네트워크 비정상 탐지를 위한 속성 축소를 반영한 의사결정나무 기술
Decision Tree Techniques with Feature Reduction for Network Anomaly Detection
0
조회
0
다운로드
6
인용
0
참고문헌
키워드
초록
최근 알려지지 않은 공격에 대처하기 위한 네트워크 비정상(anomaly) 탐지 기술에 대한 관심이 한층 높아지고있다. 이러한 기술 개발을 위해 데이터 마이닝(data mining), 기계학습(machine learning), 그리고 딥러닝(deep learning)등을 활용한 다양한 연구가 진행되고 있다. 본 논문에서는 분류(classification) 문제를 다루는 데이터 마이닝 기술 중 가장 전통적인 방법 중 하나인 의사결정나무(decision tree)를 이용하여 NSL-KDD 데이터셋을 대상으로 네트워크 비정상 탐지 가능성을 보여준다. 의사결정나무의 과대적합(over-fitting) 단점을 해소하기위해 카이-제곱(chi-square) 테스트를 통해 최적의 속성 선택(feature selection)을 수행하고, 선택된 13개의 속성을 사용한 의사결정나무 모델 환경에서 NSL-KDD 시험 데이터 셋 KDDTest+에 대해 84% 그리고KDDTest-21에 대해 70%의 네트워크 비정상 검출 정확도를 보였다. 제시된 정확도는 기존 의사결정나무 모델 적용 시 이들 시험 데이터 셋을 대상으로 알려진 정확도 81% 그리고 64% 수준과 비교해 약 3% 그리고 6% 각각 향상된 결과다.
Abstract
Recently, there is a growing interest in network anomaly detection technology to tackle unknown attacks. For thispurpose, diverse studies using data mining, machine learning, and deep learning have been applied to detect networkanomalies. In this paper, we evaluate the decision tree to see its feasibility for network anomaly detection on NSL-KDDdata set, which is one of the most popular data mining techniques for classification. In order to handle the over-fittingproblem of decision tree, we select 13 features from the original 41 features of the data set using chi-square test, and thenmodel the decision tree using TensorFlow and Scik-Learn, yielding 84% and 70% of binary classification accuracies on theKDDTest+ and KDDTest-21 of NSL-KDD test data set. This result shows 3% and 6% improvements compared to theprevious 81% and 64% of binary classification accuracies by decision tree technologies, respectively.
참고문헌 (18)
- A. Patel, "Survey of intrusion detection and prevention systems", Information Management & Computer Security, 18(4), pp.277~290 (2010)
- M. Ahmed, "A survey of network anomaly detection techniques", Journal of Network and Computer Applications, 60(C), pp.19~31 (2016)
- S. R. Safavian, "A survey of decision tree classifier methodology", IEEE Trans. on Systems, Man and Cybernetics, 21(3), pp.660~674 (1991)
- C. Kruegel, "Using decision trees to improve signature-based intrusion detection", RAID 2003, LNCS 2820, 173~191 (2004)
- J. Lee, "Effective value of decision tree with KDD 99 intrusion detection datasets for intrusion detection system", Proceedings of the 10th International Conference on Advanced Communication Technology, pp.1170~1175 (2008)
- H. Hota, "Decision tree techniques applied on NSL-KDD data and its comparison with various feature selection techniques", Advanced Computing, Networking and Informatics - Volume 1 Proceedings of the Second International Conference on Advanced Computing, Networking and Informatics, pp.205~211 (2014)
- M. Tavallaee, "A detailed analysis of the KDD CUP 99 data set", Proceedings of 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, pp.1~6 (2009)
- "KDD Cup 1999 Data"[URL]
- "NSL-KDD dataset" (2009)[URL]
- K. Cios, "Data mining methods for knowledge discovery" (2000), Kluwer Academic Publishers
- S. Chebrolu, "Feature deduction and ensemble design of intrusion detection system", Journal of Computers and Security, 24(4), pp.295~307 (2005)
- A. Zainal, "Feature selection using rough set in intrusion detection", TENCON 2006 - 2006 IEEE Region 10Conference, pp.1~4 (2006)
- "SelectKBest"[URL]
- "DecisionTreeClassifier"[URL]
- "Get started with TensorFlow"[URL]
- A. Geron, "Hands-On Machine Learning with Scikit-Learn &TensorFlow" (2017), O'REILLY
- D. Kwon, "A survey of deep learning-based network anomaly detection", Cluster Computing Journal, pp.1~13 (2017), Springer
- W. Lee, "A data mining framework for building intrusion detection models", Proceedings of the 1999 IEEE Symposium on Security and Privacy, pp.120~132 (1999)