소프트웨어 정의 경계를 이용한 네트워크 트래픽 기반 동적 접근 제어
Network Traffic-Based Access Control Using Software-Defined Perimeter
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
컴퓨터 기술의 급속한 발전은 더 안전한 사용자 환경이 필요하게 되어, 모든 내부 및 외부 네트워크 활동을 검증하는 제로 트러스트 모델의 도입을 촉진했다. 본 논문은 제로 트러스트의 구현 및 지연 문제를 해결하기 위해 소프트웨어 정의 경계 기능을 활용한 효율적인 네트워크 트래픽 데이터 기반 동적 접근 제어 방법을 제안한다. 성능 평가 결과에 따르면 제안한 방법의 탐지 성능은 기존 방식과 유사하게 나타났지만 데이터 셋의 크기는 약 70% 감소했다. 그리고 적응형 제로 트러스트 검증 방식을 제안하여 데이터 셋 크기와 검증 시간을 각각 약 83%, 10% 줄이면서 종래의 방식과 유사한 탐지 성능을 유지했다.
Abstract
The rapid advancement of computer technology has necessitated a safer user environment, prompting the adoption of the zero trust model, which verifies all internal and external network activities. This paper proposes an efficient network traffic data-based dynamic access control method leveraging Software-Defined Perimeter (SDP) capabilities to implement zero trust and address latency issues. According to the performance evaluation results, the detection performance of the proposed scheme is similar to that of conventional schemes, but the dataset size was reduced by 62.47%. Additionally, by proposing an adaptive zero trust verification approach, the dataset size and verification time were reduced by 83.9% and 9.1%, respectively, while maintaining similar detection performance to conventional methods.
참고문헌 (17)
- Syed, N. F., "Zero trust architecture(zta) : A comprehensive survey", IEEE Access, 10, pp.57143~57179 (2022)
- Teerakanok, S., "Migrating to zero trust architecture: Reviews and challenges", Security and Communication Networks, pp.1~10 (2021)
- TN, N., "Zero trust security model: Defining new boundaries to organizational network", Proceedings of the 2023 Fifteenth International Conference on Contemporary Computing, pp.603~609 (2023)
- So-Hui Kim, "Practical Zero Trust Technology and Policy for 5G Network Convergence Industry", Korean Journal of Industrial Security, 14, pp.203~222 (2024)
- Fernandez, Eduardo B., "A critical analysis of Zero Trust Architecture (ZTA)", Computer Standards & Interfaces, 89, pp.103832~ (2024)
- Zolotukhin, M., "Intelligent solutions for attack mitigation in zero-trust environments. In Cyber Security:Critical Infrastructure Protection", COMPUTMETHODS, 56, pp.403~417 (2022), Springer International Publishing
- Zero Trust Architecture, "S. Rose", National Institute of Standards and Technology, U.S. Department of Commerce, ~, pp.NIST Special Publication 800-207 (2020)
- Park, C. S., "Zero Trust Architecture", Review of Korea Institute of Information Security and Cryptology (KIISC), 33(4), pp.131~141 (2023)
- Lee. J. Y, "A Study on the Establishment of Zero Trust Security Model", Korea Information Processing Society, 2023, pp.12(6), 189~196
- Devarakonda, A., "Network intrusion detection: A comparative study of four classifiers using the NSL-KDD and KDD’99 datasets", Journal of Physics: Conference Series, 2161(1), pp.012043~ (2022), IOP Publishing
- Yao, Q., "Dynamic access control and authorization system based on zerotrust architecture", Proceedings of the 2020 1st international conference on control, robotics and intelligent system, pp.123~127 (2020)
- Jin, Q, "Zero-trust based distributed collaborative dynamic access control scheme with deep multi-agent reinforcement learning", EAI Endorsed Transactions on Security and Safety, ~ (2022)
- Jeon, So-Eun, "Suboptimal Feature Selection Techniques for Effective Malicious Traffic Detection on Lightweight Devices", CMESComputer Modeling in Engineering &Sciences, 140(2) (2024)
- Gouveia, A., "Recent Advances in Security, Privacy, and Trust for Internet of Things (IoT)and Cyber-Physical Systems (CPS)", pp.2020, Chapman and Hall
- Deng, Y., "Multiple imputation through xgboost", Journal of Computational and Graphical Statistics, 33(2), pp.1~19 (2023)
- M. Tavallaee, "A Detailed Analysis of the KDD CUP 99 Data Set", 2009IEEE symposium on computational intelligence for security and defense applications (CISDA), pp.1~6 (2009)
- Iman Sharafaldin, "Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization", 4th International Conference on Information Systems Security and Privacy (ICISSP) (2018)