패킷 페이로드 분석을 활용한 트랜스포머 기반 침입탐지시스템
Intrusion Detection System based on Packet Payload Analysis using Transformer
1
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
네트워크 패킷의 메타데이터를 학습한 침입탐지시스템이 최근 많이 제안되었다. 그러나 이러한방식은 모델 학습에 사용할 메타데이터 생성을 위해 패킷을 분석하는 시간, 그리고 학습 전 메타데이터를 전처리하는 시간이 필요하다. 또한, 특정 메타데이터를 학습한 모델은 실제 네트워크로 유입되는 원본 패킷을 그대로 사용하여 침입을 탐지하는 것이 불가능하다. 이러한 문제를 해결하기위해 본 논문에서는 패킷 페이로드를 하나의 문장으로 학습시켜 침입을 탐지하는 자연어 처리 기반의 침입탐지시스템을 제안하였다. 제안하는 기법의 성능 검증을 위해 UNSW-NB15와 Transformer 모델을 활용하였다. 먼저, 데이터세트의 PCAP 파일에 대한 라벨링을 실시한 후 2종의 Transformer 모델(BERT, DistilBERT)에 문장 형태로 직접 학습시켜 탐지성능을 분석하였다. 실험 결과 이진분류정확도는 각각 99.03%, 99.05%로 기존 연구에서 제안한 기법들과 유사하거나 우수한 탐지성능을보였으며, 다중분류는 각각 86.63%, 86.36%로 더 우수한 성능을 나타냄을 확인하였다.
Abstract
Intrusion detection systems that learn metadata of network packets have been proposed recently. However these approaches require time to analyze packets to generate metadata for model learning, and time to pre-process metadata before learning. In addition, models that have learned specific metadata cannot detect intrusion by using original packets flowing into the network as they are. To address the problem, this paper propose a natural language processing-based intrusion detection system that detects intrusions by learning the packet payload as a single sentence without an additional conversion process. To verify the performance of our approach, we utilized the UNSW-NB15 and Transformer models. First, the PCAP files of the dataset were labeled, and then two Transformer (BERT, DistilBERT) models were trained directly in the form of sentences to analyze the detection performance. The experimental results showed that the binary classification accuracy was 99.03% and 99.05%, respectively, which is similar or superior to the detection performance of the techniques proposed in previous studies. Multi-class classification showed better performance with 86.63% and 86.36%, respectively.
참고문헌 (21)
- 김건남, "LightGBM을 활용한 패킷 페이로드 분석 기반의 침입탐지시스템", 한국컴퓨터정보학회논문지, 28(6), pp.47~54 (2023), 한국컴퓨터정보학회[DOI]
- N. Moustafa, "UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set)", 2015 Military Communications and Information Systems Conference (MilCIS), pp.1~6 (2015)
- "UNSW-NB15 Data set"[URL]
- "NSL-KDD dataset"[URL]
- Sydney M. Kasongo, "Performance Analysis of Intrusion Detection Systems Using a Feature Selection Method on the UNSW-NB15 Dataset", Journal of Big Data, 7(105) (2020), Springer Science and Business Media LLC[DOI]
- J. Vimalrosy, "OSS-RF: INTRUSION DETECTION USING OPTIMIZED SINE SWARM BASED RANDOM FOREST CLASSIFIER ON UNSW-NB15DATASET", IJTPE Journal, 14, pp.275~283 (2022)
- M. H. Kabir, "Network Intrusion Detection Using UNSW-NB15 Dataset: Stacking Machine Learning Based Approach", 2022International Conference on Advancement in Electrical and Electronic Engineering (ICAEEE), pp.1~6 (2022)
- Nour Moustafa, "The evaluation of Network Anomaly Detection Systems: Statistical analysis of the UNSW-NB15 data set and the comparison with the KDD99 data set", Information Security Journal: A Global Perspective, 25(1-3), pp.18~31 (2016), Informa UK Limited[DOI]
- Abhijit Das, "Anomaly-based Network Intrusion Detection using Ensemble Machine Learning Approach", International Journal of Advanced Computer Science and Applications, 13(2), pp.635~645 (2022), The Science and Information Organization[DOI]
- D. Jing, "SVM Based Network Intrusion Detection for the UNSW-NB15 Dataset", 2019 IEEE 13th International Conference on ASIC (ASICON), pp.1~4 (2019)
- Fares Meghdouri, "Analysis of Lightweight Feature Vectors for Attack Detection in Network Traffic", Applied Sciences, 8(11), pp.2196~ (2018), MDPI AG[DOI]
- Zihan Wu, "RTIDS: A Robust Transformer-Based Approach for Intrusion Detection System", IEEE Access, 10, pp.64375~64387 (2022), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- Y. G. Yang, "Intrusion detection: A model based on the improved vision transformer", National Natural Science Foundation of China, ~ (2022)
- Ju-wan Lim, "Performance comparison of network anomaly detection using BERT, LSTM and GRU", KICS, pp.1268~1269 (2022)
- Y. A. Farrukh, "Payload-Byte: A Tool for Extracting and Labeling Packet Capture Files of Modern Network Intrusion Detection Datasets", pp.58~67 (2022)
- Vaswani, "Attention is All you Need", NIPS, ~ (2017)
- J. Devlin, "BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding", 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, 1, pp.4171~4186 (2019)
- Yinhan Liu, "RoBERTa:A Robustly Optimized BERT Pretraining Approach", Computation and Language, ~ (2019)
- Zhenzhong Lan, "ALBERT: A Lite BERT for Self-supervised Learning of Language Representations", Computation and Language, 6 (2020)[DOI]
- Zhilin Yang, "XLNet: Generalized Autoregressive Pretraining for Language Understanding", NeurIPS, ~ (2019)