기계학습 기반 IDS 보안이벤트 분류 모델의 정확도 및 신속도 향상을 위한 실용적 feature 추출 연구
A Practical Feature Extraction for Improving Accuracy and Speed of IDS Alerts Classification Models Based on Machine Learning
1
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
인터넷의 성장과 함께 각종 취약점을 악용한 사이버 공격들이 지속적으로 증가하고 있다. 이러한 행위를 탐지하기위한 방안으로 침입탐지시스템(IDS; Intrusion Detection System)이 널리 사용되고 있지만, IDS에서 발생하는 많은 양의 오탐(정상통신을 공격행위로 잘못 탐지한 보안이벤트)은 여전히 해결되지 않은 문제로 남아있다. IDS오탐 문제를 해결하기 위한 방법으로 기계학습 알고리즘을 통한 자동분류 연구가 진행되고 있지만 실제 현장 적용을위해서는 정확도와 데이터 처리속도 향상을 위한 연구가 더 필요하다. 기계학습 기반 분류 모델은 다양한 요인에 의해서 그 성능이 결정된다. 최적의 feature를 선택하는 것은 모델의 분류 성능 및 정확성 향상에 크게 영향을 미치기 때문에 기계학습에서 매우 중요한 부분을 차지한다. 본 논문에서는 보안이벤트 분류 모델의 성능 향상을 위해 기존 연구에서 제안한 기본 feature에 추가로 10종의 신규 feature를 제안한다. 본 논문에서 제안하는 10종의 신규feature는 실제 보안관제센터 전문 인력의 노하우를 기반으로 고안된 것으로, 모델의 분류 성능을 향상시킬 뿐만아니라 단일 보안이벤트에서 직접 추출 가능하기 때문에 실시간 모델 구축도 가능하다. 본 논문에서는 실제 네트워크 환경에서 수집된 데이터를 기반으로 제안한 신규 feature들이 분류 모델 성능 향상에 미치는 영향을 검증하였으며, 그 결과, 신규 feature가 모델의 분류 정확도를 향상시키고 오탐지율을 낮춰주는 것을 확인할 수 있었다.
Abstract
With the development of Internet, cyber attack has become a major threat. To detect cyber attacks, intrusion detectionsystem(IDS) has been widely deployed. But IDS has a critical weakness which is that it generates a large number of falsealarms. One of the promising techniques that reduce the false alarms in real time is machine learning. However, there areproblems that must be solved to use machine learning. So, many machine learning approaches have been applied to thisfield. But so far, researchers have not focused on features. Despite the features of IDS alerts are important for performanceof model, the approach to feature is ignored. In this paper, we propose new feature set which can improve the performanceof model and can be extracted from a single alarm. New features are motivated from security analyst’s know-how. Wetrained and tested the proposed model applied new feature set with real IDS alerts. Experimental results indicate theproposed model can achieve better accuracy and false positive rate than SVM model with ordinary features.
참고문헌 (25)
- Guide to intrusion detection and prevention systems (IDPS), NIST Special Publication-800-94, "K. Scarfone", ~ (2007)
- T. Pietraszek, "Using adaptive alert classification to reduce false positive in intrusion detection", Recent Advances in Intrusion Detection, pp.102~124 (2004)
- N. Hubballi, "False alarm minimization techniques in sig- nature-based intrusion detection sys- tems: A survey", Computer Communications, 49, pp.1~17 (2014)[DOI]
- G. Spathoulas, "Methods for post-processing of alerts in intrusion detection: A survey", International Journal of Information Security Science, 2(2), pp.64~80 (2013)
- R. Sommer, "Enhancing byte-level network intrusion detection signatures with context", Proceedings of the 10th ACM conference on Computer and communications security, pp.262~271 (2003), ACM
- S.J. Yang, "High level information fusion for tracking and projection of multistage cyber attacks", Information Fusion, 10(1), pp.107~121 (2009)[DOI]
- E. Raftopoulos, "Detecting, validating and characterizing computer infections in the wild", Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference, pp.29~44 (2011), ACM
- G. Spathoulas, "Enhancing IDS performance through comprehensive alert post-processing", Computers & Security, 37, pp.176~196 (2013)[DOI]
- M.S. Shin, "False alarm classification model for net- work-based intrusion detection system", International Conference on Intelligent Data Engineering and Automated Learning, pp.259~265 (2004)
- T. Pietraszek, "Data mining and machine learning-Towards reducing false positives in intrusion detection", Information Security Technical Report, 10, pp.169~183 (2005)[DOI]
- C. Thomas, "Performance enhancement of intrusion detection systems using advances in sensor fusion", pp.1~7 (2008)
- G. Tjhai, "A preliminary two-stage alarm correlation and filtering system using SOM neural network and K-means algorithm", Computers & Security, 29, pp.712~723 (2010)[DOI]
- N. Hubballi, "Network specific false alarm reduction in intrusion detection system", Security and Communication Networks, 4, pp.1339~1349 (2011)[DOI]
- C. Chiu, "Semi-supervised learning for false alarm reduction", Industrial conference on data mining, pp.595~605 (2010)
- Y. Meng, "Adaptive false alarm filter using machine learning in intrusion detection", Practical applications of intelligent systems, pp.573~584 (2011)
- S. Benferhat, "An intrusion detection and alert correlation approach based on revising probabilistic classifiers using expert knowledge", Applied Intelligence, 38, pp.520~540 (2013)[DOI]
- Y. Meng, "Intrusion detection using disagreement-based semi-supervised learning: detection enhancement and false alarm reduction", Cyberspace Safety and Security, pp.483~497 (2012)
- Y. Meng, "Enhancing false alarm reduction using pool-based active learning in network intrusion detection", International Conference on Information Security Practice and Experience 2013, pp.1~15 (2013)
- W. Li, "MVPSys: Towards practical multi-view based false alarm reduction system in network intrusion detection", Computers & Security, 60, pp.177~192 (2016)[DOI]
- H. Liang, "False positive elimination in in- trusion detection based on clustering", 12th International Conference on Fuzzy Systems and Knowledge Discovery (FSKD), pp.519~523 (2015)
- T. Alapaholuoma, "A behavior-based method for rationalizing the amount of ids alert data", ICCGI 2012, The Seventh International Multi-Conference on Computing in the Global Information Technology (2012)
- J.O. Nehinbe, "Automated method for reducing false positives", 2010 International Conference on Intelligent Systems, Modelling and Simulation, pp.54~59 (2010)
- V. Vapnik, "The nature of statistical learning theory" (2013), Springer science & business media
- C.W. Hsu, "A practical guide to support vector classification", pp.1~16 (2003)
- C.C. Chang, "LIBSVM: a library for support vector machines", ACM transactions on intelligent systems and technology, 2(3) (2011)