Method and device for ascertaining anomalies in a communications network

Patent metadata

Field	Value
Publication number	US-11057279-B2
Application number	US-201816633635-A
Country	US
Kind code	B2
Filing date	Jul 23, 2018
Priority date	Jul 31, 2017
Publication date	Jul 6, 2021
Grant date	Jul 6, 2021

Abstract

A method for ascertaining an anomaly in a communications network. In a first phase, a discriminator is trained to recognize whether messages transmitted over the communications network are indicative of the anomaly existing; during training, normal data and artificial data produced by a generator are fed to the discriminator, and, in response, the discriminator is trained to recognize that normal data being fed thereto connotes no anomaly, and artificial data being fed thereto connotes an anomaly. In a second phase, the generator is trained to produce artificial data which, when fed to the discriminator, are classified with the greatest possible probability as normal data. In a third phase, contents of messages received over the communications network are fed as an input variable to the discriminator; an output variable is ascertained, and the decision as to whether the anomaly exists or not being made as a function of the output variable.

First claim

What is claimed is:

1. A method for ascertaining whether there is an anomaly in a communications network, comprising the following steps:
in a first phase, training a discriminator to recognize whether messages transmitted over the communications network are indicative of an anomaly existing, wherein during the training of the discriminator, normal data and artificial data produced by a generator are fed as an input variable to the discriminator, and the discriminator being trained to recognize that the normal data being fed to the discriminator connotes no anomaly, and the artificial data being fed to the discriminator connotes an anomaly;
in a second phase, training the generator to produce the artificial data in such a way that, when the artificial data are fed to the discriminator, the discriminator classifies the artificial data as likely to be normal data; and
in a third phase, feeding contents of messages received over the communications network as an input variable to the discriminator, an output variable being ascertained as a function of the input variable and a decision as to whether the anomaly exists or not being made as a function of the output variable.

2. The method as recited in claim 1 , wherein the communication network is a communication network of a motor vehicle.

3. The method as recited in claim 1 , wherein the training of the discriminator in the first phase and the training of the generator in the second phase is alternately repeated several times prior to implementation of the third phase.

4. The method as recited in claim 1 , wherein, in the second phase, an overall system composed of the generator and the discriminator are being trained and exclusively parameters which characterize the generator are adapted.

5. The method as recited in claim 1 , wherein random variables are fed to the generator, and the generator produces the artificial data as a function of the fed random variables.

6. The method as recited in claim 1 , wherein, in the first phase, the discriminator is trained using mixed batches that contain both the normal data and the artificial data.

7. The method as recited in claim 1 , wherein, in the first phase, the discriminator is alternately trained using batches that exclusively contain the normal data or exclusively contain the artificial data.

8. The method as recited in claim 7 , wherein, at a beginning of a first pass through the first phase, the discriminator is initially trained using at least one batch, which exclusively contains the normal data.

9. The method as recited in claim 1 , wherein the discriminator and/or the generator is a machine learning system.

10. The method as recited in claim 1 , wherein the discriminator and/or the generator is a deep neural network.

11. A non-transitory machine-readable storage medium on which is stored a computer program for ascertaining whether there is an anomaly in a communications network, the computer program, when executed by a computer, causing the computer to perform the following steps:
in a first phase, training a discriminator to recognize whether messages transmitted over the communications network are indicative of an anomaly existing, wherein during the training of the discriminator, normal data and artificial data produced by a generator are fed as an input variable to the discriminator, and the discriminator being trained to recognize that the normal data being fed to the discriminator connotes no anomaly, and the artificial data being fed to the discriminator connotes an anomaly;
in a second phase, training the generator to produce the artificial data in such a way that, when the artificial data are fed to the discriminator, the discriminator classifies the artificial data as likely to be normal data; and
in a third phase, feeding contents of messages received over the communications network as an input variable to the discriminator, an output variable being ascertained as a function of the input variable and a decision as to whether the anomaly exists or not being made as a function of the output variable.

Assignees

• Bosch Gmbh Robert

Inventors

• Junginger Andrej
• Ulmer Holger
• Hanselmann Markus
• Strauss Thilo

Classifications

• H04L67/12 Primary

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• H04L41/16 Primary

  using machine learning or artificial intelligence · CPC title

• G06N3/045

  Combinations of networks · CPC title

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• G06F18/214

  Generating training patterns; Bootstrap methods, e.g. bagging or boosting · CPC title