KR101994528B1 - Method and Apparatus for Detection of Traffic Flooding Attacks using Time Series Analysis - Google Patents

Abstract

A method and an apparatus for detecting a traffic congestion attack using a time series technique are presented. The method of detecting a traffic congestion attack using the time series scheme according to the present invention includes the steps of converting a normal traffic flow and an abnormal traffic flow into a traffic time series pattern for detecting an abnormal intrusion attack and extracting characteristics of a traffic time series pattern, Calculating a Euclidean distance with respect to a traffic time series pattern using the extracted representative subsequence by learning a characteristic of the time series pattern and extracting representative subsequences by using the calculated Euclidean distance, And classifying the flow and the abnormal traffic flow.

Description

FIELD OF THE INVENTION [0001] The present invention relates to a method and apparatus for detecting a traffic congestion attack using a time series technique,

The present invention relates to a method and apparatus for classifying normal and abnormal traffic flows by converting traffic into time-series data for analysis.

Recently, as the IT technology becomes more popular, personalized services are provided to users through various technologies including prediction model design in various fields, and reliability of personal information including network security has been highlighted accordingly. In the network intrusion detection technology, there are two types of intrusion model. The anomaly based detection technique generates a profile of a user's general patterns and analyzes patterns deviating therefrom. Misuse Based Detection detects a pattern obtained from past intrusions To perform similar or similar pattern analysis.

DDoS (Distributed Denial of Service) attack, which is one kind of abnormal unauthorized intrusion that is analyzed by abnormal-based intrusion detection technology, creates a large number of zombie PC remotely and uses it to increase traffic exponentially, to be. In addition, the cases of traffic congestion attacks are continuously increasing and the size of the traffic congestion attacks is increasing. Therefore, an efficient detection technique for the abnormal intrusion attacks is required.

SUMMARY OF THE INVENTION The present invention is directed to a method and apparatus for detecting abnormal intrusion attacks by converting normal traffic flows and abnormal traffic flows into time series patterns and applying shapelets to the transformed time series data to detect abnormal intrusion attacks And to provide a method and an apparatus for performing the method.

In one aspect, a traffic congestion attack detection method using the time series scheme proposed in the present invention includes a step of converting a normal traffic flow and an abnormal traffic flow into a traffic time series pattern for detecting an abnormal intrusion attack, and extracting characteristics of a traffic time series pattern Extracting a representative subsequence by learning characteristics of the extracted traffic time series pattern, calculating an Euclidean distance with respect to a traffic time series pattern using the extracted representative subsequence, and calculating the Euclidean distance And classifying the normal traffic flow and the abnormal traffic flow.

The step of converting the normal traffic flow and the abnormal traffic flow into the traffic time series pattern and extracting the characteristics of the traffic time series pattern for the detection of the abnormal intrusion attack is performed in order to solve the problem of the decrease in the accuracy and the increase in the learning time according to the over- Technique to extract a predetermined number of upper features of the plurality of features of the data set of the traffic time series pattern.

In order to select a predetermined number of upper features among the plurality of features, entropy calculation is performed as a preprocessing process, and a predetermined number of upper features are extracted by using an information gain technique through difference between entropy of an upper node and entropy of a lower node do.

The step of calculating the Euclidean distance with respect to the traffic time series pattern using the extracted representative subsequence includes a Fast-Shapelet method to reduce the learning time and the test execution time of the Shapelets time series analysis technique, And generates a shaper that maximizes the distance between the normal traffic flow and the abnormal traffic flow through the Euclidean distance method.

The step of classifying the normal traffic flow and the abnormal traffic flow using the calculated Euclidean distance includes a step of classifying a binary classification based on a predetermined threshold between the shaper and the abnormal traffic flow generated in calculating the Euclidean distance Go ahead. How to Detect Peak Congestion Attacks.

According to another aspect of the present invention, there is provided a device for detecting a traffic congestion attack using a time series technique, which comprises: converting a normal traffic flow and an abnormal traffic flow into a traffic time series pattern for detecting an abnormal intrusion attack; A subsequence extracting unit for extracting a representative subsequence by learning the characteristics of the extracted traffic time series pattern, a subsequence extracting unit for extracting a representative subsequence from the extracted traffic subsequence, And a classifying unit classifying the normal traffic flow and the abnormal traffic flow using the calculated Euclidean distance.

The feature extraction unit extracts a predetermined number of upper features among a plurality of features of the data set of the traffic time series pattern using an information gain technique to solve the problem of reduction of the accuracy and increase of the learning time according to the over sum.

The feature extraction unit performs entropy calculation as a preprocessing process to select a predetermined number of upper features among a plurality of features and calculates a predetermined number of features by using an information gain technique through a difference between an entropy of an upper node and an entropy of a lower node Extract upper features.

The Euclidean distance calculator applied the Fast-Shapel technique to reduce the learning and test execution time of the Shapelets time series analysis technique and the normal traffic flow Create a schematic that maximizes the distance between the unhealthy traffic flows.

The classifier performs binary classification on the basis of a predetermined threshold between the shitlet generated in the step of calculating the Euclidean distance and the abnormal traffic flow.

According to the embodiments of the present invention, Shapelets time series analysis technique is applied to select an upper feature among a plurality of features to solve the problem of decrease in accuracy and increase in learning time according to over sum, In order to effectively reduce the learning and test execution time, the Euclidean distance method can classify the normal traffic flow and the abnormal traffic flow by generating a shaper that maximizes the distance between the normal traffic flow and the abnormal traffic flow.

1 is a flowchart illustrating a method for detecting a traffic congestion attack using a time series technique according to an embodiment of the present invention.
2 is a diagram for explaining a method of extracting characteristics of a traffic time series pattern according to an embodiment of the present invention.
3 is a view for explaining a shapelets technique according to an embodiment of the present invention.
4 is a diagram for explaining a subsequence extraction method according to an embodiment of the present invention.
5 is a diagram illustrating a configuration of a traffic congestion attack detection apparatus using a time series technique according to an embodiment of the present invention.
FIG. 6 is a graph showing the results of applying normal traffic and traffic congestion attacks and shaplets according to an exemplary embodiment of the present invention.

Intrusion detection technology can be classified into knowledge base / misuse detection and behavior based / abnormal behavior detection according to detection methods. Knowledge base / misuse detection sets patterns based on analysis results of specific attacks, and has the disadvantage of low false positives, but it can not detect new attacks and has a low detection rate. Behavior based / abnormal behavior detection has the disadvantage of detecting intrusion when sudden change is detected, enabling new attack detection, and using artificial intelligence algorithm, but high false positives.

In another aspect, intrusion detection techniques can be grouped into network packets and host log files depending on the data source. Network packets detect all traffic on the network, detect various types of intrusions, and have no server performance degradation. The host log file can be precisely protected against intrusion through various log data, and it can know the host connecting the source code. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a flowchart illustrating a method for detecting a traffic congestion attack using a time series technique according to an embodiment of the present invention.

A method for detecting a traffic congestion attack using a time series technique includes a step 110 of converting a normal traffic flow and an abnormal traffic flow into a traffic time series pattern and detecting characteristics of a traffic time series pattern for detecting an abnormal intrusion attack, A step 120 of extracting a representative subsequence by learning a characteristic of the time series pattern, a step 130 of calculating an Euclidean distance with respect to a traffic time series pattern using the extracted representative subsequence, And classifying the normal traffic flow and the abnormal traffic flow using the distance (step 140).

In step 110, the normal traffic flow and the abnormal traffic flow are converted into a traffic time series pattern for detecting an abnormal intrusion attack, and characteristics of the traffic time series pattern are extracted. To solve the problem of decreasing the accuracy and increasing the learning time according to the over-sum, an information gain method is used to extract a predetermined number of upper features among the plurality of features of the data set of the traffic time series pattern. In order to select a predetermined number of upper features among the plurality of features, entropy calculation is performed as a preprocessing process, and a predetermined number of upper features are extracted by using an information gain technique through difference between entropy of an upper node and entropy of a lower node do.

2 is a diagram for explaining a method of extracting characteristics of a traffic time series pattern according to an embodiment of the present invention.

The NSL-KDD data set according to an embodiment of the present invention is a refined version of the data set KDD CUP'99, which is part of the DARPA scheme, with four types of attacks: normal traffic packets and abnormal packets on the real network, . These four types of attacks include DoS, Probe, U2R, and R2L. Table 1 shows the packet distribution by attack type.

<Table 1>

It also supports data sets for learning and testing, and the characteristics of the data set include the contents of the network header, such as Protocol type, Service, src_byte, dst_byte, and access counts of host and guest logins. The proposed method focuses on traffic congestion attacks using shapelets based time series analysis and uses DoS attack traffic data set among four attack types.

Referring to FIG. 2, FIG. 2 (a) shows a comparison of the total number of learning data of normal packets and DoS, and FIG. 2 (b) shows the number of extracted feature data. As described above, in the prior art, 5 to 30 features are measured in 5 units based on a total of 41 features, and the accuracy of the over sum is decreased. Therefore, in the present invention, ten features are extracted to reduce learning time. This will be described in more detail below.

The training data set of the NSL-KDD according to the embodiment of the present invention is composed of 4,756,832 packets. In the case of intrusion detection, it is necessary to learn about the types of attacks added periodically in order to detect new attack types. Therefore, a method for reducing the execution time of learning is needed. In other words, when using all data sets, rather than overfitting, accuracy may be reduced and learning time may be increased.

In the present invention, in order to solve the problem of decreasing the accuracy and increasing the learning time according to over sum, the information gain method is applied to select the top 10 features among the 41 features and applied to the time-series analysis method Respectively.

The information gain technique means that the discrimination power of data increases due to the selection of a certain feature and is represented through the difference between the entropy (E (node1)) of the upper node and the entropy (E (node2)) of the lower node. The larger the result, the greater the information gain and the better the discrimination power. The entropy is calculated for each node, and the rank is assigned through the difference of the entropy of the lower node in the upper node. This can be expressed by the following equation.

Table 2 lists the top 10 information gains, which are features used in the present invention.

<Table 2>

In step 120, the representative subsequence is extracted by learning the characteristics of the extracted traffic time series pattern, and in step 130, the Euclidean distance to the traffic time series pattern is calculated using the extracted representative subsequence .

Shapelets Fast-Shapelet technique was applied to reduce the learning and testing time of the time series analysis technique. The distance between the normal traffic flow and the abnormal traffic flow was maximized through the Euclidean distance technique. As shown in FIG.

3 is a view for explaining a shapelets technique according to an embodiment of the present invention.

Referring to FIG. 3, the Shaplet technique is one of classification techniques for classifying a time series pattern using a subsequence extracted between time series patterns. In this case, by using representative subsequences extracted by learning a time series pattern, Calculate the distance. Thereafter, the calculated distance is determined to be normal and abnormal according to the criterion of the threshold value.

4 is a diagram for explaining a subsequence extraction method according to an embodiment of the present invention.

Referring to FIG. 4, a subsequence extraction method according to an embodiment of the present invention applies a sliding window technique to time series data. The distance between time series data T and R having the same length is calculated as follows.

이다. At this time, the relationship between the time series data and the subsequence

to be.

The distance between the time series data and the extracted subsequence is calculated as follows.

In step 140, the calculated Euclidean distance is used to classify the normal traffic flow and the abnormal traffic flow. The binary classification is performed on the basis of a predetermined threshold value between the shaper and the abnormal traffic flow generated in the step of calculating the Euclidean distance.

In other words, after generating the shillet through the Euclidean distance method in the normal traffic class and the abnormal traffic class, the classification is performed based on the threshold value of the abnormal traffic class and the generated shillet.

The Optimal Split Point (OSP) can be expressed as follows by the distance between the time series data and the extracted subsequence through the threshold value.

Where d _th represents the distance threshold.

와 같고, 쉐이플릿 전체 후보는

이다. Shaflet Candidate

, And all candidates for the Shiflet

to be.

In the method for detecting an abnormal suspicion based on the time series statistic based on the prior art, a threshold value is set based on a characteristic value of a network time series data for each user IP, and then a normal value and an abnormal value are distinguished based on a threshold value. On the other hand, the proposed method calculates the subsequence of the time series data rather than the threshold method, and distinguishes the normal data from the abnormal data.

The traffic pattern analysis and entropy prediction method for detecting malware in the network environment of the related art determines the probability of whether the PAS infects malware through entropy. On the other hand, in the proposed method, the entropy calculation is a preprocessing process for extracting the feature, and by calculating the information gain through the difference between the entropy of the upper node and the entropy of the lower node, It is used as an extraction method.

The prior art network anomaly detection apparatus and method determine anomalous network anomaly through entropy calculated based on an IP address or a corresponding port number. On the other hand, in the proposed method, the part using entropy is used as a method for extracting the feature, and the execution time can be shortened by reducing the feature through this method.

5 is a diagram illustrating a configuration of a traffic congestion attack detection apparatus using a time series technique according to an embodiment of the present invention.

The traffic congestion detection apparatus 500 using the proposed time series scheme includes a feature extraction unit 510, a subsequence extraction unit 520, an Euclidean distance calculation unit 530, and a classification unit 540.

The feature extraction unit 510 converts the normal traffic flow and the abnormal traffic flow into a traffic time series pattern for detecting an abnormal intrusion attack and extracts characteristics of the traffic time series pattern. To solve the problem of decreasing the accuracy and increasing the learning time according to the over-sum, an information gain method is used to extract a predetermined number of upper features among the plurality of features of the data set of the traffic time series pattern. In order to select a predetermined number of upper features among the plurality of features, entropy calculation is performed as a preprocessing process, and a predetermined number of upper features are extracted by using an information gain technique through difference between entropy of an upper node and entropy of a lower node do.

The NSL-KDD data set according to an embodiment of the present invention is a refined version of the data set KDD CUP'99, which is part of the DARPA scheme, with four types of attacks: normal traffic packets and abnormal packets on the real network, . These four types of attacks include DoS, Probe, U2R, and R2L.

It also supports data sets for learning and testing, and the characteristics of the data set include the contents of the network header, such as Protocol type, Service, src_byte, dst_byte, and access counts of host and guest logins. The proposed method focuses on traffic congestion attacks using shapelets based time series analysis and uses DoS attack traffic data set among four attack types.

Referring to FIG. 2, FIG. 2 (a) shows a comparison of the total number of learning data of normal packets and DoS, and FIG. 2 (b) shows the number of extracted feature data. As described above, in the prior art, 5 to 30 features are measured in 5 units based on a total of 41 features, and the accuracy of the over sum is decreased. Therefore, in the present invention, ten features are extracted to reduce learning time. This will be described in more detail below.

The training data set of the NSL-KDD according to the embodiment of the present invention is composed of 4,756,832 packets. In the case of intrusion detection, it is necessary to learn about the types of attacks added periodically in order to detect new attack types. Therefore, a method for reducing the execution time of learning is needed. In other words, when using all data sets, rather than overfitting, accuracy may be reduced and learning time may be increased.

In the present invention, in order to solve the problem of decreasing the accuracy and increasing the learning time according to over sum, the information gain method is applied to select the top 10 features among the 41 features and applied to the time-series analysis method Respectively.

The subsequence extractor 520 extracts a representative subsequence by learning the characteristics of the extracted traffic time series pattern, and the euclidean distance calculator 530 calculates an euclidean distance by using the extracted representative subsequence, Calculate the Euclidean distance.

Shapelets Fast-Shapelet technique was applied to reduce the learning and testing time of the time series analysis technique. The distance between the normal traffic flow and the abnormal traffic flow was maximized through the Euclidean distance technique. As shown in FIG.

Referring to FIG. 3, the Shaplet technique is one of classification techniques for classifying a time series pattern using a subsequence extracted between time series patterns. In this case, by using a representative subsequence extracted by learning a time series pattern, Calculate the distance. Thereafter, the calculated distance is determined to be normal and abnormal according to the criterion of the threshold value.

Referring to FIG. 4, a subsequence extraction method according to an embodiment of the present invention applies a sliding window technique to time series data.

The classifying unit 540 classifies the normal traffic flow and the abnormal traffic flow using the calculated Euclidean distance. The binary classification is performed on the basis of a predetermined threshold value between the shaper and the abnormal traffic flow generated in the step of calculating the Euclidean distance.

In other words, after generating the shillet through the Euclidean distance method in the normal traffic class and the abnormal traffic class, the classification is performed based on the threshold value of the abnormal traffic class and the generated shillet.

FIG. 6 is a graph showing the results of applying normal traffic and traffic congestion attacks and shaplets according to an exemplary embodiment of the present invention.

Referring to FIG. 6, each characteristic is set as an x-axis, and a packet value is represented on the y-axis.

Experiments according to embodiments of the present invention were performed in an Intel Core i5-4690 3.5 GHz, 8 GB RAM environment. The data used in the experiment is the NSL-KDD data set, and the classification part for packet classification uses the Shaplet.

Table 3 shows the metrics for the classification of normal and abnormal packets.

<Table 3>

As a measure of the classification accuracy, Precision, which is the distribution of the normal packets among the classes classified as normal packets through the generated shuffle, Recall which is the classification distribution of the normal packets, True Positive Rate (TPR) Classification Accuracy was used.

Table 4 shows the execution time of the learning by reducing the number of features through information gain.

<Table 4>

As a result of reducing the number of features, it is confirmed that the performance improvement is about 25 times higher than the execution time using all 41 features.

A security system is an important measure of the reliability and validity of a host that supports a service. In the present invention, Shaplet technique is proposed as a technique for detection of abnormal traffic based on traffic congestion attack, and about 95% classification accuracy is confirmed. Also, it is confirmed that there is a 25 times improvement in performance time by reducing the number of features.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable array (FPA) A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device As shown in FIG. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI &gt; or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (10)

Transforming the normal traffic flow and the abnormal traffic flow into a traffic time series pattern and detecting characteristics of the traffic time series pattern to detect an abnormal intrusion attack;
Extracting a representative subsequence by learning features of the extracted traffic time series pattern;
Calculating an Euclidean distance for a traffic time series pattern using the extracted representative subsequence; And
Classifying the normal traffic flow and the abnormal traffic flow using the calculated Euclidean distance;
Lt; / RTI &gt;
Wherein the step of converting the normal traffic flow and the abnormal traffic flow into the traffic time series pattern for detecting the abnormal intrusion attack and extracting characteristics of the traffic time series pattern includes:
We focus on traffic congestion attack using shapelets based time series analysis technique and use DoS attack traffic data set among multiple attack types. In order to solve the problem of decrease in accuracy and learning time according to over sum, information gain Extracting a predetermined number of upper features of the plurality of features of the data set of the traffic time series pattern and performing entropy calculation as a preprocessing process to select a predetermined number of upper features of the plurality of features, And the difference between the entropy of the lower node and the entropy of the lower node, thereby extracting a predetermined number of upper features
Detection of traffic congestion attack. delete delete The method according to claim 1,
Wherein the step of calculating the Euclidean distance with respect to the traffic time series pattern using the extracted representative subsequence comprises:
Shapelets Fast-Shapelet technique was applied to reduce the learning and testing time of the time series analysis technique. The distance between the normal traffic flow and the abnormal traffic flow was maximized through the Euclidean distance technique. To create a shipp
Detection of traffic congestion attack. 5. The method of claim 4,
Classifying the normal traffic flow and the abnormal traffic flow using the calculated Euclidean distance,
The binary classification is performed on the basis of a predetermined threshold value between the shuffle and the abnormal traffic flow generated in the step of calculating the Euclidean distance
Detection of traffic congestion attack. A feature extraction unit for converting a normal traffic flow and an abnormal traffic flow into a traffic time series pattern for detecting an abnormal intrusion attack and extracting characteristics of a traffic time series pattern;
A subsequence extracting unit for extracting a representative subsequence by learning features of the extracted traffic time series pattern;
An Euclidean distance calculating unit for calculating an Euclidean distance with respect to a traffic time series pattern using the extracted representative subsequence; And
And classifying the normal traffic flow and the abnormal traffic flow using the calculated Euclidean distance,
Lt; / RTI &gt;
The feature extraction unit,
We focus on traffic congestion attack using shapelets based time series analysis technique and use DoS attack traffic data set among multiple attack types. In order to solve the problem of decrease in accuracy and learning time according to over sum, information gain Extracting a predetermined number of upper features of the plurality of features of the data set of the traffic time series pattern and performing entropy calculation as a preprocessing process to select a predetermined number of upper features of the plurality of features, And the difference between the entropy of the lower node and the entropy of the lower node, thereby extracting a predetermined number of upper features
Traffic congestion attack detection device. delete delete The method according to claim 6,
The euclidean distance calculator may calculate,
Shapelets Fast-Shapelet technique was applied to reduce the learning and testing time of the time series analysis technique. The distance between the normal traffic flow and the abnormal traffic flow was maximized through the Euclidean distance technique. To create a shipp
Traffic congestion attack detection device. 10. The method of claim 9,
Wherein,
The binary classification is performed on the basis of a predetermined threshold value between the shuffle and the abnormal traffic flow generated in the step of calculating the Euclidean distance
Traffic congestion attack detection device.

Images