KR101383069B1 - Apparatus and method for detecting anomalous state of network - Google Patents

Abstract

The present invention relates to a device and a method for detecting network abnormality using cluster information and visually showing the detected result. For this purpose, the device for detecting network abnormality of the present invention includes: a packet collection unit for collecting packets transmitted and received in a network; a packet analysis unit for extracting predetermined attribute values of the packets, and generating attribute value vectors by vectorizing the attribute values; a grouping unit for generating a plurality of groups by grouping the attribute value vectors with predetermined size and interval; a clustering unit for generating clusters by clustering the groups; a cluster analysis unit for concluding analysis data by analyzing the clusters; and a determination unit for determining a state of the network based on the analysis data. [Reference numerals] (110) Packet collection unit; (120) Packet analysis unit; (130) Grouping unit; (140) Clustering unit; (150) Visualization unit; (160) Cluster analysis unit; (170) Determination unit

Description

Apparatus and method for detecting network abnormality {APPARATUS AND METHOD FOR DETECTING ANOMALOUS STATE OF NETWORK}

The present invention relates to an apparatus and method for detecting an abnormal state of a network, and more particularly, the present invention relates to an apparatus and a method for detecting an abnormal state of a network using cluster information and visually showing a detection result. will be.

Most intrusion detection systems for cyber attacks have been judged for attack by judging whether or not the rule is appropriate, based on the rule that defines the pattern of attack. However, as more various attacks appeared and techniques to evade detection and defense techniques appeared, the rules for detecting them increased. As a result, an overload occurs in searching and comparing these rules, rather than an algorithm for determining whether the rules are reasonable, and thus requires a high specification system.

As a way to solve this problem, a machine learning-based fault detection system has been proposed that can classify new data by learning previous empirical data. Such systems differ greatly in classification accuracy and computation speed depending on how to analyze data for learning, classification algorithms to classify normality, and how each module is configured. In addition, such a machine learning-based system has a disadvantage in that there are more malfunctions that determine that the normal is abnormal than the rule-based intrusion detection system.

In addition, the machine learning-based intrusion detection system analyzes only one packet in the network traffic, and uses the analysis result as one object to determine whether it is normal based on a sequential set of objects. However, this method is simply a method for determining whether a packet is an attack or a normal one, and it is unreasonable to determine whether the state of the network to be protected is unstable, that is, whether the network characteristic has changed due to the attack.

In this regard, there is a Korean Patent No. 0974888 entitled "Abnormal traffic detection apparatus and method".

An object of the present invention is to provide an apparatus and method for modeling a state of a network and determining whether the network state is normal based on the model.

Another object of the present invention is to provide an apparatus and method for visualizing a state of a state of a network, and more accurately determining a state of a network through monitoring of a user.

Network abnormality detection device of the present invention for solving the above problems is a packet collection unit for collecting packets transmitted and received in the network; A packet analyzer extracting predetermined attribute values of packets and vectorizing attribute values to generate attribute value vectors; A grouping unit for generating a plurality of groups by grouping the attribute value vectors at a predetermined size and interval; A clustering unit generating clusters by performing clustering on groups; A cluster analyzer for analyzing clusters and deriving analysis data; And based on the analysis data, characterized in that it comprises a determination unit for determining the state of the network.

In addition, the clustering unit may further generate cluster information indicating state information about the clusters.

In addition, the network abnormality detection apparatus of the present invention may further include a visualization unit for visualizing the cluster information to the user.

In addition, the cluster analyzer may analyze the group included in the clusters to generate analysis data.

In addition, the determination unit may determine the state of the network by comparing the normal data and the analysis data when the network is in a normal state.

Network abnormality detection method of the present invention for solving the above problems, the packet collecting unit, collecting the packets transmitted and received in the network; Extracting, by the packet analyzer, predetermined attribute values of the packets; Generating, by the packet analyzer, attribute value vectors by vectorizing the attribute values; Generating, by the grouping unit, the plurality of groups by grouping the attribute value vectors at a predetermined size and interval; Generating clusters by performing clustering on groups by the clustering unit; Analyzing, by the cluster analyzer, clusters to derive analysis data; And determining, by the determining unit, the state of the network based on the analysis data.

In addition, generating the clustering may further generate cluster information indicating state information about the clusters.

The network abnormality detection method of the present invention may further include visualizing cluster information to a user by a visualization unit after generating clusters.

In addition, the deriving analysis data may generate analysis data by performing analysis on a group included in the clusters.

In the determining of the state of the network, the state of the network may be determined by comparing normal data with analysis data when the network is in a normal state.

According to the network abnormality detection apparatus and method of the present invention, it is possible to determine the state of the current network, and it is possible to know whether the network is damaged by various types of attacks as well as a specific network attack.

In addition, according to the network abnormality detection apparatus and method of the present invention, by the user's participation through the visualization unit, there is an effect that can more accurately detect the abnormal state of the system.

1 is a block diagram of a network abnormality detection apparatus according to an embodiment of the present invention.
2 is a diagram illustrating a grouping process of packets performed by a grouping unit included in a network abnormality detection apparatus of the present invention.
3 is a flowchart illustrating a network abnormality detection method according to an embodiment of the present invention.

The present invention will now be described in detail with reference to the accompanying drawings. Hereinafter, a repeated description, a known function that may obscure the gist of the present invention, and a detailed description of the configuration will be omitted. Embodiments of the present invention are provided to more fully describe the present invention to those skilled in the art. Accordingly, the shapes and sizes of the elements in the drawings and the like can be exaggerated for clarity.

Hereinafter, a network abnormality detection apparatus according to an exemplary embodiment of the present invention will be described with reference to FIG. 1. 1 is a block diagram of a network abnormality detection apparatus 100 according to an embodiment of the present invention. As shown in FIG. 1, the network abnormality detection apparatus 100 of the present invention includes a packet collecting unit 110, a packet analyzing unit 120, a grouping unit 130, a clustering unit 140, and a visualization unit 150. ), The cluster analyzer 160 and the determiner 170. Description of each configuration of the network abnormality detection device 100 of the present invention is made in detail below.

The packet collecting unit 110 collects packets transmitted and received in a network, specifically, a network to be protected. Here, the packet collector 110 may correspond to a gateway of a network.

The packet analyzer 120 extracts attribute values for a predetermined attribute from the packets collected by the packet collector 110 and vectorizes the extracted attribute values. Here, the extracted attribute values may include information for determining the order or timing of the packets, for example, a time difference from a previous packet. In addition, the extracted attribute values may include information about a source and a destination, for example, a source address, a destination address, an IP address difference value between a source and a destination, and a destination port. In addition, the extracted attribute values may include information for error analysis, size change, and attack determination of a packet, for example, window size, sequence number, and information on a top protocol. Such property values can facilitate the determination of a service attack. For example, if a denial of service attack occurs, the number of packets sent to a particular IP and port intended by the attacker may increase dramatically, and the number of IP address differences between the source and destination stored within one attribute value vector may be the same. Based on the evidence, the judgment about the service attack can be performed. Through such vectorization, the packet analyzer 120 generates attribute value vectors based on the extracted attribute values.

The grouping unit 130 functions to group the attribute value vectors at a predetermined size and interval. Here, the grouping of the attribute value vectors through the grouping unit 130 is because the packet is the smallest unit constituting the data block, so it is not clear which data is composed of only one packet. Here, the size of the generated group may be set by the number of packets or the time interval at which the packets are collected. In addition, the group interval may be designated by the size of the group such as the number of packets or the time. Through this process, the grouping unit 130 generates a plurality of groups for the attribute value vectors.

In this way, each group may be generated for each predetermined time interval, such as at a time point of the packet, for example, between 9 am and 9: 5 am. Through this, the network abnormality detection apparatus 100 of the present invention may classify the packets transmitted and received in the network by time or period.

The clustering unit 140 functions to perform clustering on the groups generated by the grouping unit 130. Through this, the clustering unit 140 generates clusters for the groups. In addition, the clustering unit 140 further generates cluster information about the clusters. Here, the cluster information is the basis for determining the network state including attribute information about the cluster. For example, the cluster information may include information for determining state information of the network for the corresponding time point. That is, the cluster information may include the total number of packets included in the cluster, the average of the packets constituting the group of the cluster, and the standard deviation of the packets constituting the group of the cluster for a specific time point. Therefore, the state of the network can be determined at a glance through the cluster information. Based on this feature, cluster information may be referred to herein as a network snapshot.

The visualization unit 150 functions to visualize cluster information generated by the clustering unit 140. As mentioned above, the cluster information may be the basis for determining the current state of the network. By visualizing the cluster information to the user, the user can directly determine whether the network abnormality. Through this, the error that may occur in determining whether the network is abnormal can be significantly improved.

The cluster analyzer 160 analyzes the clusters to derive analysis data. For example, the cluster analyzer 160 may analyze attribute value vectors for packets of each of the clusters and determine whether the packets are damaged or attacked. In addition, the cluster analyzer 160 may derive analysis data by analyzing the groups included in the clusters. In addition, the cluster analyzer 160 may derive the analysis data based on the flow of the clusters, that is, the generation order or flow order of the clusters.

The determiner 170 determines a state of the network based on the analysis data generated by the cluster analyzer 160. That is, the determination unit 170 may determine the state of the network by comparing the normal data and the analysis data when the network is in the normal state. For example, the determination unit 170 may determine the network state by comparing the groups included in the clusters with the groups included in the clusters at the present time in the normal state. Here, when an abnormal state of the network is detected, a warning or notification message may be transmitted to the user. In this way, the user can immediately recognize the abnormal state of the network and can immediately respond.

2 is a diagram illustrating a grouping process of packets performed by a grouping unit included in a network abnormality detection apparatus of the present invention. As mentioned with reference to FIG. 1, the grouping unit functions to group attribute value vectors at a predetermined size and interval.

Referring to FIG. 2, an example of grouping network traffic 21 collected and vectorized through a packet collector and a packet analyzer of a network abnormality detection apparatus of the present invention is shown. In this example, it is assumed that the size of the group is seven, and the group interval is three. As described with reference to FIG. 1, it should be understood that the number of sizes and intervals of such groups is not limited thereto and may be set in time in addition to the number of packets.

As shown in FIG. 2, the first group 22 is packet 1 to packet 7, the second group 23 is packet 4 to packet 10, the third group 24 is packet 7 to packet 13, The fourth group 25 may consist of packets 10 to 16 and the fifth group 26 may consist of packets 13 to 19. The groups having the predetermined size and interval are each characterized based on the attribute value vector of the packets. In addition, as shown in FIG. 2, in order to evaluate a network state at a specific time point, front and rear packets of a packet corresponding to the time point may be generated as a group. It should be understood that the example of grouping described with reference to FIG. 2 is merely an example, and that grouping may be performed in various ways.

Hereinafter, a network abnormality detection method according to an embodiment of the present invention will be further described with reference to FIG. 3. 3 is a flowchart illustrating a network abnormality detection method according to an embodiment of the present invention. In the following description, portions that overlap with those described with reference to FIGS. 1 and 2 are omitted for clarity of specification.

The packet collecting unit collects the packets transmitted and received in the network (S301).

Thereafter, the step S302 of extracting predetermined attribute values of the packets is performed by the packet analyzer. Here, the extracted attribute values may include, for example, information capable of determining the order or timing of the packets, information on the origin and destination of the packet, error analysis on the packet, information on size change and attack determination, and the like. Can be.

Thereafter, a step S303 of generating attribute value vectors by vectorizing the attribute values is performed by the packet analyzer.

Thereafter, step S304 is performed by grouping the attribute value vectors by a predetermined size and interval to generate a plurality of groups. As mentioned with reference to FIG. 1, the size and interval for a group here may be set for the number of packets or for the time interval over which packets were collected.

Thereafter, the clustering unit performs clustering on groups to generate clusters (S305).

Thereafter, a step S306 of generating cluster information for the cluster generated in step S305 is performed by the clustering unit. Here, the cluster information is the basis for determining the state of the network, including attribute information for the cluster, as described above with reference to FIG. 1. In addition, since cluster information is described in detail with reference to FIG. 1, it is omitted here.

Thereafter, a step S307 of determining whether visualization of cluster information generated in step S306 is necessary is performed. In step S307, if it is determined that the visualization of the cluster information is necessary, control is passed to step S312, otherwise control is passed to step S308.

In step S308, the cluster analysis unit analyzes the clusters to derive analysis data. Specifically, step S308 derives analysis data by analyzing the groups included in the clusters.

Thereafter, the determination unit determines the state of the network based on the analysis data derived in step S308 (S309). In detail, in operation S309, the state of the network may be determined by comparing normal data with analysis data when the network is in a normal state.

Thereafter, based on the result derived in step S309, determining whether the network is in a normal state (S310) is performed. In step S310, if the network is determined to be in the normal state, control is passed to the end block. If not, control passes to step S311, informing the user of an abnormal condition of the network. In step S311, when the user is notified, control is passed to the end block.

The step S312 is performed when the visualization of the cluster information is requested in step S307, and serves to visualize the cluster information generated in the step S306. As mentioned above, the cluster information may be the basis for determining the current state of the network. By visualizing the cluster information to the user, the user can directly determine whether the network abnormality.

The teachings of the principles of the present invention may be implemented as a combination of hardware and software. In addition, the software can be implemented as an application program that is actually implemented on the program storage unit. The application program can be uploaded to and executed by a machine that includes any suitable architecture. Preferably, the machine may be implemented on a computer platform having hardware such as one or more central processing units (CPUs), computer processors, random access memory (RAM), and input / output (I / O) interfaces. . In addition, the computer platform may include an operating system and microinstruction code. The various processes and functions described herein may be part of microcommand codes or a portion of an application program, or any combination thereof, and they may be executed by various processing devices including a CPU. In addition, various other peripheral devices such as additional data storage and printers may be connected to the computer platform.

It is to be understood that the actual connections between system components or process functional blocks may vary depending on how the principles of the present invention are programmed, as some of the constituent system components and methods illustrated in the accompanying drawings are preferably implemented in software It should be further understood. Given the teachings herein, those skilled in the relevant art (s) will be able to contemplate these and similar implementations or configurations of the principles of the invention.

While illustrative embodiments have been described herein in connection with the accompanying drawings, the principles of the invention are not limited to these precise embodiments, and various changes and modifications may be made without departing from the scope or spirit of the principles of the invention. It should be understood that it may be performed by those skilled in the art. All such changes and modifications are intended to be included within the scope of the principles of the invention as set forth in the appended claims.

As described above, an optimal embodiment has been disclosed in the drawings and specification. Although specific terms have been employed herein, they are used for purposes of illustration only and are not intended to limit the scope of the invention as defined in the claims or the claims. Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible from this. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

100: network abnormality detection device
110: packet collection unit 120: packet analysis unit
130: grouping unit 140: clustering unit
150: visualization unit 160: correlation analysis unit
170: judgment unit

Claims (10)

A packet collecting unit collecting packets transmitted and received in a network;
A packet analyzer extracting predetermined attribute values of the packets and vectorizing the attribute values to generate attribute value vectors;
A grouping unit for generating a plurality of groups by grouping the attribute value vectors at a predetermined size and interval;
A clustering unit generating clusters by performing clustering on the groups;
A cluster analyzer for analyzing the clusters to derive analysis data; And
And a determination unit to determine a state of the network based on the analysis data. The method of claim 1,
The clustering unit,
And generating cluster information indicating the state information of the clusters. 3. The method of claim 2,
The network abnormality detection apparatus, further comprising a visualization unit for visualizing the cluster information to the user. The method of claim 1,
The cluster analysis unit,
And analyzing the groups included in the clusters to generate the analysis data. The method of claim 1,
Wherein,
And determining the state of the network by comparing the normal data and the analysis data when the network is in a normal state. Collecting, by the packet collecting unit, packets transmitted and received in the network;
Extracting, by a packet analyzer, predetermined attribute values of the packets;
Generating, by the packet analyzer, attribute value vectors by vectorizing the attribute values;
Generating a plurality of groups by grouping the attribute value vectors by a predetermined size and interval by a grouping unit;
Generating clusters by performing clustering on the groups by a clustering unit;
Analyzing, by the cluster analyzer, clusters to derive analysis data; And
And determining, by the determining unit, the state of the network based on the analysis data. The method according to claim 6,
Wherein generating the clusters comprises:
And generating cluster information indicating the status information of the clusters. 8. The method of claim 7,
After creating the clusters,
And visualizing, by the visualization unit, the cluster information to the user. The method according to claim 6,
Deriving the analysis data,
And analyzing the groups included in the clusters to generate the analysis data. The method according to claim 6,
Determining the state of the network,
And determining a state of the network by comparing normal data with the analysis data when the network is in a normal state.

Images