신속한 IoT 봇넷 행위분석을 위한 XAI 기반 네트워크 특징 추출 방법론
A Methodology of XAI-Based Network Features Extraction for Rapid IoT Botnet Behavior Analysis
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
사물인터넷(IoT)의 보편화는 다양한 분야의 효율성과 편리성을 향상시켰으나, 이로 인한 보안 위협도 함께 증가하고 있다. 특히, IoT 봇넷의 경우 단시간에 다수의 기기를 감염시키고 각종 공격을 유발하는 등 주요 보안위협으로 평가되고 있다. 기기 자체에 보안 조치를 취하기 어려운 IoT 환경에서 이러한 봇넷의 위험을 최소화하기 위해서는 실시간 모니터링 및 대응을 위한 보안관제 체계 구축이 필수적이다. 보안관제 분야에서는 봇넷을 탐지하는 것 뿐만 아니라, 탐지된 봇넷의 상세 행위를 분석하여 효과적인 대응책을 마련하는 것이 매우 중요하다. 이를 위해 보안전문가들은 탐지된 위협의 페이로드를 분석함으로써 봇넷의 행위분석 및 대응방안 수립에 심혈을 기울이고 있으나, 모든 위협을 전문인력만으로 분석하는 것은 시간·비용 측면에 많은 어려움이 있다. 이에 본 연구에서는 효과적인 IoT 봇넷 행위분석을 위해 XAI 기반의 네트워크 특징 추출 방법론을 제안한다. 제안하는 방법론은 1) BPE 및 TF-IDF 기반의 페이로드 특징 추출, 2) XAI 기반의 특징 중요도 분석, 3) 특징 중요도에 따른 판단 근거 시각화의 세 가지 단계로 구성되며, 이를 통해 보안전문가가 IoT 공격의 증거를 직관적으로 이해하고 불필요한 분석 시간을 절약할 수 있음을 확인하였다. 이는 보안관제에서 위협에 대한 신속한 의사결정 및 대응 전략 수립에 기여할 것으로 기대된다.
Abstract
The widespread adoption of the Internet of Things (IoT) has enhanced efficiency and convenience across various fields, but it has also led to a surge in security threats. Among these, IoT botnets are particularly concerning as they can rapidly infect a large number of devices and launch various types of attacks, making them a significant security threat. In IoT environments where implementing security measures on individual devices is challenging, establishing a security monitoring system for real-time detection and response is essential to mitigate the risks posed by botnets. In the field of security monitoring, it is crucial not only to detect botnets but also to analyze their detailed behaviors to devise effective countermeasures. Security experts devote considerable effort to analyzing the payloads of detected threats to understand botnet behavior and develop appropriate responses. However, analyzing all threats manually is time-consuming and costly. To address this, our study proposes an XAI-based network feature extraction methodology to enhance the effectiveness of IoT botnet behavior analysis. This study proposes a practical security monitoring methodology for IoT botnet behavior analysis and response, consisting of three steps: 1) BPE and TF-IDF based payload feature extraction, 2) XAI-based feature importance analysis, and 3) visualization of decision rationale based on feature importance. This approach provides security experts with intuitive visual evidence of IoT attacks and reduces analysis time, contributing to faster decision-making and response strategy development in security monitoring.
참고문헌 (15)
- "Global IoT Market"[URL]
- "Mirai source code"[URL]
- Djenouri Y, "Interpretable intrusion detection for next generation of internet of things", Computer Communications, 203, pp.192~198 (2023)
- Alani M.M, "Towards an explainable universal feature set for IoT intrusion detection", Sensors, 22(15), pp.5690~ (2022)
- Sharma B, "Explainable artificial intelligence for intrusion detection in IoT networks : A deep learning based approach", Expert Systems with Applications, 238, pp.121751~ (2024)
- Abou El Houda, Z., "“why should i trust your ids?”: An explainable deep learning framework for intrusion detection systems in internet of things networks", IEEE Open Journal of the Communications Society, 3, pp.1164~1176 (2022)
- Djenouri Y, "When explainable AI meets IoT applications for supervised learning", Cluster Computing, 26(4), pp.2313~2323 (2023)
- Oseni A, "An explainable deep learning framework for resilient intrusion detection in IoT-enabled transportation networks", IEEE Transactions on Intelligent Transportation Systems, 24(1), pp.1000~1014 (2023)
- Keshk, M., "An explainable deep learning-enabled intrusion detection framework in IoT networks", Information Sciences, 639, pp.119000~ (2023)
- Abou El Houda.Z, "A novel IoT-based explainable deep learning framework for intrusion detection systems", IEEE Internet of Things Magazine, 5(2), pp.20~23 (2022)
- R. Kalakoti, "Enhancing IoT Botnet Attack Detection in SOCs with an Explainable Active Learning Framework", 2024 IEEE World AI IoT Congress(AIIoT), pp.265~272 (2024)
- R. Kalakoti, "Improving Transparency and Explainability of Deep Learning Based IoT Botnet Detection Using Explainable Artificial Intelligence (XAI)", 2023 International Conference on Machine Learning and Applications (ICMLA), pp.595~601 (2024)
- Gummadi A.N, "XAI-IoT : An Explainable AI Framework for Enhancing Anomaly Detection in IoT Systems", IEEE Access, 12, pp.71024~71054 (2024)
- R. Kalakoti, "Improving IoT Security With Explainable AI : Quantitative Evaluation of Explainability for IoT Botnet Detection", IEEE Internet of Things Journal, 11(10), pp.18237~18254 (2024)
- Gowda. T, "Finding the optimal vocabulary size for neural machine translation", Findings of the Association for Computational Linguistics: EMNLP 2020, pp.3995~3964 (2020)