악성코드 대응을 위한 신뢰할 수 있는 AI 프레임워크
Trustworthy AI Framework for Malware Response
0
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
4차 산업혁명의 초연결사회에서 악성코드 공격은 더욱 기승을 부리고 있다. 이러한 악성코드 대응을 위해 인공지능기술을 이용한 악성코드 탐지 자동화는 새로운 대안으로 주목받고 있다. 그러나, 인공지능의 신뢰성에 대한 담보없이 인공지능을 활용하는 것은 더 큰 위험과 부작용을 초래한다. EU와 미국 등은 인공지능의 신뢰성 확보방안을 강구하고 있으며, 2021년 정부에서는 신뢰할 수 있는 인공지능 실현 전략을 발표했다. 정부의 인공지능 신뢰성에는 안전과 설명가능, 투명, 견고, 공정의 5가지 속성이 있다. 우리는 악성코드 탐지 모델에 견고를 제외한 안전과, 설명가능, 투명, 공정의 4가지 요소를 구현하였다. 특히 외부 기관의 검증을 통해 모델 정확도인 일반화 성능의 안정성을 입증하였고 투명을 포함한 설명가능에 중점을 두어 개발하였다. 변화무쌍한 데이터에 의해 학습이 결정되는 인공지능 모델은 생명주기 관리가 필요하다. 이에 인공지능 모델을 구성하는 데이터와 개발, 서비스 운영을 통합하는 MLOps 프레임워크에 대한 수요가 늘고 있다. EXE 실행형 악성코드와 문서형 악성코드 대응 서비스는 서비스 운영과 동시에 데이터 수집원이 되고, 외부 API를 통해 라벨링과 정제를 위한 정보를 가져오는 데이터 파이프라인과 연계하도록 구성하였다. 클라우드 SaaS 방식과 표준 API를 사용하여 다른 보안 서비스 연계나 인프라 확장을 용이하게 하였다.
Abstract
Malware attacks become more prevalent in the hyper-connected society of the 4th industrial revolution. To respond to such malware, automation of malware detection using artificial intelligence technology is attracting attention as a new alternative. However, using artificial intelligence without collateral for its reliability poses greater risks and side effects. The EU and the United States are seeking ways to secure the reliability of artificial intelligence, and the government announced a reliable strategy for realizing artificial intelligence in 2021. The government’s AI reliability has five attributes: Safety, Explainability, Transparency, Robustness and Fairness. We develop four elements of safety, explainable, transparent, and fairness, excluding robustness in the malware detection model. In particular, we demonstrated stable generalization performance, which is model accuracy, through the verification of external agencies, and developed focusing on explainability including transparency. The artificial intelligence model, of which learning is determined by changing data, requires life cycle management. As a result, demand for the MLops framework is increasing, which integrates data, model development, and service operations. EXE-executable malware and documented malware response services become data collector as well as service operation at the same time, and connect with data pipelines which obtain information for labeling and purification through external APIs. We have facilitated other security service associations or infrastructure scaling using cloud SaaS and standard APIs.
참고문헌 (33)
- Gibert, D., "The rise of machine learning for detection and classification of malware : Research developments, trends and challenges", Journal of Network and Computer Applications, 153, pp.102526~ (2020)
- "Trusted artificial intelligence realization strategy"[URL]
- C. P. SungIk Jo, "Implementation strategies for machine learning operations(mlops)", Institute for Information &communication Technology Planning & evaluation (IITP), 1985(1), pp.2~16 (2021)
- Kang, B., "N-gram opcode analysis for android malware detection", arXiv preprint arXiv:1612.01445, ~ (2016)
- Santos, I., "Opcode sequences as representation of executables for data-mining-based unknown malware detection", Information Sciences, 231, pp.64~82 (2013)
- Saxe, J., "Deep neural network based malware detection using two dimensional binary program features", 2015 10th International Conference on Malicious and Unwanted Software (MALWARE), pp.11~20 (2015)
- Shabtai, A., "Detecting unknown malicious code by applying classification techniques on opcode patterns", Security Informatics, 1(1), pp.1~22 (2012)
- Kumar, N., "Malware Classification using Early Stage Behavioral Analysis", IEEE Conference Publication, pp.16~23 (2019), | IEEE Xplore
- Han, W., "MalDAE : Detecting and explaining malware based on correlation and fusion of static and dynamic characteristics", Computers & Security, 83, pp.208~233 (2019)
- Fuyong, Z., "Malware detection and classification based on n-grams attribute similarity", 2017IEEE international conference on computational science and engineering (CSE) and IEEE international conference on embedded and ubiquitous computing (EUC), 1, pp.793~796 (2017)
- Mikolov, T., "Efficient estimation of word representations in vector space", arXiv preprint arXiv : 1301. 3781, ~ (2013)
- Pascanu, R., "Malware classification with recurrent networks", 2015IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp.1916~1920 (2015)
- Hardy, W., "DL4MD : A deep learning framework for intelligent malware detection", Proceedings of the International Conference on Data Science (ICDATA). The Steering Committee of The World Congress in Computer Science, Computer Engineering and Applied Computing (WorldComp), pp.61~67 (2016)
- Jung, B., "Malware classification using byte sequence information", Proceedings of the 2018 Conference on Research in Adaptive and Convergent Systems, pp.143~148 (2018)
- Gibert, D., "Convolutional neural networks for malware classification", pp.1~98 (2016), University Rovira i Virgili
- Kolosnjaji, B., "International Joint Conference on Neural Networks(IJCNN), pp", 2017 International Joint Conference on Neural Networks (IJCNN), pp.3838~3845 (2017)
- Raff, E., "Malware detection by eating a whole exe", Workshops at the Thirty-Second AAAI Conference on Artificial Intelligence, pp.268~276 (2018)
- "Word2vec: Google’s New Leap Forward on the Vectorized Representation of Words", Medium, ~ (2018)
- Le, Q., "Deep learning at the shallow end : Malware classification for non-domain experts", Digital Investigation, 26, pp.S118~S126 (2018)
- Trong Duc Nguyen, "Exploring api embedding for api usages and applications", 2017 IEEE, 2017, 438~449
- Lee, Y., "Instruction2vec: efficient preprocessor of assembly code to detect software weakness with CNN", Applied Sciences, 9(19), pp.4086~ (2019)
- "Machine Learning Operations (MLOps) Implementation Strategy"[URL]
- S. Poudyal, "Ai-powered ransomware detection framework", 2020 IEEE Symposium Series on Computational Intelligence (SSCI), pp.1154~1161 (2020)
- O. Aslan, "A new malware classification framework based on deep learning algorithms", Ieee Access, 9, pp.87936~87951 (2021)
- C. Urcuqui-L ́opez, "Framework for malware analysis in android", Sistemas y Telem ́atica, 14(37), pp.45~56 (2016)
- L. Caviglione, "Seeing the unseen : revealing mobile malware hidden communications via energy consumption and artificial intelligence", IEEE Transactions on Information Forensics and Security, 11(4), pp.799~810 (2015)
- "Forensics, C.: Virusshare"[URL]
- "Virustotal.com"[URL]
- Khalid, S., "A survey of feature selection and feature extraction techniques in machine learning", 2014 science and information conference, pp.372~378 (2014)
- Peng, H., "Feature selection based on mutual information criteria of max-dependency, max-relevance, and min-redundancy", IEEE Transactions on pattern analysis and machine intelligence, 27(8), pp.1226~1238 (2005)
- A. B. Arrieta, "Explainable artificial intelligence(xai) : Concepts, taxonomies, opportunities and challenges toward responsible ai", Information fusion, 58, pp.82~115 (2020)
- 임희경, "설명가능한 인공지능(explainable AI, XAI)의 필요성과 연구동향", 정보기술융합공학논문지, 12(1), pp.51~57 (2022), IT연구소[DOI]