Gradient Boosting 기법을 활용한 다크넷 트래픽 탐지 및 분류
Darknet Traffic Detection and Classification using Gradient Boosting Techniques
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
다크넷(Darknet)은 익명성과 보안을 바탕으로 하고 있어 각종 범죄 및 불법 활동에 지속적으로 악용되고 있으며, 이러한 오·남용을 막기 위해 다크넷 트래픽을 정확하게 탐지하고 분류하는 연구는 매우 중요하다. 본 논문에서는 그레디언트 부스팅 기법을 활용한 다크넷 트래픽 탐지 및 분류 기법을 제안하였다. CIC-Darknet2020 데이터셋에 XGBoost와 LightGBM 알고리즘을 적용한 결과, 99.99%의 탐지율과 99% 이상의 분류 성능을 나타내어 기존 연구에 비해 3% 이상 높은 탐지 성능과 13% 이상의 높은 분류 성능을 달성할 수 있었다. 특히, LightGBM 알고리즘의 경우, XGBoost보다 약 1.6배의 학습 시간과 10배의 하이퍼 파라미터 튜닝 실행시간을 단축하여 월등히 우수한 성능으로 다크넷 트래픽 탐지 및 분류를 수행하였다.
Abstract
Darknet is based on the characteristics of anonymity and security, and this leads darknet to be continuously abused for various crimes and illegal activities. Therefore, it is very important to detect and classify darknet traffic to prevent the misuse and abuse of darknet. This work proposes a novel approach, which uses the Gradient Boosting techniques for darknet traffic detection and classification. XGBoost and LightGBM algorithm achieve detection accuracy of 99.99%, and classification accuracy of over 99%, which could get more than 3% higher detection accuracy and over 13% higher classification accuracy, compared to the previous research. In particular, LightGBM algorithm could detect and classify darknet traffic in a way that is superior to XGBoost by reducing the learning time by about 1.6 times and hyperparameter tuning time by more than 10 times.
참고문헌 (29)
- Jessica A. Wood, "The Darknet: A Digital Copyright Revolution", Rich. J.L. & Tech, 16, pp.14~ (2010)
- "What We Know About the Darkside Ransomware and the US Pipeline Attack"[URL]
- "Avaddon Ransomware Attack Hits AXA Philippines, Malaysia, Thailand and Hong Kong"[URL]
- "A large-scale of login attempts happened by abusing the leaked Kakaotalk account"[URL]
- Lashkari, A. H., "Characterization of tor traffic using time based features", ICISSP, 2, pp.253~262 (2017)
- Draper-Gil, G., "Characterization of encrypted and vpn traffic using time-related", ICISSP, 2, pp.407~414 (2016)
- Florian Platzer, "Critical traffic analysis on the tor network", Proceedings of the 15th International Conference on Availability, Reliability and Security (ARES '20). ACM, pp.1~10 (2020)
- P. Gao, "VPN Traffic Classification Based on Payload Length Sequence", Internatio nal Conference on Networking and Network Applications (NaNA), pp.241~247 (2020), IEEE Computer Society
- "Gradient Boosting with Scikit-Learn, XGBoost, LightGBM, and CatBoost"[URL]
- "How To Use Deep/Dark Web On Your Android (A-Z Guide On Deep Web)"[URL]
- M. B. Sarwar, "DarkDetect: Darknet Traffic Detection and Categorization Using Modified Convolution-Long Short-Term Memory", IEEE Access, 9, pp.113705~113713 (2021)
- Dingledine, "Tor: The second-generation onion router" (2004), Naval Research Lab Washington DC
- 김지혜, "주성분 분석과 머신러닝 기법을 활용한 Tor 네트워크 웹사이트 핑거프린팅 연구", 국방과 보안, 3(2), pp.7~44 (2021), 국방보안연구소
- Ferguson, Paul, "What is a VPN?", 1~22 (1998)
- "How To Use VPN For Dark Web"[URL]
- "CIC-Darknet2020"[URL]
- "Tor-nonTor dataset (ISCXTor2016)"[URL]
- "VPN-nonVPN dataset (ISCXVPN2016)"[URL]
- Arash Habibi Lashkari, "DIDarknet : A Contemporary Approach to Detect and Characterize the Darknet Traffic using Deep Image Learning", ICCNS 2020, pp.1~13 (2020), ACM
- Nitesh V. Chawla, "SMOTE: synthetic minority over-sampling technique", J. Artif. Int. Res, 16(1), pp.321~357 (2002)
- Iliadis, "Darknet Traffic Classification using Machine Learning Techniques", 10th International Conference on Modern Circuits and Systems Technologies (MOCAST). IEEE, pp.1~4 (2021)
- Neha Gupta, "Encrypted Traffic Classi fication Using eXtreme Gradient Boosting Algorithm", International Conference on Innovative Computi ng and Communications. Advances in Intelligent Systems and Computing, 1394, pp.225~232 (2019), Springer
- "CICFlowMeter"[URL]
- "ipinfo/python"[URL]
- "A gentle introduction to gradient boosting"[URL]
- "How to choose between different Boosting Algorithms"[URL]
- Shwartz-Ziv, Ravid, "Tabular data: Deep learning is not all you need", Information Fusion, 81, pp.84~90 (2021)
- Tianqi Chen, "XGBoost: A Scalable Tree Boosting System", Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining Association for Computing Machinery, pp.785~794 (2016)
- "LightGBM Features"[URL]