242 stores the n-th byte in the abnormal packet data 15 as the abnormal byte location (step S105) and proceeds to S106.

The abnormal byte estimation unit 242 determines whether or not the n-th byte is the last byte in the abnormal packet data 15 (step S106). When the n-th byte is not the last byte (step S106: No), the abnormal byte estimation unit 242 increments n by 1 (step S107) and returns to step S103.

On the other hand, when the n-th byte is the last byte (Yes in step S106), the abnormal byte estimation unit 242 determines whether or not the selection of all the same-length normal pieces of packet data has been completed (step S108). When unselected same-length normal packet data remains (step S108: NO), the abnormal byte estimation unit 242 returns to step S101.

On the other hand, when all the same-length normal pieces of packet data have been selected (Yes in step S108), the abnormal byte estimation unit 242 determines whether or not there is the same-length normal packet data in which the number of locations of the stored abnormal bytes is smaller than the certain value (step S109).

When there is the same-length normal packet data with the number of abnormal byte locations smaller than the certain value (step S109: Yes), the abnormal byte estimation unit 242 performs the following processing. In this case, the abnormal byte estimation unit 242 selects normal packet data with the smallest number of abnormal byte locations as the final similar normal packet data from among the same-length normal pieces of packet data with the number of abnormal byte locations smaller than the certain value. The abnormal byte estimation unit 242 estimates the abnormal byte location of the stored abnormal packet data 15 for the final similar normal packet data as the abnormal byte 18 (step S110), and ends the abnormal byte estimation processing.

On the other hand, when there is no same-length normal packet data with the number of abnormal byte locations smaller than the certain value (step S109: NO), the abnormal byte estimation unit 242 determines that there is no final similar normal packet data (step S111), and ends the abnormal byte estimation processing.

FIG. 5 is a flowchart of the inserted/deleted byte location estimation processing. A flow illustrated in FIG. 5 corresponds to an example of inserted/deleted byte location estimation processing executed in step S7 in FIG. 3.

The inserted/deleted byte location estimation unit 243 selects one unselected normal packet piece of data from the predetermined number of similar normal pieces of packet data (step S201).

Next, the inserted/deleted byte location estimation unit 243 calculates the edit distance between the abnormal packet data 15 and the selected similar normal packet data using dynamic programming (step S202).

Next, the inserted/deleted byte location estimation unit 243 determines whether or not all the predetermined number of similar normal pieces of packet data have been selected (step S203). When unselected normal packet data among the predetermined number of similar normal pieces of packet data remains (step S203: NO), the inserted/deleted byte location estimation unit 243 returns to step S201.

On the other hand, when the selection of all the predetermined number of similar normal pieces of packet data is completed (step S203: Yes), the inserted/deleted byte location estimation unit 243 determines whether or not there is similar normal packet data of which the edit distance is smaller than the certain distance (step S204).

When there is similar normal packet data of which the edit distance is smaller than the certain distance (Yes in step S204), the inserted/deleted byte location estimation unit 243 executes the following processing. In this case, the inserted/deleted byte location estimation unit 243 selects the similar normal packet data with the shortest edit distance among the similar normal pieces of packet data of which the edit distance is smaller than the certain distance as the final similar normal packet data. The inserted/deleted byte location estimation unit 243 estimates the inserted/deleted byte location 19 using the edit distance between the selected final similar normal packet data and the abnormal packet data 15 (step S205), and ends the inserted/deleted byte location estimation processing.

On the other hand, when there is no similar normal packet data of which the edit distance is smaller than the certain distance (step S204: NO), the inserted/deleted byte location estimation unit 243 determines that there is no final similar normal packet data (step S206), and ends the abnormal byte estimation processing.

[Experimental Results] Next, experiment results when the estimation apparatus 1 according to the present embodiment has performed an experiment for estimating the abnormal byte 18 or inserted/deleted byte location 19 will be described. Here, the experiment was performed under the following conditions. BERT has been trained by performing learning with 30,000 Modbus/TCP. Further, 400 normal pieces of packet data and 100 abnormal pieces of packet data 15 were used as a data set.

The abnormal pieces of packet data 15 were input one by one in order to perform cause estimation. Further, in this experiment, only perfect match has been regarded as estimation success.

As a first experiment, a byte rewriting experiment in which n locations in the payload are rewritten with random bytes was performed.

FIG. 6 is a diagram illustrating experimental results when the rewriting of the byte has been performed. Further, FIG. 7 is a diagram illustrating experimental results when a random byte is inserted. Further, FIG. 8 is a diagram illustrating experimental results when bytes are deleted. In FIGS. 6 to 8, a vertical axis represents a rate of estimation success, and a horizontal axis represents the number of deleted bytes. Here, the rate of estimation success represents a rate of successful estimation, with 1 being a case in which the estimation is successful for all of 100 abnormal pieces of packet data 15.

In the case of an experiment in which bytes are rewritten, the estimation apparatus 1 can perform estimation of about 90% even when five locations are rewritten, as illustrated in FIG. 6. In this case, since the packet length ranges from 12 to 25, it can be considered that the estimation accuracy is quite good when the estimation can be substantially performed even when rewriting in five locations is performed.