JP2006033039A - Passing route detector, detecting method and detecting program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To specify the passing route of a specific packet group of tracking object when it is transmitted from a plurality of sources. <P>SOLUTION: The passing route detector 1 comprises a section 3 for observing packet groups passing through the branches 2a-2d of a router 2, respectively, a section 4 for performing independent component analysis of packet groups observed at the packet observing section 3, a section 5 for storing information pertaining to packet groups passed through the branches 2a-2d in the past, a section 6 for specifying the passing route of a specific packet group based on the results of independent component analysis derived at the analyzing section 4, and a section 7 for outputting specification results from the route specifying section 6. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention provides a specific packet group in a branching unit that is arranged on a network and includes a plurality of branches for connecting to other components on the network, and packets are input and output through the plurality of branches. The present invention relates to a technique for detecting the passage route of the.

  2. Description of the Related Art Conventionally, with the development of networks such as the Internet, attacks that send a large number of packets to a specific server, such as a DoS (Denial of Service) attack, are known. When such an attack is made, it is necessary to trace the source of the packet. Usually, information about the source of the packet used for the DoS attack or the like is falsified. Therefore, when a DoS attack or the like is performed, it is difficult to specify a packet transmission source by a normal tracking unit.

  For this reason, in recent years, a method has been proposed in which a transmission source is identified by tracking the passage route of a packet group passing through a router or the like based on the similarity of the passage pattern of a specific packet group. Specifically, it is possible to identify the source of a specific packet group by tracking the passage route of a packet group having a passage pattern similar to the passage pattern that is the amount of time change of packets used for DoS attacks, etc. (For example, see Non-Patent Document 1).

Jun Sakaguchi, Kohei Ota, Yuji Izumi, Nei Kato, Yoshiaki Nemoto, “Tracking DDoS by comparing traffic patterns based on quadratic programming”, IEICE Transactions, IEICE, August 2002, Vol.j85-B, No.8, p1295-1303

  However, the conventional packet tracking method has a problem that the accuracy of specifying the transmission source is lowered when an attack is performed on a specific server or the like using a plurality of servers or the like like a DDoS attack. That is, when a DDoS attack using a plurality of servers or the like is performed, the server arrives at the attack target server or the like in a state where packets transmitted from the plurality of servers or the like are combined. For this reason, the passage pattern of the packet group that reaches the attack target server, etc. is different from the passage pattern of the packet group that is transmitted from the individual transmission source. It becomes difficult to specify the origin.

  The present invention has been made in view of the above, and when a specific packet group to be tracked is transmitted from a plurality of transmission sources, it is possible to specify a passage route detection of the specific packet group An object of the present invention is to realize a device, a passage route detection method, and a passage route detection program.

  A plurality of branches arranged on the network and connected to other components on the network, and a path for passing a specific packet group in a branching means for inputting and outputting packets via the plurality of branches A path detection device for detecting a specific packet group output from the branching unit via a predetermined branch and input to the branching unit via a branch selected from branches other than the predetermined branch The comparison packet group and the independent component analysis result of the specific packet group and the comparison using the independent component extracted from the observation result of the past packet group input to the branching unit through the selected branch in the past The present invention is characterized in that route specifying means for specifying one or more branches used for input of the specific packet group based on the comparison with the independent component analysis result of the packet group is provided.

  According to the first aspect of the present invention, there is provided a passage route specifying means for specifying the branch used for inputting the specific packet group based on the independent component analysis result derived from the information regarding the packet group passing through the branch. Even when a specific packet group is input to the branching means via a plurality of branches, accurate path detection can be performed regardless of variations in the passage pattern.

  According to a second aspect of the present invention, there is provided the passage detection device according to the above invention, wherein the route specifying unit includes a mixture ratio in an independent component analysis result of the specific packet group output via the predetermined branch, and the predetermined Identifying one or more branches used for input of the specific packet group based on the similarity between the mixture ratio in the independent component analysis result of the packet group input via each of the branches other than the branch It is characterized by.

  According to a third aspect of the present invention, there is provided the passage detection apparatus according to the above-described invention, wherein the route specifying unit has a predetermined tolerance in which the Euclidean distance between the specific packet group and the mixing ratio is set for each branch to be compared. The branch through which the comparison packet group corresponding to the mixture ratio having a value outside the range passes is specified as the branch used for input of the specific packet group.

  According to a fourth aspect of the present invention, in the above-described invention, the permissible range includes the mixture ratio of the specific packet group and the mixture ratio of the independent component analysis result regarding the packet group that has passed through the branch to be compared in the past. Between the average value of the Euclidean distances and the average value of the Euclidean distances, and a variance value of the Euclidean distances. It is the value below the difference value with the value of 2 times.

  According to a fifth aspect of the present invention, in the above-described invention, the passage detection device includes a packet observation unit that observes the comparison packet group and the specific packet group that are input to the branch unit via the branch to be compared, and the comparison packet. Group, an analysis unit that performs independent component analysis of observation results regarding the past packet group and the specific packet group, and a storage unit that stores observation results of the past packet group observed prior to route specification. Features.

  According to a sixth aspect of the present invention, there is provided a passing route detection method including a plurality of branches arranged on a network and connected to other components on the network, and input / output of packets via the plurality of branches. A path detection method for detecting a path of a specific packet group in a branching unit in which a branching unit is performed, wherein the specific packet group output from the branching unit via a predetermined branch, from among branches other than the predetermined branch The independent packet extracted from the observation result of the comparison packet group input to the branching unit through the selected branch and the past packet group input to the branching unit through the selected branch in the past is used as a component. And identifying one or more branches used for input of the specific packet group based on a comparison between the independent component analysis result of the specific packet group and the independent component analysis result of the comparison packet group. Characterized in that it comprises a path specifying process.

  According to a seventh aspect of the present invention, there is provided the passage detection method according to the above invention, wherein the Euclidean distance between the specific packet group and the mixing ratio is set for each branch to be compared in the route specifying step. The branch through which the comparison packet group corresponding to the mixture ratio having a value outside the range passes is specified as the branch used for input of the specific packet group.

  In addition, in the above-described invention, the permissible range includes the mixture ratio of the specific packet group and the mixture ratio of the independent component analysis result regarding the packet group that has passed through the branch to be compared in the past. Between the average value of the Euclidean distances and the average value of the Euclidean distances, and a variance value of the Euclidean distances. It is the value below the difference value with the value of 2 times.

  A passage route detection program according to claim 9 causes a computer to execute the method according to claim 7 or 8.

  A passage detection device, a passage detection method, and a passage detection program according to the present invention specify a branch used for input of a specific packet group based on an independent component analysis result derived from information on a packet group passing through a branch. Because it is configured to include a passing route specifying means, it is possible to accurately detect a route regardless of changes in the passing pattern even when a specific packet group is input to the branching means via a plurality of branches. The effect that it is.

  The best mode (hereinafter simply referred to as “embodiment”) for carrying out the passage route detection device, the passage route detection method, and the passage route detection program according to the present invention will be described below. It should be noted that the drawings referred to in the following description are schematic and do not necessarily match the actual ones.

  First, a passage detection apparatus according to an embodiment will be described. The passage detection apparatus according to the present embodiment is provided in the branching unit when passing through the branching unit with respect to a specific packet group passing through the branching unit such as a router having a plurality of branches for inputting and outputting packets. By detecting which branch is input to the branching unit, the passage route of the specific packet group in the branching unit is detected.

  FIG. 1 is a schematic diagram showing the overall configuration of the passage detection apparatus according to the present embodiment. As shown in FIG. 1, the passage detection device 1 according to the present embodiment is observed by a packet observation unit 3 that observes a packet group that passes through each of the branches 2 a to 2 d of the router 2, and is observed by the packet observation unit 3. An analysis unit 4 for performing independent component analysis on the received packet group, a storage unit 5 for storing information on past passing packet groups for each of the branches 2a to 2d, and an independent component derived by the analysis unit 4 A path specifying unit 6 that specifies the passage route of the specific packet group based on the analysis result and an output unit 7 that outputs the specifying result by the path specifying unit 6 are provided.

  The packet observation unit 3 is for observing a packet group passing through the branches 2a to 2d provided in the router 2 and acquiring information on the packet group. Specifically, the packet observation unit 3 has a function of counting the number of packets passing through each of the branches 2a to 2d, for example, and acquires a time change pattern of the number of passing packets as information on the packet group. In addition, the packet observation unit 3 outputs information on the packet group to the storage unit 5 for use in derivation of an allowable range when specifying a future passage route, and for use in specifying the current passage route. It has a function of outputting to the specifying unit 6.

  The analysis unit 4 is for performing independent component analysis on a packet group that passes through the branches 2 a to 2 d provided in the router 2. Here, independent component analysis is one of the methods used when decomposing an observation signal formed by linear summation of a plurality of information source signals into a plurality of independent signals. In this embodiment, an analysis unit 4 extracts independent components based on observation results relating to a specific data group, a comparison data group, and a past data group, which will be described later, and an independent component extracted from the specific data group, the comparison data group, and the past data group as a component. Component analysis results shall be obtained.

Further, the analysis unit 4 specifically performs independent component analysis on the packet group observed by the packet observation unit 3 or the packet group stored in the storage unit 5 based on the instruction of the route specifying unit 6, It has a function of outputting the analysis result to the path specifying unit 6. Result y of the independent component analysis that is derived by the analysis unit 4, for each packet group, (the _n 2 or greater natural number) mixing ratio a ₁ ~a n with and independent component i ₁ through i _n,

y = a ₁ i ₁ + a ₂ i ₂ +... + a _n i _n (1)

It shall be defined in the form of

  In addition, it is preferable to use a packet group having a time length equal to the time length of the specific packet group from the viewpoint of performing accurate path identification, as the packet group to be subjected to independent component analysis derived by the analysis unit 4. For the comparison packet group described later, it is preferable to use a packet group in the same time zone as the time zone in which the specific packet group is output from the router 2.

  The storage unit 5 is for storing information on the packet observed by the packet observation unit 3. The storage unit 5 has a function of outputting necessary information to the route specifying unit 6 based on an instruction from the route specifying unit 6. The information regarding the packet group stored in the storage unit 5 is used, for example, for deriving an allowable range used for specifying a passing route by the route specifying unit 6.

  The output unit 7 is for outputting the result of specifying the passage route of the specific packet group by the route specifying unit 6. The output form of the output unit 7 may be such that the specific result is visually displayed on a display or the like, or the specific result may be output to another medium such as a printer. Further, the output unit 7 may have a function of converting the identification result obtained by the path identifying unit 6 into a specific data format as necessary and outputting the result as electronic data.

  When the specific packet group is output from the router 2 via any one of the branches 2a to 2d, the path specifying unit 6 is configured to specify the branch that has passed when the specific packet group is input to the router 2. Is. Specifically, the path specifying unit 6 outputs the information regarding the packet group acquired by the packet observation unit 3 and the information stored in the storage unit 5 to the analysis unit 4, and the analysis unit 4 based on the information. The router 2 has a function of specifying a passage route of a specific packet group in the router 2 by using the independent component analysis result derived by the above.

  The route specifying unit 6 performs the independent component analysis on the specific data group and the independent component result on the comparative data group based on the independent component analysis using the independent components extracted regarding the specific data group, the comparison data group, and the past data group as constituent elements. By comparing, the router 2 has a function of specifying the passage route of the specific packet group. Specifically, the path specifying unit 6 compares the mixing ratios in the independent component analysis results for each packet group, and determines the branch through which the packet group having a mixing ratio similar to the mixing ratio in the specific packet group has passed. It has a function to specify as a branch used for input. In the present embodiment, the path specifying unit 6 has a function of determining the similarity of the mixture ratio using the Euclidean distance between the mixture ratios for each packet group.

Here, the Euclidean distance refers to a value obtained by multiplying the square sum of the difference values between the corresponding mixing ratios by the (½) power in the independent component analysis results respectively derived from a plurality of packet groups. Is defined as follows. That is, independent component analysis results y ₁ and y ₂ respectively derived for a plurality of packet groups are

_{y 1 = a 1 'i 1} + a 2' i 2 + ··· + a n 'i n ··· (2)
_{y 2 = a 1 '' i} 1 + a 2 '' i 2 + ··· + a n '' i n ··· (3)

Euclidean distance d is expressed as

_{d = {(a 1 '-a} 1'') 2 + (a 1' -a 1 '') 2 + ··· + (a 1 '-a 1'') 2} 1/2 ··· ( 4)

Is defined as The Euclidean distance shown in the equation (4) can be used as an index of similarity between a plurality of independent component analysis results. In this embodiment, as will be described in detail later, the Euclidean distance is used. Judgment of similarity is made.

  Next, a route detection operation of the passage route detection apparatus according to this exemplary embodiment will be described. FIG. 2 is a flowchart for explaining the operation of the route specifying unit 6 provided in the passage route detection apparatus 1. In the following description, when a specific packet group is output from the router 2 via the branch 2d, the specific packet group output from the branch 2d is input to the router 2 via any of the branches 2a to 2c. A case where the above is specified will be described as an example.

  First, the path specifying unit 6 selects a branch to be compared from the branches 2a to 2c (step S101), and a packet group (hereinafter referred to as “comparison packet group”) input to the router 2 through the selected branch. And an independent component analysis result regarding the specific packet group output via the branch 2d is acquired (step S102). Specifically, the path identification unit 6 acquires information on the specific packet group and the comparison packet group from the packet observation unit 3 and passes through a plurality of past time zones stored in the storage unit 5 (hereinafter, referred to as “packet group”). Independent component analysis results are acquired by acquiring information related to a “past packet group” and causing the analysis unit 4 to derive independent component analysis results based on the acquired information. Thereafter, the path specifying unit 6 performs a path specifying process based on the comparison of the acquired independent component analysis results, more specifically, a path specifying process based on the comparison of the mixing ratio in the independent component analysis results, and is selected in step S101. It is determined whether or not the branch is used as an input path for the specific packet group to the router 2 (step S103).

  Then, the route specifying unit 6 determines whether route specifying processing has been performed for all of the branches 2a to 2c (step S104). If all the branches have not been completed (step S104, No), the process returns to step S101 again to select the remaining branches, and the processes shown in steps S102 and S103 are repeated. On the other hand, when the route specifying process has been completed for all branches (Yes in step S104), information about the branch specified as the passing route in step S103 is output via the output unit 7 (step S105), and the route specifying is performed. The operation of unit 6 is complete.

  As described above, in step S103, the path specifying unit 6 mixes the packet group (comparison packet group) input via the selected branch and the independent packet analysis result of the specific packet group at each comparison. The ratio is to be compared. Although various types of mixing ratio comparison modes can be used, in this embodiment, as an example, the Euclidean distance between the mixing ratio in the specific packet group and the mixing ratio in the comparison packet group is derived. The similarity of the mixture ratio is determined according to the derived Euclidean distance value. Hereinafter, the route specifying process in step S103 will be described in detail.

FIG. 3 is a subroutine showing the route specifying process in step S103. As shown in FIG. 3, the path identification unit 6 derives a by mixing ratio obtained for the first specific packet group, the Euclidean distance d ₀ between the obtained mixing ratio with respect to Comparative packet group (step S201) . And the path | route specific | specification part 6 acquires the mixing ratio regarding several past packet groups (step S202).

The path specifying unit 6 derives the Euclidean distance between each of the mixing ratios corresponding to the plurality of past packet groups and the mixing ratio corresponding to the specific packet group, and the average value d of the plurality of derived Euclidean distances. _ave and the variance value d _std are derived (step S203). Thereafter, the path specifying unit 6 determines whether or not the Euclidean distance d ₀ between the comparison packet group and the specific packet group is a value outside a predetermined allowable range (step S204). The specific allowable range is, for example, not less than (d _ave −2d _std ) and not more than (d _ave + 2d _std ), and the path specifying unit 6 determines whether the value is outside the allowable range. .

  If the value is outside the allowable range (step S204, Yes), the path specifying unit 6 selects the branch through which the comparison packet group has passed (that is, the branch selected in step S101). (Step S205). On the other hand, when the value is within the allowable range (No in step S204), it is determined that the branch through which the comparison packet group has passed is not a passage route (step S206). Thus, the route specifying process subroutine is completed, and the processes in and after step S104 are performed.

  Next, advantages of the passage detection device according to the present embodiment will be described. First, the passage detection apparatus according to the present embodiment specifies a passage based on the result of independent component analysis. For this reason, when the specific packet group is input to the router 2 via a plurality of branches, the passage pattern of the specific packet group does not match the passage pattern of the input packet group that has passed through each branch. However, it is possible to specify the passage route with high accuracy.

  It is assumed that the specific packet group that is the target of route detection usually has a certain regularity. Therefore, by appropriately defining the independent components corresponding to the regularity of the specific packet group and performing independent component analysis on the specific packet group and the comparison packet group based on such definition, the presence or absence of the identity of the packet group is determined. It is possible to determine. Since this identity is established irrespective of the passage pattern of the packet group, the passage route detection apparatus according to the present embodiment allows the packet group output from the router 2 to be transmitted to the router 2. Even when input is made via a plurality of branches and the passing patterns are different from each other, highly accurate route detection can be performed.

  Such an advantage becomes particularly remarkable when a packet group used for the DDoS attack is selected as the specific packet group. In general, it is known that a DDoS attack pattern is constituted by a linear sum of a plurality of attack patterns. For this reason, it is possible to obtain an independent component analysis result having independent components corresponding to each of a plurality of attack patterns in a DDoS attack, and by comparing the mixing ratio corresponding to each independent component, the identity of the packet group can be obtained. The discrimination can be performed easily and accurately. Therefore, the passage detection device according to the present embodiment has an advantage that it can perform route detection with particularly high accuracy when the packet group used for the DDoS attack is set as the target of route detection as the specific packet group. It will have.

  In addition, the passage detection device according to the present embodiment has an advantage that it is possible to perform route detection corresponding to the difference in the characteristics of the passage packets in each of the branches 2a to 2d provided in the router 2. In general, a group of packets passing through the branches 2a to 2d provided in the router 2 usually has different characteristics depending on differences in connected servers and the like. On the other hand, when the passage of a specific packet group is specified using a certain criterion, for example, a packet in which an independent component result similar to the specific packet group is obtained compared with other branches in a steady state. There is a risk that a branch through which a group passes is always detected as a passage route.

  On the other hand, in the present embodiment, as described in step S204, an allowable range determined for each selected branch is used as a determination criterion used for specifying a passage route. Therefore, it is possible to set a determination criterion according to the characteristics of the passing packet group in each of the branches 2a to 2d provided in the router 2, and there is an advantage that more accurate path detection is possible.

Furthermore, the passage detection apparatus according to the present embodiment sets the allowable range used in step S204 to be (d _ave −2d _std ) or more and (d _ave + 2d _std ) or less. By using such an allowable range, it is possible to perform an accurate determination in consideration of the degree of deviation from the steady state when specifying the passage route.

  FIG. 4 is a graph showing a distribution state of the Euclidean distance between the mixing ratio derived from the packet group that has passed in the past in the selected branch and the mixing ratio derived from the specific packet group. In FIG. 4, the horizontal axis indicates the Euclidean distance, and the vertical axis indicates the appearance frequency. In the present embodiment, an allowable range is determined based on an average value and a variance value of a plurality of Euclidean distance values related to past packet groups indicating such a distribution state. Specifically, the allowable range is indicated by hatching in FIG. The area is defined as an allowable range.

As is clear from the hatched area shown in FIG. 4, the above-described allowable range includes most of the appearance frequencies of packet groups corresponding to the past steady state. Therefore, by specifying only the branch through which the comparison packet group corresponding to the Euclidean distance d ₀ having a value outside the shaded area has passed as the passage route of the specific packet group, the branch in which the packet passage mode is in a steady state is erroneously determined. Therefore, it is possible to avoid specifying as a passage route, and there is an advantage that route detection with high accuracy is possible.

  Next, the detection accuracy regarding the route detection using the passage detection device according to the present embodiment will be described. FIG. 5 and FIG. 6 are graphs showing detection accuracy when a simulation is performed using the passage detection apparatus according to the present embodiment. In addition, as a condition of simulation, a packet group used for a DDoS attack is used as a specific packet group, and the size of the specific packet group has about 10 times the number of packets in the steady state packet group. Is used. Moreover, the specific value of the detection accuracy shown in FIG. 5 and FIG. 6 uses the average value of the values obtained by the simulation repeated about 10 times under the same conditions for the sake of accuracy.

  The graph shown in FIG. 5 shows the detection accuracy when the number of branches provided in the router 2 is changed under the condition that a specific packet group is input through a single branch in the above-described simulation. is there. In FIG. 5, the horizontal axis indicates the number of branches of the router 2, and the vertical axis indicates the detection accuracy, that is, the probability that a correct branch is selected as the passage route of the specific packet group.

  As shown in the graph of FIG. 5, when the passage detection device according to the present embodiment is used, high detection accuracy is maintained despite the change in the number of branches provided in the router 2. Specifically, although there is a slight fluctuation, the detection accuracy value is maintained at a value of almost 90%, and even when the number of branches is increased, substantially the same detection accuracy can be maintained. It is shown.

  Further, the graph shown in FIG. 6 shows the detection accuracy when the number of branches used for inputting the specific packet group to the router 2 (that is, the number of branches to be specified in the route detection) is changed in the simulation described above. Is shown. In FIG. 6, the horizontal axis indicates the number of branches used for inputting a specific packet group, and the vertical axis indicates the detection accuracy.

  As shown in FIG. 6, the detection accuracy does not decrease with an increase in the number of branches used for inputting a specific packet group, and a high detection accuracy of approximately 95% is maintained. On the other hand, when a similar simulation is performed using a conventional passage detection device that performs route identification based on packet passage patterns, detection is performed according to an increase in the number of branches used to input a specific packet group. It has been clarified that the accuracy gradually decreases, and the detection accuracy is reduced to about 80% when the number of branches is 10. For this reason, the passage detection device according to the present exemplary embodiment has a case where a packet group output from a plurality of servers or the like constitutes a specific packet group, such as a DDoS attack, as compared with the conventional one. Even so, it becomes clear from the simulation results that highly accurate path detection is possible.

  Although the present invention has been described above by using the embodiment, it is needless to say that the present invention is not limited to the above-described embodiment, and those skilled in the art will recognize various examples. It is possible to conceive variations and the like. For example, information other than information related to the temporal change in the number of passing packets may be used as the information on the packet group to be subjected to independent component analysis.

  Moreover, although the passage route detection apparatus 1 according to the embodiment may be realized by a hardware structure, a necessary function may be realized by a program that can be executed on a computer such as a personal computer. . Since a general personal computer includes an arithmetic mechanism such as a CPU and a storage unit such as a hard disk, the passage detection apparatus 1 may be realized by using a program describing necessary processing. The passage path detection device 1 may be built in the router 2.

  In step S203, the route specifying unit 6 derives the average value and the variance value of the Euclidean distance between the mixture ratio of the past packet group and the mixture ratio of the specific packet group. It is good also as a structure memorize | stored in the part 5, and as a simpler structure, instead of deriving an average value based on an actual measurement value, a predetermined numerical value corresponding to the average value and the variance value is set in advance. It is also good.

It is a schematic diagram which shows the structure of the passage detection apparatus concerning embodiment. It is a flowchart for demonstrating operation | movement of the path | route specific | specification part with which a passage route detection apparatus is equipped. Of the operations of the route specifying unit, it is a subroutine shown for route specifying processing. It is a graph which shows typically about the permissible range used as a judgment standard of route specification. It is a graph which shows the effect of the passage detection device concerning an embodiment. It is a graph which shows the effect of the passage detection device concerning an embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Passing path detection apparatus 2 Router 2a-2d Branch 3 Packet observation part 4 Analysis part 5 Memory | storage part 6 Path | route identification part 7 Output part

Claims (9)

A plurality of branches arranged on the network and connected to other components on the network, and a path for passing a specific packet group in a branching means for inputting and outputting packets via the plurality of branches A passage detection device for detecting,
A specific packet group output from the branch means via a predetermined branch, a comparison packet group input to the branch means via a branch selected from branches other than the predetermined branch, and a selected branch Comparison between the independent component analysis result of the specific packet group and the independent component analysis result of the comparison packet group, with the independent component extracted from the observation result of the past packet group input to the branch means in the past as a constituent element And a route specifying means for specifying one or more branches used for the input of the specific packet group.   The route specifying means includes a mixing ratio in an independent component analysis result of the specific packet group output via the predetermined branch and an independent component of the packet group input via each of the branches other than the predetermined branch. 2. The passage detection apparatus according to claim 1, wherein one or more branches used for input of the specific packet group are specified based on similarity between the mixture ratios in the analysis result.   The path specifying means includes a branch through which a comparison packet group corresponding to a mixing ratio in which a Euclidean distance between the specific packet group and a mixing ratio of the specific packet group is a value outside a predetermined allowable range set for each branch to be compared is passed. The path detection device according to claim 1, wherein the branch path is specified as a branch used for inputting the specific packet group.   The allowable range is a value that is twice the variance value of a plurality of Euclidean distances derived between the mixing ratio of the specific packet group and the independent component analysis result of the past packet group, and an average of the Euclidean distance 4. The value according to claim 3, wherein the value is equal to or greater than an addition value of the value and is equal to or less than a difference value between an average value of the Euclidean distance and a value twice as large as a variance value of the Euclidean distance. Passage path detection device. A packet observation means for observing the comparison packet group and the specific packet group that are input to the branch means via the branch to be compared;
Analyzing means for analyzing independent components of observation results regarding the comparison packet group, the past packet group, and the specific packet group;
Storage means for storing observation results of the past packet group observed prior to route identification;
The passage detection apparatus according to claim 1, further comprising: A plurality of branches arranged on the network and connected to other components on the network, and a path for passing a specific packet group in a branching means for inputting and outputting packets via the plurality of branches A method for detecting a passage route to detect,
A specific packet group output from the branch means via a predetermined branch, a comparison packet group input to the branch means via a branch selected from branches other than the predetermined branch, and a selected branch Comparison between the independent component analysis result of the specific packet group and the independent component analysis result of the comparison packet group, with the independent component extracted from the observation result of the past packet group input to the branch means in the past as a constituent element And a route specifying step of specifying one or more branches used for input of the specific packet group.   In the path specifying step, the branch through which the comparison packet group corresponding to the mixing ratio in which the Euclidean distance between the specific packet group and the mixing ratio is a value outside a predetermined allowable range set for each branch to be compared has passed. The path detection method according to claim 6, wherein the branch is specified as a branch used to input the specific packet group.   The allowable range is twice the variance value of a plurality of Euclidean distances derived between the mixing ratio of the specific packet group and the mixing ratio of the independent component analysis result regarding the packet group that has passed through the comparison target in the past. A value equal to or greater than an addition value of the value and the average value of the Euclidean distance, and a value equal to or less than a difference value between the average value of the Euclidean distance and a value twice the variance value of the Euclidean distance The passing route detection method according to claim 7.   A passage detection program for causing a computer to execute the method according to claim 7 or 8.

Images