봇 넷 트래픽 식별을 위한 스택구조 딥러닝 접근 방식
A Deep Learning Approach with Stacking Architecture to Identify Botnet Traffic
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
봇 넷의 악의적인 행위는 인터넷 서비스 제공자뿐만 아니라 기업, 정부, 그리고 심지어 가정의일반 사용자에 이르기까지 엄청난 경제적 손실을 끼치고 있다. 본 논문에서는 CTU-13 봇 넷 트래픽 데이터 셋을 사용하여 딥러닝 모델 Convolutional Neural Network(CNN)을 적용한 봇 넷 트래픽검출에 대한 가능성을 확인하고자한다. 특히 알려진 봇 넷과 알려지지 않은 봇 넷 트래픽에 대해C&C 서버를 검출하기 위한 봇과 C&C 서버 사이 트래픽, 봇을 검출하기 위한 C&C 통신 이외에봇이 발생하는 트래픽, 그리고 정상 트래픽을 분류하는 멀티클래스 분류(multi-class classification)를시도하였다. 성능검증을 위한 지표는 정확도, 정밀도, 재현율, 그리고 F1 점수를 제시하였다. 한편확장성과 운영을 고려하여 봇 넷 타입 별로 모듈을 적재할 수 있는 스택구조의 봇 넷 검출 시스템을 제안함으로써 실제 네트워크의 적용 가능성을 제시하였다.
Abstract
Malicious activities of Botnets are responsible for huge financial losses to Internet Service Providers, companies, governments and even home users. In this paper, we try to confirm the possibility of detecting botnet traffic by applying the deep learning model Convolutional Neural Network (CNN) using the CTU-13 botnet traffic dataset. In particular, we classify three classes, such as the C&C traffic between bots and C&C servers to detect C&C servers, traffic generated by bots other than C&C communication to detect bots, and normal traffic. Performance metrics were presented by accuracy, precision, recall, and F1 score on classifying both known and unknown botnet traffic. Moreover, we propose a stackable botnet detection system that can load modules for each botnet type considering scalability and operability on the real field.
참고문헌 (16)
- Sérgio S.C. Silva, "Botnets: A survey", Computer Networks, 57(2), pp.378~403 (2013), Elsevier BV[DOI]
- Symantec Internet Security Threat Report, "B. O’Gorman", ~, pp.Technical Report, Vol. 24 (2019)
- Weibo Liu, "A survey of deep neural network architectures and their applications", Neurocomputing, 234, pp.11~26 (2017), Elsevier BV[DOI]
- M. Tavallaee, "A Detailed Analysis of the KDD CUP 99 Data Set", Proceddings of the 2009IEEE Symposium on Computational Intelligence, pp.1~6 (2009)
- C. Livadas, "Using Machine Learning Techniques to Identify Botnet Traffic", Proceedings of the 31st IEEE Conference on Local Computer Networks (2006)
- C. Hung, "A Botnet Detection System Based on Machine-Learning using Flow-Based Features", SECURWARE 2018: The Twelfth International Conference on Emerging Security Information, Systems and Technologies (2018)
- B. Nugraha, "Performance Evaluation of Botnet Detection using Deep Learning Techniques", Proceedings of the 11th International Conference on Network of the Future (2020)
- L. Mohammadpour, "A Convolutional Neural Network for Network Intrusion Detection System", Proceedings of the APAN-Research Workshop (2018)
- S. García, "An empirical comparison of botnet detection methods", Computers & Security, 45, pp.100~123 (2014), Elsevier BV[DOI]
- "The CTU-13 Dataset. A Labeled Dataset with Btnet, Normal and Background traffic"[URL]
- S. Maeda, "A Botnet Detection Method on SDN using Deep Learning", Proceedings of 2019 IEEE International Conference on Consumer Electronics, pp. 1-6, pp.1~6 (2019)
- S. C. Chen, "Effective botnet detection through neural networks on convolutional features", Proceedings of the 17th IEEE Conference On Trust, Security, And Privacy In Computing And Communications, 2018, 372~378
- B. Rahbarinia, "Peerrush : Mining for Unwanted p2p traffic", Journal of Information Security and Applications, 19(3), pp.194~208 (2014)
- Lorenzo Fernandez Maimo, "A Self-Adaptive Deep Learning-Based System for Anomaly Detection in 5G Networks", IEEE Access, 6, pp.7700~7712 (2018), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- IP Illustrated, Volume 1, "TCP", pp.1994, W.R. Stevens
- A. Geron, "Hands-On Machine Learning with Scikit-Learn &TensorFlow" (2017), O’REILLY