본문 바로가기
KERD
논문KCI 등재

시그니처 기반 모델과 흐름 기반 모델의 상호 보완을 통한 지능형 침입 탐지 및 방지 시스템

Intelligent Intrusion Detection and Prevention System byComplementing Signature-Based and Flow-Based Models

김수연|나유경|박태준|문성수
한국정보보호학회 (Korea Institute Of Information Security And Cryptology)|2024.12|정보보호학회논문지 (Journal of The Korea Institute of Information Security and Cryptology)|제34권 제6호|pp. 1501-1516|DOI https://doi.org/10.13089/JKIISC.2024.34.6.1501

0

조회

0

다운로드

0

인용

0

참고문헌

키워드

Random ForestAnomaly DetectionNetwork SecurityIDS/IPS
주제분류컴퓨터학

초록

네트워크 사용이 증가함에 따라 사이버 공격의 규모 또한 증가하고 있다. 이와 같은 공격을 완화하기 위해 여러 보안 장비들이 존재하지만, 일반적으로 이 장비들은 정적 규칙에 의존하기 때문에 규칙 외 공격에 대한 대응이 어려운 등 유연성이 부족하다는 한계가 있다. 이러한 문제를 해결하기 위해, 본 논문에서는 시그니처 기반 모델과 흐름 기반 모델의 상호 보완을 통한 지능형 침입 탐지 및 방지 시스템을 제안한다. 이 시스템은 랜덤 포레스트와 TranAD로 구성되어 단일 패킷의 특징을 이용한 분류와 패킷의 흐름을 이용한 이상치 탐지를 이용해 기존의 공격뿐만 아니라 새로운 유형의 공격을 식별할 수 있도록 한다. 또한, 탐지된 결과를 기반으로, 자동으로 패킷 필터링 규칙을 업데이트하여 즉각적으로 공격에 대응할 수 있다. 본 시스템의 프로토타입을 통한 실험 결과, 매우 높은 정확도로 이상행위를 탐지하며, 차세대 보안 솔루션으로서의 가능성을 보여주었다.

Abstract

As network usage has increased, the frequency and sophistication of cyber-attacks through networks have also increased. Although security devices exist to mitigate these attacks, they generally rely on static rules, which limits their flexibility in responding to attacks beyond predefined rules. To address this issue, this paper proposes an intelligent intrusion detection and prevention system by complementing signature-based and flow-based models. Leveraging Random Forest and TranAD, our system analyzes individual packets and their sequential flows to identify both known and unknown attacks. Additionally, the system automatically updates packet filtering rules based on the detection results, allowing for immediate responses to attacks. Experiments with the system prototype demonstrates high accuracy ,showing its potential as a next-generation security solution.

참고문헌 (42)

  1. P. Hruza, "Cyber-attacks and attack protection", WMSCI 2014 : The 18th World Multi-Conference on Systemics, Cybernetics and Informatics, pp.170~174 (2014)
  2. M. Antonakakis, "Understanding the mirai botnet", 26th USENIX security symposium (USENIX Security 17), pp.1093~1110 (2017)
  3. Korea Internet & Security Agency, "Ransomware Trends & Statistics:Third Quarter for 2020", Korea Internet & Security Agency, ~ (2020)
  4. I.F. Kilincer, "Machine learning methods for cyber security intrusion detection : Datasets and comparative study", Computer Networks, 188(7), pp.107840~107840 (2021)
  5. O. Aslan, "A comprehensive review of cyber security vulnerabilities, threats, attacks, and solutions", Electronics, 12(6), pp.1333~1333 (2023)
  6. N. Moustafa, "UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set)", 2015 military communications and information systems conference (MilCIS) (2015)
  7. V. Kumar, "An integrated rule based intrusion detection system: analysis on UNSW-NB15 data set and the real time online dataset", Cluster Computing, 23, pp.1397~1418 (2019)
  8. Aurelien, "Hands-on machine learning with Scikit-Learn, Keras, and TensorFlow" (2019), O'Reilly Media
  9. C.A.U. Hassan, "Comparison of Machine Learning Algorithms in Data classification", 2018 24th International Conference on Automation and Computing(ICAC), pp.1~6 (2018)
  10. P.A.A Resende, "A survey of random forest based methods for intrusion detection systems", ACM Computing Surveys(CSUR), 51(48), pp.1~36 (2018)
  11. G.B. Begashaw, "Review of outlier detection and identifying using robust regression model", International Journal of Systems Science and applied mathematics, 5(1), pp.4~11 (2020)
  12. N. Shone, "A deep learning approach to network intrusion detection", IEEE Transactions on Emerging Topics in Computational Intelligence, 2(1), pp.41~50 (2018)
  13. N. Marir, "Distributed abnormal behavior detection approach based on deep belief network and ensemble SVM using spark", IEEE Access, 6, pp.59657~59671 (2018)
  14. B. Yan, "Effective feature extraction via stacked sparse autoencoder to improve intrusion detection system", IEEE Access, 6, pp.41238~41248 (2018)
  15. X. Zhang, "A multiple-layer representation learning model for network-based attack detection", IEEE Access, 7, pp.91992~92008 (2019)
  16. E. Tufan, "Anomaly-based intrusion detection by machine learning : A case study on probing attacks to an institutional network", IEEE Access, 9, pp.50078~50092 (2021)
  17. M. Bhavsar, "Anomaly-based intrusion detection system for IoT application", Discover Internet of Things, 3(5), pp.5~ (2023)
  18. S. Nayyar, "Recurrent neural network based intrusion detection system", 2020 international conference on communication and signal processing (iccsp), pp.136~140 (2020)
  19. M.A. Khan, "A scalable and hybrid intrusion detection system based on the convolutional-LSTM network", Symmetry, 11(4), pp.583~ (2019)
  20. Z. Long, "A Transformer-based network intrusion detection approach for cloud security", Journal of Cloud Computing, 15(5), pp.5~ (2024)
  21. Z. Zoghi, "UNSWNB15computer security dataset : Analysis through visualization", Security and Privacy, 7(1) (2024)
  22. Moustafa, Nour, "UNSW-NB15 : a comprehensive data set for network intrusion detection systems(UNSW-NB15 network data set)", 2015 military communications and information systems conference (MilCIS) (2015), IEEE
  23. P.P. Mukkamala, "A survey on the different firewall technologies", International Journal of Engineering Applied Sciences and Technology, 5(1), pp.363~365 (2020)
  25. S. Panigrahi, "Effect of normalization techniques on univariate time series forecasting using evolutionary higher order neural network", International Journal of Engineering and Advanced Technology, 3(2), pp.280~285 (2013)
  26. A.C. Muller, "Introduction to machine learning with Python: a guide for data scientists" (2016), O'Reilly Media
  27. Glassner, "Deep learning:a visual approach" (2021), No Starch Press
  29. C. Khammassi, "A GA-LR wrapper approach for feature selection in network intrusion detection", computers & security, 70, pp.255~277 (2017)
  30. S. Meftah, "Network based intrusion detection using the UNSW-NB15 dataset", International Journal of Computing and Digital Systems, 8(5), pp.478~487 (2019)
  31. V. Kumar, "An integrated rule based intrusion detection system : analysis on UNSW-NB15 data set and the real time online dataset", Cluster Computing, 23, pp.1397~1418 (2019)
  32. A. Karami, "An anomaly-based intrusion detection system in presence of benign outliers with visualization capabilities", Expert Systems with Applications, 108, pp.36~60 (2018)
  33. E. Serkani, "Anomaly Detection UsingSVMas Classifier and Decision Tree for Optimizing FeatureVectors", The ISC International Journal of Information Security, 11(2), pp.159~171 (2019)
  34. M. Jouhari, "Efficient Intrusion Detection: Combining X2 Feature Selection with CNN-BiLSTM on the UNSW-NB15 Dataset", International Conference on Wireless Networks and Mobile Communications (WINCOM), 11, pp.1~6 (2024)
  35. S.M. Kasongo, "Performance analysis of intrusion detection systems using a feature selection method on the UNSW-NB15dataset", Journal of Big Data, 7(1), pp.105~ (2020)
  36. M. Nawir, "MULTI-CLASSIFICATION OF UNSW-NB15 DATASET FOR NETWORK ANOMALY DETECTION SYSTEM", Bulletin of Electrical Engineering and Informatics, 8(1), pp.46~51 (2018)
  37. S.M. Kasongo, "A deep learning method with wrapper based feature extraction for wireless intrusion detection system", Computers & Security, 92, pp.101752~ (2020)
  38. A.D. Eunice, "Network anomaly detection technology based on deep learning", 2021 IEEE 3rd International Conference on Frontiers Technology of Information and Computer (ICFTIC), 3, pp.6~9 (2021)
  39. N. Moustafa, "The evaluation of Network Anomaly Detection Systems: Statistical analysis of the UNSW-NB15 data set and the comparison with the KDD99 data set", Information Security Journal: A Global Perspective, 25(1-3), pp.18~31 (2016)
  40. Y. Yin, "IGRF-RFE: a hybrid feature selection method for MLP-based network intrusion detection on UNSW-NB15 dataset", Journal of Big Data, 10(1), pp.15~ (2023)
  41. "UNSW_NB15"[URL]
  42. D. Jing, "SVM based network intrusion detection for the UNSW-NB15 dataset", 2019 IEEE 13th international conference on ASIC (ASICON), 13, pp.1~4 (2019), IEEE

관련 논문AI추천

침입탐지를 위한 랜덤포레스트 모형의 효과적인 구조: NSL-KDD 데이터셋을 중심으로윤한성, 이창명산업개발연구소 · 산업혁신연구2024 · 제40권 제3호머신 러닝을 활용한 IDS 구축 방안 연구강현선한국소프트웨어감정평가학회 · 한국소프트웨어감정평가학회 논문지2019 · 제15권 제2호Hybrid Feature Selection과 Data Balancing을 통한효율적인 네트워크 침입 탐지 모델민병준, 신동규, 신동일, 유지훈한국정보처리학회 · 정보처리학회 논문지2021 · 제10권 제2호클래스 불균형 데이터에 적합한 기계 학습 기반 침입 탐지 시스템김종현, 김현주, 박기남, 정윤경, 현상원한국정보보호학회 · 정보보호학회논문지2017 · 제27권 제6호스텍앙상블과 인접 넷플로우를 활용한 침입 탐지 시스템김세린, 석민재, 성지현, 이권용, 이상원, 조학수한국정보보호학회 · 정보보호학회논문지2023 · 제33권 제6호네트워크 침입탐지를 위한 계층적 하이브리드 모형윤한성(사)디지털산업정보학회 · (사)디지털산업정보학회 논문지2025 · 제21권 제4호

이 간행물의 다른 논문 (34건)

블록암호 MGFN의 선형 공격에 대한 안전성 분석전용진, 김남일, 백승준, 김종성pp. 1161-1170딥러닝을 활용한 경량 블록 암호의 신경망 구분자 성능 개선 기술 연구오채린, 임우상, 서창호, 김현일, 정수용pp. 1171-1188Width 효율적 ASCON 양자 회로를 이용한 Grover 기반 양자 보안비도 분석최찬호, 최두호, 오진섭pp. 1189-1199terSIDH의 성능 분석 및 상수 시간 구현김수리, 이정환, 홍석희, 허동회, 강태훈pp. 1201-1209기계 학습 활용 운영체제 핑거프린팅 연구 조사김휘강, 안명식, 박상범, 윤경찬pp. 1211-1229
원문 보기