준 지도 이상 탐지 기법의 성능 향상을 위한 섭동을 활용한 초구 기반 비정상 데이터 증강 기법
Abnormal Data Augmentation Method Using Perturbation Based on Hypersphere for Semi-Supervised Anomaly Detection
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
최근 정상 데이터와 일부 비정상 데이터를 보유한 환경에서 딥러닝 기반 준 지도 학습 이상 탐지 기법이 매우 효과적으로 동작함이 알려져 있다. 하지만 사이버 보안 분야와 같이 실제 시스템에 대한 알려지지 않은 공격 등 비정상 데이터 확보가 어려운 환경에서는 비정상 데이터 부족이 발생할 가능성이 있다. 본 논문은 비정상 데이터가 정상 데이터보다 극히 작은 환경에서 준 지도 이상 탐지 기법에 적용 가능한 섭동을 활용한 초구 기반 비정상 데이터 증강 기법인 ADA-PH(Abnormal Data Augmentation Method using Perturbation based on Hypersphere)를 제안한다. ADA-PH는 정상 데이터를 잘 표현할 수 있는 초구의 중심으로부터 상대적으로 먼 거리에 위치한 샘플에 대해 적대적 섭동을 추가함으로써 비정상 데이터를 생성한다. 제안하는 기법은 비정상 데이터가 극소수로 존재하는 네트워크 침입 탐지 데이터셋에 대하여 데이터 증강을 수행하지 않았을 경우보다 평균적으로 23.63% 향상된 AUC가 도출되었고, 다른 증강 기법들과 비교했을 때 가장 높은 AUC가 또한 도출되었다. 또한, 실제 비정상 데이터에 유사한지에 대한 정량적 및 정성적 분석을 수행하였다.
Abstract
Recent works demonstrate that the semi-supervised anomaly detection method functions quite well in the environment with normal data and some anomalous data. However, abnormal data shortages can occur in an environment where it is difficult to reserve anomalous data, such as an unknown attack in the cyber security fields. In this paper, we propose ADA-PH(Abnormal Data Augmentation Method using Perturbation based on Hypersphere), a novel anomalous data augmentation method that is applicable in an environment where abnormal data is insufficient to secure the performance of the semi-supervised anomaly detection method. ADA-PH generates abnormal data by perturbing samples located relatively far from the center of the hypersphere. With the network intrusion detection datasets where abnormal data is rare, ADA-PH shows 23.63% higher AUC performance than anomaly detection without data augmentation and even performs better than the other augmentation methods. Also, we further conduct quantitative and qualitative analysis on whether generated abnormal data is anomalous.
참고문헌 (33)
- N. Shone, "A Deep Learning Approach to Network Intrusion Detection", IEEE Transactions on Emerging Topics in Computational Intelligence, 2(1), pp.41~50 (2018)
- J. Audibert, "USAD : UnSupervised Anomaly Detection on Multivariate Time Series", Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp.3395~3404 (2020)
- S. M. Anwar, "Medical Image Analysis using Convolutional Neural Networks : A Review", Journal of Medical Systems, 42(11), pp.226~ (2018)
- D. J. Atha, "Evaluation of deep learning approaches based on convolutional neural networks for corrosion detection", Structural Health Monitoring, 17(5), pp.1110~1128 (2018)
- D. Denning, "Requirements and model for IDES-a real-time intrusion-detection expert system", SRI International Menlo Park, 8 (1985)
- K. Ilgun, "State Transition Analysis : A Rule-Based Intrusion Detection Approach", IEEE Transactions on Software Engineering, 21(3), pp.181~199 (1995)
- B. Scholkopf, "Support Vector Method for Novelty Detection", Proceedings of the 12th Neural Information Processing Systems, pp.582~588 (1999)
- D. M. J. Tax, "Support Vector Data Description", Machine Learning, 54(1), pp.45~66 (2004)
- L. Ruff, "Deep One-Class Classification", Proceedings of the 35th International Conference on Machine Learning, 80, pp.4393~4402 (2018)
- D. Hendrycks, "Deep Anomaly Detection with Outlier Exposure", 7th International Conference on Learning Representations (2019)
- W. Yan, "Attack Detection for Securing Cyber Physical Systems", IEEE Internet of Things Journal, 6(5), pp.8471~8481 (2019)
- J. Wang, "Distributed Framework for Detecting PMU Data Manipulation Attacks With Deep Autoencoders", IEEE Transactions on Smart Grid, 10(4), pp.4401~4410 (2019)
- A. Liu, "SFE-GACN : A novel unknown attack detection under insufficient data via intra categories generation in embedding space", Computers and Security, 105, pp.102262~ (2021)
- I. J. Goodfellow, "Generative Adversarial Nets", Proceedings of the 27th Neural Information Processing Systems, pp.2672~2680 (2014)
- J. Lee, "GAN-based imbalanced data intrusion detection system", Personal and Ubiquitous Computing, 25(1), pp.121~128 (2021)
- I. J. Goodfellow, "Explaining and Harnessing Adversarial Examples", Proceedings of the 3rd International Conference on Learning Representations (2015)
- L. Ruff, "Deep Semi-Supervised Anomaly Detection", 8th International Conference on Learning Representations (2020)
- N. V. Chawla, "SMOTE : synthetic minority oversampling technique", Journal of Artificial Intelligence, 16, pp.321~357 (2002)
- T. Karras, "Training Generative Adversarial Networks with Limited Data", Advances in Neural Information Processing Systems, 33, pp.12104~12114 (2020)
- Z. Dai, "Good Semi-supervised Learning That Requires a Bad GAN", Proceedings of the 30th Neural Information Processing Systems, pp.6510~6520 (2017)
- P. Zheng, "One-Class Adversarial Nets for Fraud Detection", Proceedings of the AAAI Conference on Artificial Intelligence, 33, pp.1286~1293 (2019)
- S. T. K. Jan, "Throwing Darts in the Dark? Detecting Bots with Limited Data using Neural Data Augmentation", IEEE Symposium on Security and Privacy (SP), pp.1190~1206 (2020)
- T. Salimans, "Improved Techniques for Training GANs", Advances in Neural Information Processing Systems, 29 (2016)
- L. Mescheder, "Which training methods for GANs do actually converge?", International Conference on Machine Learning, pp.3481~3490 (2018)
- A. Madry, "Towards Deep Learning Models Resistant to Adversarial Attacks", Proceedings of the 6th International Conference on Learning Representations (2018)
- S. Goyal, "DROCC : Deep Robust One-Class Classification", Proceedings of the 37th International Conference on Machine Learning, 119, pp.3711~3721 (2020)
- G. Pang, "Deep learning for anomaly detection : A review", ACM Computing Surveys, 54(2), pp.1~38 (2022)
- I. Sharafaldin, "Toward generating a new intrusion detection dataset and intrusion traffic characterization", Proceedings of the 4th International Conference on Information Systems Security and Privacy, pp.108~116 (2018)
- A. Alsaedi, "TON_IoT telemetry dataset : A new generation dataset of IoT and IIoT for data-driven intrusion detection systems", IEEE Access, 8, pp.165130~165150 (2020)
- Y. Zhang, "Network Intrusion Detection : Based on Deep Hierarchical Network and Original Flow Data", IEEE Access, 7, pp.37004~37016 (2019)
- A. P. Bradley, "The use of the area under the ROC curve in the evaluation of machine learning algorithms", Pattern Recognition, 30(7), pp.1145~1159 (1997)
- S. Kullback, "On Information and Sufficiency", The Annals of Mathematical Statistics, 22(1), pp.79~86 (1951)
- L. van der Maaten, "Visualizing Data using t-SNE", Journal of Machine Learning Research, 9(86), pp.2579~2605 (2008)