네트워크 트래픽 수집 및 복원을 통한 내부자 행위 분석 프레임워크 연구
A Study on the Insider Behavior Analysis Framework for Detecting Information Leakage Using Network Traffic Collection and Restoration
2
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
In this paper, we developed a framework to detect and predict insider information leakage by collecting and restoring network traffic. For automated behavior analysis, many meta information and behavior information obtained using network traffic collection are used as machine learning features. By these features, we created and learned behavior model, network model and protocol-specific models. In addition, the ensemble model was developed by digitizing and summing the results of various models. We developed a function to present information leakage candidates and view meta information and behavior information from various perspectives using the visual analysis. This supports to rule-based threat detection and machine learning based threat detection. In the future, we plan to make an ensemble model that applies a regression model to the results of the models, and plan to develop a model with deep learning technology.
Abstract
In this paper, we developed a framework to detect and predict insider information leakage by collecting and restoring network traffic. For automated behavior analysis, many meta information and behavior information obtained using network traffic collection are used as machine learning features. By these features, we created and learned behavior model, network model and protocol-specific models. In addition, the ensemble model was developed by digitizing and summing the results of various models. We developed a function to present information leakage candidates and view meta information and behavior information from various perspectives using the visual analysis. This supports to rule-based threat detection and machine learning based threat detection. In the future, we plan to make an ensemble model that applies a regression model to the results of the models, and plan to develop a model with deep learning technology.
참고문헌 (11)
- Richard C. Brackney, "Understanding the Insider Threat" (2005), RAND
- Marcus A. Maloof, "ELICT: A System for Detecting Insiders Who Violate need-to-know", pp.146~166 (2007), RAID
- Ted E. Senator, "Detecting Insider Threats in a Real Corporate Database of Computer Usage Activity", ACM SIGKDD, pp.1393~1401 (2013)
- 고장혁, "GPU를 이용한 정보시스템 성능향상에 관한 연구", 한국군사과학기술학회 종합학술대회, pp.391~392 (2013)
- 고장혁, "국방정보시스템 성능향상을 위한 효율적인 GPU적용방안 연구", (사)디지털산업정보학회 논문지, 11(1), pp.27~35 (2015), (사)디지털산업정보학회[DOI]
- Kalyan Veeramachaneni, "AI2: Training a Big Data Machine to Defend", IEEE BigDataSecurity-HPSC-IDS, pp.49~54 (2016)
- 고장혁, "정보 유출 탐지를 위한 머신 러닝 기반 내부자 행위 분석 연구", (사)디지털산업정보학회 논문지, 13(2), pp.1~11 (2017), (사)디지털산업정보학회[DOI]
- Richard Bejtlich, "Practice of Network Security Monitoring", ~ (2013)
- 고장혁, "Indicator-based Behavior Ontology for Detecting Insider Threats in Network Systems", KSII Transactions on Internet and Information Systems, 11(10), pp.5062~5079 (2017), 한국인터넷정보학회[DOI]
- Nutan Farah Haq, "Application of Machine Learning Approaches in Intrusion Detection System: A Survey", International Journal of Advanced Research in Artificial Intelligence, 4(3), pp.9~18 (2015)
- Jeffrey Cleveland, "Scalable Machine Learning Framework for Behavior-Based Access Control", Resilient Control Systems(ISRCS), 2013 6th International Symposium, pp.181~185 (2013)