침해사고 분석을 위한 LSTM-CRF 기반 IOC 추출 연구
A Study on IOC Extraction Based on LSTM-CRF for Intrusion Incident Analysis
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
현대 사회에서 사이버 공격은 심각한 사회 문제로 대두되고 있다. 체계적이고 효과적인 방어 메커니즘을 위해 IOC(Indicator of Compromise)를 추출하여 사용한다. 그러나 기존의 IOC 추출은 정규 표현식에 의존하며, 복잡한 패턴의 작성이나 유지보수가 어렵다. 해당 연구에서는 Bi-LSTM과 CRF를 결합한 딥러닝 모델을 활용하여 BIO-tagging을 통해 IOC를 추출하였다. 이 모델은 97%의 높은 정확도로 이전 방식보다 효과적인 IOC 추출 방법임을 증명하였다. 이러한 IOC를 통해 차후 Graph로 표현하여 GNN(Graph Neural Networks)에 적용하고, 향후 기대 방향을 소개한다.
Abstract
In contemporary society, cyberattacks have emerged as a grave societal concern. To establish a systematic and effective defense mechanism, Indicator of Compromise (IOC) is employed. However, traditional IOC extraction methods heavily rely on regular expressions, making the creation and maintenance of complex patterns challenging. In this study, we employed a deep learning model that combines Bi-LSTM and CRF for IOC extraction, demonstrating its effectiveness with a remarkable 97% accuracy compared to previous methods. This research introduces the application of these IOCs to construct graphs for utilization in Graph Neural Networks (GNN) and outlines future prospects.
참고문헌 (11)
- Graves, A., "Long short-term memory, Supervised sequence labelling with recurrent neural networks", 37~45 (2012)
- Gers, F. A., "Learning to forget: Continual prediction with LSTM", Neural computation, 12(10), pp.2451~2471 (2000)
- Hochreiter, S., "Long short-term memory", Neural computation, 9(8), pp.1735~1780 (1997)
- Lafferty, J., "Conditional random fields: Probabilistic models for segmenting and labeling sequence data", ~ (2001)
- Niepert, M, "Learning convolutional neural networks for graphs", International conference on machine learning, pp.2014~2023 (2016), PMLR
- Ramshaw, L. A., "Text chunking using transformation-based learning", Natural language processing using very large corpora, pp.157~176 (1999), Springer Netherlands
- Scarselli, F., "The graph neural network model", IEEE transactions on neural networks, 20(1), pp.61~80 (2008)
- Schuster, M., "Bidirectional recurrent neural networks", IEEE transactions on Signal Processing, 45(11), pp.2673~2681 (1997)
- Sutton, C., "An introduction to conditional random fields", Foundations and Trends® in Machine Learning, 4(4), pp.267~373 (2012)
- Wu, Z., "A comprehensive survey on graph neural networks", IEEE transactions on neural networks and learning systems, 32(1), pp.4~24 (2020)
- Zhao, J., "Cyber threat intelligence modeling based on heterogeneous graph convolutional network", 23rd international symposium on research in attacks, intrusions and defenses (RAID 2020), pp.241~256 (2020)