LightGBM을 활용한 패킷 페이로드 분석 기반의 침입탐지시스템
Intrusion Detection System based on Packet Payload Analysis using LightGBM
1
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
기계학습 기반의 침입탐지시스템에 대한 연구는 대부분 메타데이터를 활용한다. 그러나 메타데이터는 패킷을 분석해서 생성되는 정보이기 때문에, 실제 네트워크 환경에서 실시간 침입탐지를보장하기는 어렵다. 이에 본 논문에서는 패킷의 페이로드(payload)를 직접 분석하여 신속하게 네트워크 침입을 탐지할 수 있는 기계학습 기반의 침입탐지시스템을 제안하였다. 제안하는 기법의 성능을 검증하기 위해 UNSW-NB15 데이터세트와 LightGBM 모델을 활용하였다. 먼저 'Payload-Byte' 기법을 활용하여 데이터세트 내의 PCAP 파일에 대한 라벨링을 실시한 후 LightGBM 모델로 학습을 실시하고 탐지성능을 분석하였다. 실험 결과 이진 분류는 정확도 99.33%, F1-score 98.73%를 달성하여 탐지성능이 크게 향상됨을 확인하였다. 그러나 다중 분류는 정확도 85.63%, F1-score 85.68%로 선행연구와 유사한 탐지성능을 보였다.
Abstract
Most studies on machine learning-based intrusion detection systems use metadata. However, since metadata is information generated by analyzing packets, it is difficult to ensure real-time intrusion detection in a real network environment. Therefore, in this paper, we proposed a machine learning-based intrusion detection system that can quickly detect network intrusions by directly analyzing the payload of packets. The UNSW-NB15 Dataset and the LightGBM model were used to verify the detection performance of the proposed technique. We first used the 'Payload-Byte' technique to label PCAP files in the Dataset, then conducted learning with the LightGBM model and analyzed detection performance. Experimental results showed that our approach can achieve a significant improvement in the binary classification with accuracy of 99.33% and F1-score of 98.73%. However, Multi-class classification showed similar detection performance to previous studies with accuracy of 85.63% and F1-score of 85.68%.
참고문헌 (19)
- "Statistics Information"[URL]
- N. Moustafa, "UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set)", 2015 Military Communications and Information Systems Conference (MilCIS), pp.1~6 (2015)
- "UNSW-NB15 Data Set"[URL]
- Nour Moustafa, "The evaluation of Network Anomaly Detection Systems: Statistical analysis of the UNSW-NB15 data set and the comparison with the KDD99 data set", Information Security Journal: A Global Perspective, 25(1-3), pp.18~31 (2016), Informa UK Limited[DOI]
- 정구현, "패킷 페이로드 내 특정 패턴 탐지 알고리즘들의 성능 분석에 관한 연구", 한국정보통신학회논문지, 22(5), pp.794~804 (2018), 한국정보통신학회[DOI]
- K. Wang, "Anomalous Payload-Based Network Intrusion Detection", Recent Advances in Intrusion Detection : 7th International Symposium, pp.203~222 (2004)
- M. V. Mahoney, "Learning nonstationary models of normal network traffic for detecting novel attacks", Proceedings of the eighth ACM SIGKDD international conference on Knowledge discovery and data mining, pp.376~385 (2002)
- Wei Wang, "HAST-IDS: Learning Hierarchical Spatial-Temporal Features Using Deep Neural Networks to Improve Intrusion Detection", IEEE Access, 6, pp.1792~1806 (2018), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- B. A. Pratomo, "Unsupervised Approach for Detecting Low Rate Attacks on Network Traffic with Autoencoder", 2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security), pp.1~8 (2018)
- Hongyu Liu, "CNN and RNN based payload classification methods for attack detection", Knowledge-Based Systems, 163, pp.332~341 (2019), Elsevier BV[DOI]
- 김태원, "패킷 카운팅을 이용한 DoS", DDoS 공격 탐지 알고리즘 및 이를 이용한 시스템, 2010, pp.19(4), 151~159[DOI]
- B. H Lee, "Deep Learning LSTM Model based TCP SYN Flood Detection System", Master, pp.2020
- D. Jing, "SVM Based Network Intrusion Detection for the UNSW-NB15 Dataset", 2019 IEEE 13th International Conference on ASIC (ASICON), pp.1~4 (2019)
- M. H. Kabir, "Network Intrusion Detection Using UNSW-NB15Dataset: Stacking Machine Learning Based Approach", 2022International Conference on Advancement in Electrical and Electronic Engineering (ICAEEE), pp.1~6 (2022)
- Fares Meghdouri, "Analysis of Lightweight Feature Vectors for Attack Detection in Network Traffic", Applied Sciences, 8(11), pp.2196~ (2018), MDPI AG[DOI]
- Y. A. Farrukh, "Payload-Byte: A Tool for Extracting and Labeling Packet Capture Files of Modern Network Intrusion Detection Datasets", pp.58~67 (2022)
- KE, Guolin, "Lightgbm: A highly efficient gradient boosting decision tree", Advances in neural information processing systems 30, 3149~3157 (2017)
- J. Li, "The comparison and verification of some efficient packet capture and processing technologies", IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC, CBDCom, pp.CyberSciTech), 2019
- 남태우, "메타데이터의 의미론적 확장에 관한 연구", 한국문헌정보학회지, 44(4), pp.373~393 (2010), 한국문헌정보학회[DOI]