비지도학습 오토 엔코더를 활용한 네트워크 이상 검출 기술
Network Anomaly Detection Technologies Using Unsupervised Learning AutoEncoders
0
조회
0
다운로드
4
인용
0
참고문헌
키워드
초록
인터넷 컴퓨팅 환경의 변화, 새로운 서비스 출현, 그리고 지능화되어 가는 해커들의 다양한 공격으로 인한 규칙 기반 침입탐지시스템의 한계점을 극복하기 위해 기계학습 및 딥러닝 기술을 활용한 네트워크 이상 검출(NAD:Network Anomaly Detection)에 대한 관심이 집중되고 있다. NAD를 위한 대부분의 기존 기계학습 및 딥러닝기술은 ‘정상’과 ‘공격’으로 레이블링된 훈련용 데이터 셋을 학습하는 지도학습 방법을 사용한다. 본 논문에서는 공격의징후가 없는 일상의 네트워크에서 수집할 수 있는 레이블링이 필요 없는 데이터 셋을 이용하는 비지도학습 오토 엔코더(AE: AutoEncoder)를 활용한 NAD 적용 가능성을 제시한다. AE 성능을 검증하기 위해 NSL-KDD 훈련 및시험 데이터 셋을 사용해 정확도, 정밀도, 재현율, f1-점수, 그리고 ROC AUC (Receiver OperatingCharacteristic Area Under Curve) 값을 보인다. 특히 이들 성능지표를 대상으로 AE의 층수, 규제 강도, 그리고 디노이징 효과 등을 분석하여 레퍼런스 모델을 제시하였다. AE의 훈련 데이터 셋에 대한 재생오류 82-th 백분위수를 기준 값으로 KDDTest+와 KDDTest-21 시험 데이터 셋에 대해 90.4%와 89% f1-점수를 각각 보였다.
Abstract
In order to overcome the limitations of the rule-based intrusion detection system due to changes in Internet computingenvironments, the emergence of new services, and creativity of attackers, network anomaly detection (NAD) using machinelearning and deep learning technologies has received much attention. Most of these existing machine learning and deeplearning technologies for NAD use supervised learning methods to learn a set of training data set labeled ‘normal’ and‘attack’. This paper presents the feasibility of the unsupervised learning AutoEncoder(AE) to NAD from data sets collectingof secured network traffic without labeled responses. To verify the performance of the proposed AE mode, we present theexperimental results in terms of accuracy, precision, recall, f1-score, and ROC AUC value on the NSL-KDD training andtest data sets. In particular, we model a reference AE through the deep analysis of diverse AEs varying hyper-parameterssuch as the number of layers as well as considering the regularization and denoising effects. The reference model shows thef1-scores 90.4% and 89% of binary classification on the KDDTest+ and KDDTest-21 test data sets based on the thresholdof the 82-th percentile of the AE reconstruction error of the training data set.
참고문헌 (20)
- W. Liu, "A Survey of Deep Neural Network Architectures and Their Applications", Neurocomputing, 234, pp.11~26 (2017)
- M. Ahmed, "A survey of network anomaly detection techniques", Journal of Network and Computer Applications, 60, pp.19~31 (2016)
- M. Tavallaee, "A Detailed Analysis of the KDD CUP 99 Data Set", Proceedings of the 2009 IEEE Symposium on Computational Intelligence, pp.1~6 (2009)
- "NSL-KDD dataset" (2009)[URL]
- D. Kwon, "A survey of deep learning-based network anomaly detection", Cluster Computing, 27, pp.949~961 (2019)
- C. Yin, "A deep learning approach for intrusion detection using recurrent neural networks", IEEE Access, pp.21954~21961 (2017)
- J. J. Davis, "Data preprocessing for anomaly based network intrusion detection: A review", Computers & Security, 30(6-7), pp.353~375 (2011)
- H. Bourlard, "Auto-association by multilayer perceptron and singular value decomposition", Biological cybernetics, 59(4-5), pp.291~294 (1988)
- P. Vincent, "Extracting and Composing Robust Features with Denoising Autoencoders", Pro. of the 25th International Conference on Machine Learning, pp.1096~1103 (2008)
- A. Borghesi, "Anomaly detection using autoencoders in high performance computing systems", Proceedings of the AAAI Conference on Artificial Intelligence, 33, pp.9428~9433 (2019)
- M. Sakurada, "Anomaly Detection Using Autoencoders with Nonlinear Dimensionality Reduction", Proc. of MLSDA’14, pp.4~11 (2014)
- Z. Chen, "Autoencoder-based Network Anomaly Detection", 2018 Wireless Telecommunications Symposium, pp.1~5 (2018)
- F. Farahnakian, "A deep auto-encoder based approach for intrusion detection system", Proceedings of the 20th International Conference on Advanced Communication Technology, pp.178~183 (2018)
- C. Ieracitano, "Statistical analysis driven optimized deep learning system for intrusion detection", Proceedings of the International Conference on Brain Inspired Cognitive Systems, pp.759~769 (2018)
- R. C. Aygun, "Network Anomaly Detection with Stochastically Improved Autoencoder Based Models", Proc. of 2017 IEEE 4th International Conference on Cyber Security and Cloud Computing, pp.193~198 (2017)
- A. Geron, "Hands-On Machine Learning with Scikit-Learn, Keras &TensorFlow: Concepts, tools, and techniques to build intelligent systems" (2019), O’Reilly Media
- 강구홍, "네트워크 비정상 탐지를 위한 속성 축소를 반영한 의사결정나무 기술", 정보보호학회논문지, 29(4), pp.795~805 (2019), 한국정보보호학회[DOI]
- A. Ozgur, "A review of KDD99 dataset usage in intrusion detection and machine learning between 2010 and 2015", PeerJ Preprints, 4(e1954) (2016)
- D. Kwon, "An Empirical Study on Network Anomaly Detection Using Convolutional Neural Networks", Proceedings of the IEEE 38th International Conference on Distributed Computing Systems, pp.1595~1598 (2018)
- C. Zhou, "Anomaly Detection with Robust Deep Autoencoders", Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp.665~674 (2017)