정보 유출 탐지를 위한 머신 러닝 기반 내부자 행위 분석 연구
A Study on the Insider Behavior Analysis Using Machine Learning for Detecting Information Leakage
2
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
In this paper, we design and implement PADIL(Prediction And Detection of Information Leakage) system that predicts and detect information leakage behavior of insider by analyzing network traffic and applying a variety of machine learning methods. we defined the five–level information leakage model(Reconnaissance, Scanning, Access and Escalation, Exfiltration, Obfuscation) by referring to the cyber kill-chain model. In order to perform the machine learning for detecting information leakage, PADIL system extracts various features by analyzing the network traffic and extracts the behavioral features by comparing it with the personal profile information and extracts information leakage level features. We tested various machine learning methods and as a result, the DecisionTree algorithm showed excellent performance in information leakage detection and we showed that performance can be further improved by fine feature selection.
Abstract
In this paper, we design and implement PADIL(Prediction And Detection of Information Leakage) system that predicts and detect information leakage behavior of insider by analyzing network traffic and applying a variety of machine learning methods. we defined the five–level information leakage model(Reconnaissance, Scanning, Access and Escalation, Exfiltration, Obfuscation) by referring to the cyber kill-chain model. In order to perform the machine learning for detecting information leakage, PADIL system extracts various features by analyzing the network traffic and extracts the behavioral features by comparing it with the personal profile information and extracts information leakage level features. We tested various machine learning methods and as a result, the DecisionTree algorithm showed excellent performance in information leakage detection and we showed that performance can be further improved by fine feature selection.
참고문헌 (10)
- Richard C. Brackney, "Understanding the Insider Threat" (2005), RAND
- Marcus A. Maloof, "ELICT: A System for Detecting Insiders Who Violate Need-toknow", pp.146~166 (2007), RAID
- Ted E. Senator, "Detecting Insider Threats in a Real Corporate Database of Computer Usage Activity", ACM SIGKDD, pp.1393~1401 (2013)
- William T. Young, "Use of Domain Knowledge to Detect Insider Threats in Computer Activities", IEEE Security and Privacy Workshops, pp.60~67 (2013)
- 김태현, "SDR 시스템에서 GPU를 사용한 Lattice Reduction-aided 검출기 구현", (사)디지털산업정보학회 논문지, 7(3), pp.55~61 (2011), (사)디지털산업정보학회
- 고장혁, "국방정보시스템 성능향상을 위한 효율적인 GPU적용방안 연구", (사)디지털산업정보학회 논문지, 11(1), pp.27~35 (2015), (사)디지털산업정보학회[DOI]
- 고장혁, "네트워크 트래픽 분석을 통한행위기반 분석기술 연구", 한국군사과학기술학회 종합학술대회, pp.1291~1292 (2016)
- Richard Bejtlich, "Practice of Network Security Monitoring", ~ (2013)
- Nutan Farah Haq, "Application of Machine Learning Approaches in Intrusion Detection System: A Survey", International Journal of Advanced Research in Artificial Intelligence, 4(3), pp.9~18 (2015)
- Jeffrey Cleveland, "Scalable Machine Learning Framework for Behavior-Based Access Control", Resilent Control Systems (ISRCS), 2013 6th International Symposium, pp.181~185 (2013)