넷플로우-타임윈도우 기반 봇넷 검출을 위한 오토엔코더 실험적 재고찰
An Experimental Study on AutoEncoderto Detect Botnet Traffic Using NetFlow-Timewindow Scheme: Revisited
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
공격 양상이 더욱 지능화되고 다양해진 봇넷은 오늘날 가장 심각한 사이버 보안 위협 중 하나로 인식된다. 본 논문은 UGR과 CTU-13 데이터 셋을 대상으로 반지도 학습 딥러닝 모델인 오토엔코더를 활용한 봇넷 검출 실험결과를 재검토한다. 오토엔코더의 입력벡터를 준비하기 위해, 발신지 IP 주소를 기준으로 넷플로우 레코드를 슬라이딩 윈도우 기반으로 그룹화하고 이들을 중첩하여 트래픽 속성을 추출한 데이터 포인트를 생성하였다. 특히, 본 논문에서는 동일한 흐름-차수(flow-degree)를 가진 데이터 포인트 수가 이들 데이터 포인트에 중첩된 넷플로우 레코드 수에 비례하는 멱법칙(power-law) 특징을 발견하고 실제 데이터 셋을 대상으로 97% 이상의 상관계수를 제공하는 것으로 조사되었다. 또한 이러한 멱법칙 성질은 오토엔코더의 학습에 중요한 영향을 미치고 결과적으로 봇넷 검출 성능에 영향을 주게 된다. 한편 수신자조작특성(ROC)의 곡선아래면적(AUC) 값을 사용해 오토엔코더의 성능을 검증하였다.
Abstract
Botnets, whose attack patterns are becoming more sophisticated and diverse, are recognized as one of the most serious cybersecurity threats today. This paper revisits the experimental results of botnet detection using autoencoder, a semi-supervised deep learning model, for UGR and CTU-13 data sets. To prepare the input vectors of autoencoder, we create data points by grouping the NetFlow records into sliding windows based on source IP address and aggregating them to form features. In particular, we discover a simple power-law; that is the number of data points that have some flow-degree is proportional to the number of NetFlow records aggregated in them. Moreover, we show that our power-law fits the real data very well resulting in correlation coefficients of 97% or higher. We also show that this power-law has an impact on the learning of autoencoder and, as a result, influences the performance of botnet detection. Furthermore, we evaluate the performance of autoencoder using the area under the Receiver Operating Characteristic (ROC) curve.
참고문헌 (17)
- K. Alieyan, "A survey of botnet detection based on DNS", Neural Computing and Applications, 28(7), pp.1541~1558 (2017)
- H. R. Zeidanloo, "A taxonomy of botnet detection techniques", Proceedings of the International Conference on Computer Science and Information Technology, 2, pp.158~162 (2010)
- D. Zhao, "Botnet detection based on traffic behavior analysis and flow intervals", Computers & Security, 39, pp.2~16 (2013)
- Q. P. Nguyen, "GEE : A gradient-based explainable variational Autoencoder for network anomaly detection", Proceedings of the CNS, pp.91~99 (2019)
- G. M. Fernabdez, "UGR’16 : A new dataset for the evaluation of cyclostationarity-based network IDSs", Computer & Security, 73, pp.441~424 (2018)
- L. Bilge, "Disclosure : Detecting botnet command and control servers through large-scale NetFlow analysis", Proceedings of the ACSAC, pp.129~138 (2012)
- S. Garcia, "An empirical comparison of botnet detection methods", Comp. & Sec, 45, pp.100~123 (2014)
- J. Kim, "Improving botnet detection with recurrent neural network and transfer learning" (2021)
- M. Faloutsos, "On power-law relationships of the internet topology", ACM SIGCOMM Computer Communication Review, 29(4), pp.251~262 (1999)
- L. Carl, "Using machine learning techniques to identify botnet traffic", Proceedings of the Local Computer Networks, pp.967~974 (2006)
- V. Roosmalen, "Applying deep learning on packet flows for botnet detection", Proceedings of the 33rd Annual ACM Symposium on Applied Computing, pp.1629~1636 (2018)
- B. Li, "Review : A survey of network flow applications", Journal of Network and Computer Applications, 36(2), pp.567~581 (2013)
- T. Ongun, "On designing machine learning models for malicious network traffic classification" (2019)
- H. Bourlard, "Auto-association by multilayer perceptron and singular value decomposition", Biological cybernetics, 59, pp.291~294 (1988)
- 강구홍, "비지도학습 오토 엔코더를 활용한 네트워크 이상 검출 기술", 정보보호학회논문지, 30(4), pp.617~629 (2020), 한국정보보호학회[DOI]
- A. Geron, "Hands-On machine learning with Scikit-Learn, Keras & TensorFlow: Concepts, tools, and techniques to build intelligent systems" (2019), O’Reilly Media
- M. Kubat, "Addressing the curse of imbalanced training sets : one-sided selection", Proceedings of the 14th International Conference on Machine Learning, pp.179~186 (1997)