BGP 데이터의 기계학습 분석을 통한 적대세력 사이버 활동탐지
Detect cyber activity of hostile forces through machine learning analysis of BGP datas
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
전 세계적으로 사이버 공격은 계속 증가해 왔으며, 그 영향으로 국가 기관에막대한 피해가 발생하고 있다. 이에 따라, 美, 국방부는 사이버 공간을 전장으로규정하며, 민간과 군대가 연계하여 사이버 공격을 방어하기 위한 연구에천문학적인 투자를 하고 있다. 적대세력의 사이버 공격의 피해를 최소화하기위해서 그들의 사이버 활동을 탐지하여 이상징후로 분류할 시스템이 필요하다. 본 논문에서는 적대세력의 사이버 공격을 탐지하고 대응하기 위해, 사이버활동을 패턴을 오토인코더에 학습시켜 탐지하는 시스템을 제안한다. 본연구에서는 적대세력의 사이버 활동 정보가 저장된 BGP(Border Gateway Protocol) 데이터를 오토인코더에 학습시켰다. 그 결과로 적대세력의 사이버활동탐지 정확도는 93.4%, F1-점수(score)는 91%의 성능을 보였다. 이를 통해사이버 공격에 대한 탐지 및 대응에 도움이 될 것이라 기대된다.
Abstract
Cyber attacks have continued to increase worldwide, resulting in enormous damage to state institutions. Accordingly, the U.S. Department of Defense defines cyberspace as a battlefield, and is investing astronomically in research to defend against cyberattacks in collaboration with the civilian and military forces. Despite the above efforts, the number of victims of cyber attacks is continuously increasing, and it is not easy to respond to attacks. As above, in order to minimize damage from cyber attacks by hostile forces, a system that detects their cyber activities and classifies them as anomalies is needed. In this paper, in order to detect and respond to cyber attacks by hostile forces, we propose a system that detects cyber activity patterns by learning autoencoders. In this study, the autoencoder was trained with BGP data, in which cyber activity information of hostile forces was stored. As a result, the ability to detect cyber activities of hostile forces showed 93% performance. This is expected to help detect and respond to cyber attacks.
참고문헌 (24)
- Bhavna Arora, "Exploring and analyzing Internet crimes and their behaviours", Perspectives in Science, 8(7), pp.540~542 (2016)
- "Check point: Third quarter of 2022 reveals increase in cyberattacks and unexpected developments in global trends"[URL]
- Quadrennial defense review report, "S. dageet", Department of Defense, ~ (2010)
- "Generic threats to routing protocols" (2006)[URL]
- "Autonomous system (AS) reservation for private use" (2013)[URL]
- 윤재필, "Research on Cyber IPB Visualization Method based on BGP Archive Data for Cyber Situation Awareness", KSII Transactions on Internet and Information Systems, 15(2), pp.749~766 (2021), 한국인터넷정보학회
- M. Cheng, "MS-LSTM: A multi-scale LSTM model for BGP anomaly detection", IEEE 24th International Conference on Network Protocols (ICNP) (2016)
- Dai, Xianbo, "Application of machine learning in BGP anomaly detection", Journal of Physics: Conference Series, 1176(3) (2019), IOP Publishing
- T. Luo, "Distributed anomaly detection using autoencoder neural networks in wsn for iot", IEEE International Conference on Communications (ICC), pp.1~6 (2018)
- Chen, Zhaomin, "Autoencoder-based network anomaly detection", 2018 Wireless telecommunications symposium (WTS) (2018), IEEE
- Zhou, Chong, "Anomaly detection with robust deep autoencoders", Proceedings of the 23rd ACM SIGKDD international conference on knowledge discovery and data mining (2017)
- Wheelus, Charles, "Tackling class imbalance in cyber security datasets", 2018 IEEE International Conference on Information Reuse and Integration (IRI) (2018), IEEE
- Al-Abassi, Abdulrahman, "An ensemble deep learning-based cyber-attack detecti on in industrial control system", IEEE Access, 8, pp.83965~83973 (2020)
- Bagui, Sikha, "Resampling imbalanced data for network intrusion detection datasets", Journal of Big Data, 8(1), pp.1~41 (2021)
- W. Yap, "An application of oversampling, undersampling, bagging and boosting in handling imbalanced datasets", Proceedings of the first international conference on advanced data and information engineering (DaEng-2013) (2014), Springer
- Alberto Fernandez, "SMOTE for Learning from Imbalanced Data: Progress and Challenges, Marking the 15-year Anniversary", Journal of Artificial Intelligence Research, 61, pp.863~905 (2018), AI Access Foundation[DOI]
- Kaur, Prabhjot, "ICT Based Innovations", pp.23~30 (2018), Springer
- Chawla, Nitesh V., "SMOTE: synthetic minority over-sampling technique", Journal of artificial intelligence research, 16, pp.321~357 (2002)
- Mansourifar, Hadi, "Deep synthetic minority over-sampling technique", arXiv preprint arXiv:2003.09788, ~ (2020)
- Tian, Ye, "Topology mapping and geolocating for China's Internet", IEEE Transactions on Parallel and Distributed Systems, 24(9), pp.1908~1917 (2012)
- Gueye, Bamba, "Investigating the imprecision of IP block-based geolocation", International Conference on Passive and Active Network Measurement (2007), Springer
- Outsourcing Information Technology Services within the Department of Defense: An Analysis of the Navy, "Marine Corps Intranet Project", Ormerod, G. J., 2001
- Nielsen, Jakob, "1994 Design of SunWeb: Sun Microsystems' Intranet", Abgefragt am, 3(1994) (2009)
- Telleen, Steven L., "The difference between internet, intranet, and extranet", Intranet World (1998)