N-gram 기법을 사용한 침입탐지 모델
Intrusion Detection Model Using N-gram Method
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
컴퓨터 기술의 발전으로 인한 해킹에 따른 방어책으로 침입탐지 시스템에관한 많은 연구들이 진행되어왔다. 기존의 연구들은 DARPA, UNM, KDD 데이터 세트를 사용하였는데 기존의 데이터 세트들은 오래된 데이터 세트로최신의 공격들을 평가하기에는 적합하지 않은 문제가 발생한다. 2013년공개된 ADFA 데이터 세트는 이러한 문제점을 해결할 최신 공격 기법들로이루어진 데이터 세트이다. ADFA 데이터 세트는 Window와 Linux 두 가지운영 체제로 데이터가 생성되었는데 본 논문에서는 Linux 운영 체제인ALFA-LD 데이터 세트로 실험을 진행한다. ALFA-LD 데이터 세트는 시스템호출(System Call)로 구성되어 있으며 총 6가지의 공격과 하나의 정상 데이터샘플로 이루어져있다. 또한 모방공격에 취약하지 않도록 전처리 과정에서N-gram을 사용하여 시스템 콜의 순서를 보존하며 데이터를 생성하였다. 실험에는 ALFA-LD의 6가지 공격을 개별적으로 탐지하는 다중 분류 실험과클래스간 데이터의 불균형이 심하여 불균형 문제를 해소하기 위해 6가지공격을 하나로 보는 이진 분류 실험을 진행하였다. 이진 분류 실험의결과로는 3-Gram의 Logistic Regression 알고리즘이 97%의 성능을보여주었고 다중 분류의 실험 결과로는 4-Gram이 다른 데이터 보다 조금 더성능이 좋다는 것을 확인 할 수 있었다.
Abstract
Due to the development of computer technology, lots of research have been conducted on intrusion detection systems as a defense against hacking. The existing research used to use DARPA, UNM, and KDD data sets, which are old and not suitable for evaluating the latest attacks. The ADFA data set released in 2013 is a data set of the latest attack techniques to solve these problems. The ADFA data set is generated by two operating systems, which are Windows and Linux. In this paper, the experiment is conducted with the ADFA-LD data set, which is the Linux operating system. The ADFA-LD data set consists of a system call, consisting of six attacks and one normal data sample. In addition, N-gram was used to preserve the order of system calls and generate data in the preprocessing process so they are not vulnerable to imitation attacks. In the experiment, the binary classification was conducted to identify the six attacks of ADFA-LD individually and to solve the imbalance problem due to the imbalance of the data between classes.The results of binary classification experiment showed that 3-Gram Logistic Regression algorithm showed 97% performance and the results of multi-classification showed that 4-Gram was a little better than other data.
참고문헌 (12)
- KANIMOZHI, V., "Artificial Intelligence based Network Intrusi on Detection with hyper-parameter optimization tuning on the realistic cyber dataset CSE-CIC-IDS2018 using cloud computing", 2019 International Confe rence on Communication and Signal Processing (ICCSP), pp.0033~0036 (2019), IEEE
- SHUN, Jimmy, "Network intrusion detection system using neural networks", 2008 Fourth International Conference on Natural Computation, pp.242~246 (2008), IEEE
- FORREST, Stephanie, "The evolution of system-c all monitoring", 2008 annual computer security applications conference (acsac), pp.418~430 (2008), IEEE
- THOMAS, Ciza, "Data Mining, Intrusion Detection, Informati on Assurance, and Data Networks Security 2008", pp.69730G~ (2008), International Society for Optics and Photonics
- REVATHI, S., "A detailed analysis on NSL-KDD dataset using various machine learning techniques for intrusion detection", International Journal of Engineering Research & Technology (IJERT), 2(12), pp.1848~1853 (2013)
- CREECH, Gideon, "Generation of a new IDS test dataset: Time to retire the KDD collection", 2013 IEEE Wireless Communications and Networking Conference (WCNC), pp.4487~4492 (2013), IEEE
- O. Yavanoglu, "A review on cyber security datasets for machine learning algorithms", 2017 IEEE International Conference on Big Data (Big Data) (2017), IEEE
- M. Pendleton, "A dataset generator for next generation system call host intrusion detection systems", MILCOM 2017-2017 IEEE Military Communications Conference (MILCOM) (2017), IEEE
- Shaohua Lv, "Intrusion Prediction With System-Call Sequence-to-Sequence Model", IEEE Access, 6, pp.71413~71421 (2018), Institute of Electrical and Electronics Engineers (IEEE)[DOI]
- BOUZAR-BENLABIOD, "RNN-VED for Reducing False Positive Alerts in Host-based Anomaly Detection Systems", 2020 IEEE 21st International Conferen ce on Information Reuse and Integration for Data Science (IRI), pp.17~24 (2020), IEEE
- Salem, M., "Anomaly generation using generative adversarial networks in host-based intrusion detection", 2018 9th IEEE Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEM CON), pp.683~687 (2018), IEEE
- SHIN, Yukyung, "Comparison of anomaly detection accuracy of host-ba sed intrusion detection systems based on different machine learning algorithms", Intern ational Journal of Advanced Computer Science and Applications (IJACSA), 11(2) (2020)