뉴럴네트워크 기반에 악성 URL 탐지방법 설계
Design of detection method for malicious URL based on Deep Neural Network
2
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
사물인터넷 등을 통하여 각종 기기들이 인터넷으로 연결되어 있고 이로 인하여 인터넷을 이용한 공격이 발생하고 있다. 그러한 공격 중 악성 URL를 이용하여 사용자에게 잘못된 피싱 사이트로 접속하게 하거나 악성 바이러스를 유포하는 공격들이 있다. 이러한 악성 URL 공격을 탐지하는 방법은 중요한 보안 이슈 중에 하나이다. 최근 딥러닝 기술 중 뉴럴네트워크는 이미지 인식, 음성 인식, 패턴 인식 등에 좋은 성능을 보여주고 있고 이러한 뉴럴네트워크를 이용하여 악성 URL 탐지하는 분야가 연구되고 있다. 본 논문에서는 뉴럴네트워크를 이용한 악성 URL 탐지 성능을 각 파라미터 및 구조에 따라서 성능을 분석하였다. 뉴럴네트워크의 활성화함수, 학습률, 뉴럴네트워크 모델 등 다양한 요소들에 따른 악성 URL 탐지 성능에 어떠한 영향을 미치는 지 분석하였다. 실험 데이터는 Alexa top 1 million과 Whois에서 크롤링하여 데이터를 구축하였고 머신러닝 라이브러리는 텐서플로우를 사용하였다. 실험결과로 층의 개수가 4개이고 학습률이 0.005이고 각 층마다 노드의 개수가 100개 일 때, 97.8%의 accuracy와 92.94%의 f1 score를 갖는 것을 볼 수 있었다.
Abstract
Various devices are connected to the Internet, and attacks using the Internet are occurring. Among such attacks, there are attacks that use malicious URLs to make users access to wrong phishing sites or distribute malicious viruses. Therefore, how to detect such malicious URL attacks is one of the important security issues. Among recent deep learning technologies, neural networks are showing good performance in image recognition, speech recognition, and pattern recognition. This neural network can be applied to research that analyzes and detects patterns of malicious URL characteristics. In this paper, performance analysis according to various parameters was performed on a method of detecting malicious URLs using neural networks. In this paper, malicious URL detection performance was analyzed while changing the activation function, learning rate, and neural network structure. The experimental data was crawled by Alexa top 1 million and Whois to build the data, and the machine learning library used TensorFlow. As a result of the experiment, when the number of layers is 4, the learning rate is 0.005, and the number of nodes in each layer is 100, the accuracy of 97.8% and the f1 score of 92.94% are obtained.
참고문헌 (29)
- P. Zhao, "Proceedings of the 19th ACM SIGKDD international conference on Knowledge discovery and data mining", Proceedings of the 19th ACM SIGKDD international conference on Knowledge discovery and data mining, pp.919~927 (2013)
- F. Yu, "Malicious url detection algorithm based on bm pattern matching", International Journal of Security and Its Applications, 9(9), pp.33~44 (2015)
- J. Klensin, "Role of the domain name system (dns). Internet Request for Comments:RFC, 3467", ~ (2003)
- M. Anthony, "Neural network learning: Theoretical foundations" (2009), cambridge university press
- S. Yadav, "Detecting algorithmically generated domain-flux attacks with DNS traffic analysis", IEEE, 2012, pp.20(5), 1663~1677
- L. Dolberg, "Efficient multidimensional aggregation for large scale monitoring", 26th Large Installation System Administration Conference ({LISA} 12), pp.163~180 (2012)
- Y. Shi, "Malicious domain name detection based on extreme machine learning", Neural Processing Letters, 48(3), pp.1347~1357 (2018)[DOI]
- X. Sun, "Hindom: A robust malicious domain detection system based on heterogeneous information network with transductive classification", 22nd International Symposium on Research in Attacks, Intrusions and Defenses ({RAID} 2019), pp.399~412 (2019)
- L. Bilge, "Exposure: A passive dns analysis service to detect and report malicious domains", ACM Transactions on Information and System Security (TISSEC), 16(4), pp.1~28 (2014)[DOI]
- B. Rahbarinia, "Efficient and accurate behavior-based tracking of malware-control domains in large ISP networks", ACM Transactions on Privacy and Security(TOPS), 19(2), pp.1~31 (2016)[DOI]
- J. Yuan, "Malicious URL Detection Based on a Parallel Neural Joint Model", IEEE Access, 9, pp.9464~9472 (2021)[DOI]
- R. Patgiri, "deepBF:Malicious URL detection using Learned Bloom Filter and Evolutionary Deep Learning", arXiv preprint arXiv:2103.12544, ~ (2021)
- 김보민, "사용자 경험을 고려한 규칙기반 악성 URL 탐지 라이브러리 개발", 정보보호학회논문지, 30(3), pp.481~491 (2020), 한국정보보호학회[DOI]
- D. F. Specht, "Probabilistic neural networks", Neural networks, 3(1), pp.109~118 (1990)
- D. M. Kline, "Revisiting squared-error and cross-entropy functions for training neural network classifiers", Neural Computing & Applications, 14(4), pp.310~318 (2005)[DOI]
- S. Du, "Gradient descent finds global minima of deep neural networks", International Conference on Machine Learning, pp.1675~1685 (2019), PMLR
- M. Abadi, "Tensorflow: A system for large-scale machine learning", 12th {USENIX}symposium on operating systems design and implementation ({OSDI} 16), pp.265~283 (2016)
- N. Hason, "Robust Malicious Domain Detection", International Symposium on Cyber Security Cryptography and Machine Learning, pp.45~61 (2020), Springer
- D. P. Kingma, "Adam: A method for stochastic optimization", arXiv preprint arXiv:1412.6980, ~ (2014)
- L. Bottou, "Large-scale machine learning with stochastic gradient descent", Proceedings of COMPSTAT'2010, pp.177~186 (2010), Physica-Verlag HD
- A. Creswell, "Generative adversarial networks : An overview", IEEE Signal Processing Magazine, 35(1), pp.53~65 (2018)[DOI]
- E. Kodirov, "Semantic autoencoder for zero-shot learning", Proceedings of the IEEE conference on computer vision and pattern recognition, pp.3174~3183 (2017)
- H. Kwon, "Restricted evasion attack : Generation of restricted-area adversarial example", IEEE Access, 7, pp.60908~60919 (2019)[DOI]
- H. Kwon, "Random untargeted adversarial example on deep neural network", Symmetry, 10(12), pp.738~ (2018)[DOI]
- H. Kwon, "POSTER: Detecting audio adversarial example through audio modification", Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp.2521~2523 (2019)
- H. Kwon, "Advanced ensemble adversarial example on unknown deep neural network classifiers", IEICE TRANSACTIONS on Information and Systems, 101(10), pp.2485~2500 (2018)[DOI]
- H. Kwon, "Acoustic-decoy : Detection of adversarial examples through audio modification on speech recognition system", Neurocomputing, 417, pp.357~370 (2020)[DOI]