KR102152403B1 - Apparatus and method for detecting abnormal behavior using data pattern analysis - Google Patents

Abstract

A method of detecting abnormal behavior using data pattern analysis, the method comprising: receiving N pieces of acquired data each including a plurality of data points, at least one of a data change amount of the plurality of data points, an increase/decrease, and a distribution section Performing pre-processing of the N pieces of acquired data according to, generating an association rule between at least two or more data points among a plurality of data points by comparing the pre-processed N pieces of acquired data, included in the generated association rule The method may include generating an artificial neural network model using the generated feature as an input, and predicting the N+1th acquired data using the generated artificial neural network.

Description

Abnormal behavior detection device and method using data pattern analysis {APPARATUS AND METHOD FOR DETECTING ABNORMAL BEHAVIOR USING DATA PATTERN ANALYSIS}

The present application relates to an apparatus and method for detecting abnormal behavior using data pattern analysis.

Malware refers to software that is produced with a malicious purpose and has an adverse effect on the computer, and malicious codes targeting industrial control systems such as CrashOverride and Triton are advanced and comply with the protocols of the industrial control system. It is becoming difficult to detect with the detection technique of.

In addition, experimental research that detects abnormal behaviors based on various machine learning and artificial intelligence is composed of the learning process and learning results that proceed after selecting the features of the data in a black box format, making it difficult to interpret the process and results. There is a problem that it is difficult to introduce the site due to difficult maintenance.

The technology behind the present application is disclosed in Korean Patent Publication No. 10-1880686.

The present application is to solve the problems of the prior art described above, by generating an association rule through pattern analysis between various data having various types, ranges, and types of change, and inputting each association rule into an artificial neural network. Data value or change in the next acquired data is predicted, and an alarm occurs when a difference occurs between the predicted value and the actual value through the artificial neural network model, making the result analysis easy and highly intuitive data pattern analysis. It aims to provide an apparatus and method for detecting abnormal behavior using

However, the technical problem to be achieved by the embodiments of the present application is not limited to the technical problems as described above, and other technical problems may exist.

As a technical means for achieving the above technical problem, an abnormal behavior detection method using data pattern analysis according to an embodiment of the present application includes the steps of receiving N pieces of acquired data each including a plurality of data points, the plurality of Pre-processing of the N pieces of acquired data according to at least one of a data change amount, increase/decrease, and distribution interval of the data points of, and at least two of a plurality of data points by comparing the pre-processed N acquired data Generating an association rule between the above data points, generating an artificial neural network model that takes features included in the generated association rule as inputs, and predicting the N+1th acquisition data using the generated artificial neural network It may include steps.

In addition, the step of generating the association rule in the abnormal behavior detection method using data pattern analysis according to an embodiment of the present application includes a pattern of change of the at least two or more data points included in the preprocessed N pieces of acquired data. At least one or more association rules may be generated by using.

In addition, in the method for detecting anomalous behavior using data pattern analysis according to an embodiment of the present application, generating the association rule includes, among a plurality of data points included in the preprocessed N pieces of acquired data, the at least two or more data When the rate of occurrence of the pattern of change of points is greater than or equal to a preset threshold value, the pattern of change of the at least two data points may be generated as the association rule.

In addition, in the method for detecting abnormal behavior using data pattern analysis according to an embodiment of the present application, the artificial neural network model may be a recurrent neural network model.

In addition, the step of generating the artificial neural network model in the abnormal behavior detection method using data pattern analysis according to an embodiment of the present application generates an artificial neural network model corresponding to each of a plurality of association rules, and the N+1 th In the predicting of acquired data, a data point included in the N+1 th acquired data linked to the association rule may be predicted using each artificial neural network generated for each association rule.

In addition, an abnormal behavior detection method using data pattern analysis according to an embodiment of the present application includes receiving the N+1 th acquisition data including a plurality of data points, and the predicted N predicted using the artificial neural network. It may further include the step of determining an abnormal behavior for the received N+1 th acquired data by comparing the +1 th acquired data with the received N+1 th acquired data.

In addition, in the method for detecting abnormal behavior using data pattern analysis according to an exemplary embodiment of the present application, the step of determining abnormal behavior for the received N+1 th acquired data may be included in the predicted N+1 th acquired data. When the error range generated by comparing the data point with the data point included in the received N+1 th acquired data is equal to or greater than a preset threshold value, generating an alarm.

On the other hand, the apparatus for detecting abnormal behavior using data pattern analysis according to an embodiment of the present application includes a communication unit for receiving N pieces of acquired data each including a plurality of data points, and an increase/decrease in data change amount of the plurality of data points. A data pre-processing unit that performs pre-processing of the N acquired data according to at least one of whether or not and a distribution section, and generates an association rule between at least two or more data points among a plurality of data points by comparing the pre-processed N acquired data A rule generation unit that generates a rule generation unit, a model generation unit that generates an artificial neural network model that receives features included in the generated association rule as inputs, and a data prediction unit that predicts the N+1th acquisition data using the generated artificial neural network. can do.

In addition, the apparatus for detecting abnormal behavior using data pattern analysis according to an embodiment of the present disclosure compares the predicted N+1th acquisition data predicted through the artificial neural network with the received N+1th acquisition data to receive the An abnormal behavior determination unit for determining abnormal behavior with respect to the obtained N+1 th acquired data may be further included, and the communication unit may receive the received N+1 th acquired data including a plurality of data points.

In addition, in the abnormal behavior detection apparatus using data pattern analysis according to an embodiment of the present application, the abnormal behavior determination unit is included in the data points included in the predicted N+1 th acquired data and the received N+1 th acquired data. An alarm sensor that generates an alarm when an error range generated by comparing the data points is equal to or greater than a preset threshold value may be included.

The above-described problem solving means are merely exemplary and should not be construed as limiting the present application. In addition to the above-described exemplary embodiments, additional embodiments may exist in the drawings and detailed description of the invention.

According to the above-described problem solving means of the present application, an association rule is generated through pattern analysis between various types and various data, and then obtained by inputting each association rule into a Many-to-One artificial neural network (RNN model). The value of the data point according to each association rule in the data is predicted, and a notification is generated when a difference occurs between the predicted value and the actual value through the model, thereby making it easy to interpret the data result value.

According to the above-described problem solving means of the present application, by using a model that detects abnormal behavior by generating a recurrent neural network (RNN)-based model that generates association rules between acquired data and predicts next data between related data, intuitiveness It is excellent in that it has the effect of easy maintenance and repair from the standpoint of a security manager.

However, the effect obtainable in the present application is not limited to the effects as described above, and other effects may exist.

1 is a diagram schematically showing an overall system of an abnormal behavior detection apparatus using data pattern analysis according to an embodiment of the present application.
2 is a schematic block diagram of an apparatus for detecting abnormal behavior using data pattern analysis according to an embodiment of the present application.
3 is a schematic exemplary flowchart illustrating an operation of an abnormal behavior detection apparatus using data pattern analysis according to an embodiment of the present application.
4 is a flowchart illustrating an operation of an abnormal behavior detection method using data pattern analysis according to an exemplary embodiment of the present application.

Hereinafter, exemplary embodiments of the present application will be described in detail with reference to the accompanying drawings so that those of ordinary skill in the art may easily implement the present application. However, the present application may be implemented in various different forms and is not limited to the embodiments described herein. In addition, in the drawings, parts not related to the description are omitted in order to clearly describe the present application, and similar reference numerals are attached to similar parts throughout the specification.

Throughout the present specification, when a part is said to be "connected" with another part, it is not only "directly connected", but also "electrically connected" or "indirectly connected" with another element interposed therebetween. "Including the case.

Throughout this specification, when a member is positioned "on", "upper", "upper", "under", "lower", and "lower" of another member, this means that a member is located on another member. It includes not only the case where they are in contact but also the case where another member exists between the two members.

Throughout the specification of the present application, when a certain part "includes" a certain component, it means that other components may be further included rather than excluding other components unless specifically stated to the contrary.

The apparatus for detecting abnormal behavior using data pattern analysis according to an embodiment of the present application generates an association rule between acquired data, and uses a recurrent neural network (RNN)-based model that predicts next data between acquired data. It relates to a model that generates and detects abnormal behavior. The generated association rule can be used not only as a security rule, but also uses a data set that is related through the association rule as input data of the RNN, and generates the next expected data as the output of the RNN. Therefore, the proposed method and model are highly intuitive and can be easily maintained and repaired from the perspective of a security administrator.

1 is a diagram schematically showing the overall system of an abnormal behavior detection apparatus using data pattern analysis according to an embodiment of the present application, and FIG. 2 is a schematic diagram of an abnormal behavior detection apparatus using data pattern analysis according to an exemplary embodiment of the present application It is a block diagram.

1 and 2, the abnormal behavior detection apparatus 200 using data pattern analysis receives N pieces of acquired data each including a plurality of data points from the database 100, and pre-processes data and a related rule. It can perform operations to detect abnormal behavior such as generation, artificial neural network model generation, and abnormal behavior determination. The database 100 may collect and store a plurality of data including N pieces of acquired data, and the abnormal behavior detection apparatus 200 using data pattern analysis performs data pattern analysis among a plurality of data stored in the database 100. It is possible to receive N pieces of acquisition data to proceed. Here, the acquired data may refer to the entire data set acquired from the database 100 by the abnormal behavior detection device 200 using data pattern analysis. For example, data related to power plants, data related to hospitals, data related to schools, and traffic It can contain various types of data sets such as public data such as related data and financial data. For example, the acquired data may be stored in the database 100 in the form of a vast amount of data packets and transmitted to the abnormal behavior detection device 200.

The database 100 and the apparatus 200 for detecting abnormal behavior using data pattern analysis may communicate through the network 1. Network 1 refers to a wireless connection structure in which information exchange is possible between each node such as a terminal and a server, and examples of such networks include a 3rd Generation Partnership Project (3GPP) network and a Long Term Evolution (LTE) network. , 5G network, WIMAX (World Interoperability for Microwave Access) network, Internet, LAN (Local Area Network), Wireless LAN (Wireless Local Area Network), WAN (Wide Area Network), PAN (Personal Area Network), Bluetooth (Bluetooth) network, satellite broadcasting network, analog broadcasting network, DMB (Digital Multimedia Broadcasting) network, and the like are included, but are not limited thereto.

The abnormal behavior detection apparatus 200 using data pattern analysis according to an embodiment of the present application may detect advanced malicious code similar to normal behavior such as Trition and Crashoverride based on the payload, that is, acquired data, and features In selecting (Feature), by selecting the relevant features through the Association Rule without performing Dimension Reduction, it is highly intuitive and the association rule itself can be used as a whitelist. In addition, since the recurrent neural network (RNN) model generated through the association rule is a data generation model, the output value is an expected value of the corresponding association rule, so it is easy to interpret the result value.

The abnormal behavior detection device 200 using data pattern analysis includes a communication unit 210, a data preprocessor 220, a rule generation unit 230, a model generation unit 240, a data prediction unit 250, and an abnormal behavior determination unit. It may include 260.

The communication unit 210 may receive N pieces of acquired data each including a plurality of data points. The communication unit 210 may receive N pieces of acquired data from the database 100. Here, each of the N pieces of acquired data may include a plurality of data points. The data point means a single/individual type of data included in the acquired data, and a plurality of data points may be included in the concept of sub data in one acquired data. For example, when the acquired data is data related to a power plant, the data points are various types, such as data on on/off power plants, data on the amount of power produced, and data on trends in power plant sales. Can contain tangible data. As another example, when the acquired data is hospital-related data, the data points may include data on the number of medical staff and patients, data on the number of medical accidents, and disease-related data. In addition, each data point may include a type of data change, an increase/decrease, and a distribution interval according to information included in the data point. A detailed description of the data points will be described later.

If the data is a binary value such as on/off, it does not matter, but if the data is expressed as the same value as the measurement data, the number of cases cannot be limited and a problem may occur. Accordingly, according to an exemplary embodiment of the present disclosure, in this case, a data distribution section may be used by dividing the amount of data change, whether the data increases/decreases, and the distribution section by 0 to 10, 11 to 20, and the like.

The data preprocessor 220 may perform preprocessing of N pieces of acquired data according to at least one of a data change amount, increase/decrease, and distribution interval of the plurality of data points. The data pre-processing unit 220 may format and quantify data for at least one of a data change amount, an increase/decrease, and a distribution section included in the plurality of data points according to the type and type of each of the plurality of data points. For example, when the acquired data is power plant-related data and the data point is the amount of power produced, the data pre-processing unit 220 may numerically quantify the amount of change in the amount of power produced, whether the amount of power produced is increased or decreased, or map it to a preset label. have. As an example, when the data point is data related to the amount of power produced, the data preprocessor 220 is '0' when the amount of power produced is 0kW to 50,000 kW, and '1' when the amount of power produced is 50,001kW to 100,000kW, and 100,001kW to The case of 150,000 kW can be quantified as '2', and the case of 150,001 kW ~ 200,000 kW can be quantified as '3'. In addition, the data pre-processing unit 220 converts a case where the amount of power produced in the reference day increases compared to the previous day to be '1', and when the amount of power decreases is '0', based on the date of receiving the acquired data from the database 100. can do. As another example, when the acquired data is data related to a power plant and the data point is data related to on/off of a power plant, the data preprocessing unit 220 is '1' when the power plant is on, and '0' when the power plant is off. It can be quantified as The foregoing is only an example, and the data preprocessor 220 uses a reference value and a numerical value previously set by the user to determine the amount of change in data included in the plurality of data points, whether or not to increase/decrease, and at least one of the distribution intervals. It can be quantified by standardizing the data for In addition, each of the N pieces of acquired data may include a plurality of data points, and each of the plurality of data points may include at least one of a data change amount, an increase/decrease, and a distribution period, so that the data preprocessor 220 Data preprocessing may be performed according to at least one of a change amount of data included in each of the plurality of data points, an increase/decrease, and a distribution section.

The rule generator 230 may compare the N pieces of pre-processed acquired data to generate an association rule between at least two or more data points among a plurality of data points included in each acquired data.

3 is a schematic exemplary flowchart of a method of operating an abnormal behavior detection apparatus using data pattern analysis according to an exemplary embodiment of the present application.

Referring to FIG. 3, the apparatus 200 for detecting abnormal behavior using data pattern analysis pre-processes N pieces of acquired data through the data pre-processing unit 220, and stores N pieces of acquired data pre-processed through the rule generation unit 230. You can compare and create association rules. The rule generation unit 230 may generate at least one association rule using a pattern of change of at least two or more data points included in the N pieces of preprocessed acquired data.

For example, N acquisition data including acquisition data #1 (221) and acquisition data #2 (222) are power plant-related data, and data point P#1 (221a) included in acquisition data #1 (221) is Data on the power plant on/off, data point P#2 (221b) is data on the amount of power produced, data point P#3 (221c) is data on the power plant sales trend, and is included in the acquisition data #2 (222). Data point P#1 (222a), data point P#2 (222b), and data point P#3 (222c) are also data on power plant on/off, power generation data, and power plant sales trends, respectively. I assume. In addition, each of the plurality of data points may include at least one type of data change amount, increase/decrease status, and distribution section, and the data preprocessor 220 includes data change amount, increase/decrease in each of the plurality of data points. Preprocessing of N pieces of acquired data may be performed according to at least one of whether or not the distribution period.

The rule generation unit 230 is related based on at least one of a change pattern of at least two or more data points included in the N pieces of acquired data, a data change amount of the at least two or more data points, an increase/decrease, and a distribution section. You can create rules.

As an example, the data point P#1 (221a) of the preprocessed acquisition data #1 (221) is'on', the data point P#2 (221b) is'increase', and the preprocessed acquisition data #2 (222) is Data point P#1 (222a) is'on', data point P#2 (222b) is'increase', and data point P#1 (223a) of preprocessed acquired data #N 223 is'on', When the data point P#2 (not shown) is'increase' (considering all N pieces of acquired data up to acquired data #N), the rule generator 230 refers to the AR#1 231 as "data point P#. When 1 is'on', the data point P#2 can generate an association rule as "a rule of increasing".

Here, AR stands for Association Rule, AR#1 is Association Rule 1, AR#2 is Association Rule 2, AR#N is Association Rule N, and the serial number assigned to the association rule It can mean. In addition, when the data point P#1 of all N pieces of acquired data is'on' and the data point P#2) is'increase', the rule generator 230 sets the AR#1 231 to the data point P#1. Is'on' and data point P#2 is'increment', and the association rule can be created, but is not limited thereto, but is not limited to data of some of the acquired data (acquisition data equal to or greater than a preset threshold) AR#1 may be generated even when point P#1 is'on' and data point P#2 is'increase'. How to create an association rule will be described in more detail below.

As another example, the data point P#3 (221c) of the preprocessed acquisition data #1 (221) is'increase', the data point P#4 (not shown) is'increase', and the preprocessed acquisition data #2 (222) is Data point P#3 (222c) of is'increase', data point P#4 (not shown) is'increase', and data point P#3 (not shown) of preprocessed acquired data #N 223 is' When'increase' and data point P#4 (not shown) is'increase', the rule generator 230 refers to the AR#2 232 as "increase" when the data point P#3 is'increase', the data point P# 4 can create an association rule with "incremental rule".

As another example, the data point P#8 (not shown) of the preprocessed acquisition data #1 221 is'off', the data point P#9 (not shown) is '0', and the preprocessed acquisition data #2 ( Data point P#8 (not shown) of 222) is'off', data point P#9 (not shown) is '0', and data point P#8 (not shown) of preprocessed acquired data #N(23) is ) Is'off' and the data point P#9 (not shown) is '0', the rule generator 230 refers to the AR#N 233 as "when the data point P#8 is off", the data Point P#9 may create an association rule as "a rule of 0".

The rule generator 230 may generate an association rule between a plurality of data points according to at least one of a data change amount, increase/decrease, and distribution section of the data point. In the case of the above-mentioned example, it was exemplified that the association rule is generated by using one of the amount of data change, increase/decrease, and distribution interval of the data point, but is not limited thereto, and is included in each of a plurality of data points. An association rule between at least two or more data points may be generated in consideration of a plurality of data variation and increase/decrease, or increase/decrease and distribution section, or data variation and distribution section. That is, a plurality of association rules between the same data points (eg, P#1, P#2) may be generated for each type of data point. In addition, in the case of the above-mentioned example, the association rule was created by using the pattern of change of two data points included in one acquired data, but the pattern of change of two or more data points is not limited thereto. Can be used to create an association rule.

In addition, according to an embodiment of the present application, the rule generation unit 230 is a threshold value in which a rate of occurrence of a pattern of change of at least two or more data points is preset among a plurality of data points included in the preprocessed N pieces of acquired data. If this is the case, a pattern of change of at least two or more data points may be generated as an association rule. For example, the threshold value regarding whether to generate a pattern of change between specific data points as an association rule may be preset by a user and input to the apparatus 200 of the present application. In addition, the preset boundary value may be set for each association rule according to the type and type of data points included in each association rule. Because the data points included in each association rule are different, and even if the data points are the same, the types may be different, the targets that are created as association rules and saved as a white list of the system administrator and managed must also vary depending on the data point. Because it does.

As an example, when the preset boundary value is 100%, and a pattern of change between specific data points among a plurality of data points included in the preprocessed 100 acquired data occurs in all 100 acquired data, the rule generator 230 A pattern of change between corresponding data points can be created as an association rule.

As another example, when the preset threshold is 80% and the number of acquired data in which a pattern of change between specific data points occurs among a plurality of data points included in the preprocessed 100 acquired data is 80 or more, the rule generator 230 ) Can generate a pattern of change of the corresponding data point as an association rule.

The rule generation unit 230 may generate a related rule through preprocessed data preprocessed from a series of data. When the rule generation unit 230 generates the association rule, the association rule number (AR#1, AR#2, ..., AR#N) can be initialized, and data of a plurality of data points included in all acquired data An association rule may be created for a point type, that is, a data change amount of a plurality of data points, an increase/decrease, and a distribution section, and a pattern of change between the found data points may be added to the association rule. When generating a related rule, the rule generator 230 may assign a related rule number. In addition, after completing the creation of association rules for all acquired data, the administrator can directly filter necessary association rules for all generated association rules.

The model generation unit 240 may generate an artificial neural network model by inputting features included in the generated association rule. According to an embodiment of the present application, the model generator 240 may generate an artificial neural network model corresponding to each of a plurality of association rules. As an example, referring to FIG. 3, the model generator 240 generates an artificial neural network model to correspond to each of the first association rule AR#1, the second association rule AR#2, and the Nth association rule AR#N. Can be generated. The model generation unit 240 may generate an artificial neural network model by extracting and binding features included in each association rule from each acquired data. Here, the artificial neural network model may be a recurrent neural network (RNN) model. As the RNN model type, the output of the RNN model may not be a classification model type that outputs normal/abnormal, but may be a data generation model type used to output a predicted value of the next expected value. According to an embodiment of the present application, the model generation unit 240 extracts features such as values and types of data points related to each association rule from each acquired data, vectorizes them, applies them as inputs to the artificial neural network, and continuously applies the artificial neural network. Can be learned by. That is, the model generation unit 240 according to an embodiment of the present application utilizes a data set related to each association rule associated with each model as input data of the RNN, and uses the data set related to each association rule associated with each model as input data of the RNN, A model for predicting related data points can be trained and created.

Since the abnormal behavior detection apparatus 200 using data pattern analysis according to an embodiment of the present application calculates a next predicted feature value by using a series of data as an input using a Many to One model, many It can improve prediction accuracy compared to the to many model. Here, the many to one model may mean a network model that generates one result for a plurality of inputs, and many to many may mean a network model that generates a plurality of results for a plurality of inputs.

The data prediction unit 250 may predict the N+1th acquired data using the generated artificial neural network. The data predictor 250 may predict a data point included in the N+1 th acquired data linked to each association rule by using each artificial neural network generated for each association rule.

Referring to FIG. 3, the data predictor 250 may predict a data point included in the N+1 th acquired data linked to the AR#1 231 as the first association rule. For example, when AR#1 231 is "a rule in which data point P#1 is'on', data point P#2 is'increment'", the data prediction unit 250 is the first association rule The data points P#1 and P#2 included in the N+1th acquired data can be predicted with specific values through the RNN model 241 linked with the AR#1 (231) and the association rule AR#1 (231). have. In addition, when AR#2 232 is "a rule in which data point P#3 is'increase', data point P#4 is a'increase' rule", the data prediction unit 250 is Through the RNN model 242 linked with #2 232 and the association rule AR#2 232, data points P#3 and P#4 included in the N+1th acquired data can be predicted as specific values. . In addition, when the AR#N 233 is "a rule in which data point P#8 is'off', data point P#9 is '0'", the data predictor 250 is The data points P#8 and P#9 included in the N+1th acquisition data can be predicted as specific values through the RNN model 243 linked with #N 233 and the Nth association rule AR#N 233. I can.

The abnormal behavior determination unit 260 compares the predicted N+1th acquisition data predicted through an artificial neural network with the actually received N+1th acquisition data to determine an abnormal behavior for the received N+1th acquisition data. I can judge. Here, the communication unit 210 may receive the received N+1th acquisition data including a plurality of data points.

Upon receiving the actual N+1th acquired data from the communication unit 210, the abnormal behavior determination unit 260 compares the N+1th acquired data predicted by the data prediction unit 250 with the actual N+1th acquired data. It is possible to determine abnormal behavior for the actual N+1th acquired data. The data point of the predicted N+1th acquired data linked to the association rule using the RNN artificial neural network, the amount of data change, the increase/decrease, and the distribution interval are predicted data. Therefore, from the communication unit 210, the data point of the actual N+1th acquired data and the amount of data change, the increase/decrease, and distribution section, and the ideally predicted data point and data point of the N+1th acquired data. By comparing the data change amount, increase/decrease status, and distribution section, it is possible to determine the data point of the actual N+1th acquired data, the data change amount of the data point, increase/decrease status, and abnormal behavior in the distribution section.

According to an embodiment of the present application, the abnormal behavior determination unit 260 compares the data points included in the N+1 th acquired data predicted according to each association rule with the data points included in the received N+1 th acquired data. When the generated error range is equal to or greater than a preset threshold value, an alarm sensor (not shown) for generating an alarm may be included.

For example, when the preset threshold value is 90%, the data point of the actual N+1th acquired data received through the communication unit 210 or the amount of data change, increase/decrease, and distribution section, and data prediction If the data point of the N+1th acquired data ideally predicted through the unit 250 or the amount of data change, increase/decrease, and the degree of matching of the distribution section are less than 90%, the abnormal behavior determination unit 260 Determines that the data point of the actual N+1th acquired data received through the communication unit 210, the amount of data change, increase/decrease, and distribution section of the data point are abnormal, and an alarm through an alarm sensor (not shown). Can occur.

The abnormal behavior determination unit 260 has a basic structure to generate an alarm when it exceeds a specific threshold by comparing the output of the generated RNN model with the next predicted data individually. It can be used as a basis for determining abnormal behavior, and it is also possible to perform abnormal behavior determination by creating a whitelist with the associated rule itself.

In the case of conventional abnormal behavior detection, it is difficult to introduce the field because it is a detection based on a header or a model at the level of a black box in the process of selecting and learning a feature. However, as described above, according to the exemplary embodiment of the present application, advanced malware similar to normal behavior such as Trition and Crashoverride may also be detected based on the payload, that is, acquired data. In addition, since dimension reduction is not performed in selecting a feature, and related features (data points) are selected through the association rule, it is highly intuitive and the association rule itself can be used as a whitelist. The RNN generated through this association rule is a data generation model, and since the output value is the expected value of the corresponding feature (data point), it is easy to interpret the result value.

Hereinafter, based on the details described above, the operation flow of the present application will be briefly described.

4 is a flowchart illustrating an operation of an abnormal behavior detection method using data pattern analysis according to an exemplary embodiment of the present application.

The abnormal behavior detection method using data pattern analysis illustrated in FIG. 4 may be performed by the abnormal behavior detection apparatus 200 using data pattern analysis described above. Accordingly, even if omitted below, the description of the abnormal behavior detection apparatus 200 using data pattern analysis may be equally applied to the description of the abnormal behavior detection method using data pattern analysis.

Referring to FIG. 4, in the method of detecting abnormal behavior using data pattern analysis, the abnormal behavior detecting apparatus 200 using data pattern analysis may receive N pieces of acquired data each including a plurality of data points ( S401). Next, the abnormal behavior detection apparatus 200 using data pattern analysis may perform pre-processing of N pieces of acquired data according to at least one of a data change amount, increase/decrease, and distribution section of a plurality of data points (S402). . Next, the abnormal behavior detection apparatus 200 using the data pattern analysis may generate a correlation rule between at least two or more data points among the plurality of data points by comparing the preprocessed N pieces of acquired data (S403). Next, the apparatus 200 for detecting abnormal behavior using data pattern analysis may generate an artificial neural network model that inputs features included in the generated association rule (S404). Next, the apparatus 200 for detecting abnormal behavior using data pattern analysis may predict the N+1th acquired data using the generated artificial neural network (S405). Next, the abnormal behavior detection apparatus 200 using data pattern analysis may receive the N+1 acquisition data including a plurality of data points (S406). Next, the abnormal behavior detection apparatus 200 using data pattern analysis compares the predicted N+1th acquired data predicted using an artificial neural network with the received N+1th acquired data, It is possible to determine abnormal behavior with respect to the acquired data (S407).

In the above description, steps 401 to S407 may be further divided into additional steps or may be combined into fewer steps, according to an embodiment of the present disclosure. In addition, some steps may be omitted as necessary, and the order between steps may be changed.

An abnormal behavior detection method using data pattern analysis according to an exemplary embodiment of the present disclosure may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the present invention, or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -A hardware device specially configured to store and execute program instructions such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those produced by a compiler but also high-level language codes that can be executed by a computer using an interpreter or the like. The above-described hardware device may be configured to operate as one or more software modules to perform the operation of the present invention, and vice versa.

In addition, the above-described method for detecting abnormal behavior using data pattern analysis may be implemented in the form of a computer program or application executed by a computer stored in a recording medium.

The foregoing description of the present application is for illustrative purposes only, and those of ordinary skill in the art to which the present application pertains will be able to understand that it is possible to easily transform it into other specific forms without changing the technical spirit or essential features of the present application. Therefore, it should be understood that the embodiments described above are illustrative in all respects and not limiting. For example, each component described as a single type may be implemented in a distributed manner, and similarly, components described as being distributed may also be implemented in a combined form.

The scope of the present application is indicated by the claims to be described later rather than the detailed description, and all changes or modified forms derived from the meaning and scope of the claims and their equivalent concepts should be interpreted as being included in the scope of the present application.

100: database
200: Abnormal behavior detection method using data pattern analysis
210: communication department
220: data preprocessor
230: rule generation unit
240: model generator
250: data prediction unit
260: abnormal behavior judgment unit

Claims (10)

In the abnormal behavior detection method using data pattern analysis,
Receiving N pieces of acquisition data each including a plurality of data points;
Performing pre-processing of the N pieces of acquired data according to at least one of a data change amount of the plurality of data points, an increase/decrease, and a distribution section;
Comparing the N pieces of preprocessed acquired data to generate a plurality of association rules between at least two or more data points among a plurality of data points included in each acquired data;
Generating an artificial neural network model that inputs features included in the generated association rule; And
Predicting the N+1th acquired data using the generated artificial neural network,
Including,
Each of the plurality of data points includes at least one type of data change amount, increase/decrease, and distribution interval,
The step of generating the association rule,
Generates an association rule associated with at least two or more data points using a pattern of change of at least two or more data points included in each of the N pieces of pre-processed acquired data, the two or more data included in each acquired data The association rule is generated based on at least one of a data change amount of a point, an increase/decrease, and a distribution interval,
Generating the artificial neural network model,
Generate a plurality of artificial neural network models corresponding to each of the plurality of association rules,
The plurality of artificial neural network models are a Many to One Recurrent Neural Network model that receives a data set related to a corresponding association rule as an input and outputs a predicted value of a data point related to the corresponding association rule from the N+1 th acquired data. In that, abnormal behavior detection method using data pattern analysis. delete The method of claim 1,
The step of generating the association rule,
Among a plurality of data points included in the pre-processed N pieces of acquired data, when the rate of occurrence of the pattern of change of the at least two data points is greater than or equal to a preset threshold, the pattern of change of the at least two or more data points is The method of detecting abnormal behavior using data pattern analysis, which is generated by the association rule. delete The method of claim 1,
The step of predicting the N+1th acquired data,
An abnormal behavior detection method using data pattern analysis to predict a data point included in the N+1 th acquired data linked to the association rule by using each artificial neural network generated for each association rule. The method of claim 1,
Receiving the N+1th acquisition data including a plurality of data points; And
Comparing the predicted N+1 th acquisition data predicted using the artificial neural network with the received N+1 th acquisition data to determine an abnormal behavior for the received N+1 th acquisition data,
An abnormal behavior detection method using data pattern analysis further comprising a. The method of claim 6,
The step of determining abnormal behavior for the received N+1th acquired data,
When the error range generated by comparing the data point included in the predicted N+1th acquired data with the data point included in the received N+1th acquired data is equal to or greater than a preset threshold, generating an alarm That includes, abnormal behavior detection method using data pattern analysis. In the abnormal behavior detection device using data pattern analysis,
A communication unit for receiving N pieces of acquired data each including a plurality of data points;
A data preprocessing unit that performs preprocessing of the N pieces of acquired data according to at least one of a data change amount of the plurality of data points, an increase/decrease, and a distribution section;
A rule generation unit that compares the N pieces of preprocessed acquired data and generates a plurality of association rules between at least two or more data points among a plurality of data points included in each acquired data;
A model generation unit that generates an artificial neural network model that receives features included in the generated association rule as inputs; And
A data prediction unit that predicts the N+1th acquisition data using the generated artificial neural network,
Including,
Each of the plurality of data points includes at least one type of data change amount, increase/decrease, and distribution interval,
The rule generation unit,
Generates an association rule associated with at least two or more data points using a pattern of change of at least two or more data points included in each of the N pieces of preprocessed acquired data, the two or more data included in each acquired data The association rule is generated based on at least one of a data change amount of a point, an increase/decrease, and a distribution interval,
The model generation unit,
Generate a plurality of artificial neural network models corresponding to each of the plurality of association rules,
The plurality of artificial neural network models are a Many to One Recurrent Neural Network model for inputting a data set related to a corresponding association rule and outputting a predicted value of a data point related to the corresponding association rule from the N+1 th acquired data. In that, abnormal behavior detection device using data pattern analysis. The method of claim 8,
Further comprising an abnormal behavior determination unit that compares the predicted N+1 th acquired data predicted through the artificial neural network with the received N+1 th acquired data to determine an abnormal behavior for the received N+1 th acquired data and,
The communication unit,
The apparatus for detecting abnormal behavior using data pattern analysis to receive the received N+1 th acquisition data including a plurality of data points. The method of claim 9,
The abnormal behavior determination unit,
An alarm sensor that generates an alarm when an error range generated by comparing a data point included in the predicted N+1th acquired data with a data point included in the received N+1th acquired data is greater than or equal to a preset threshold value That includes, abnormal behavior detection apparatus using data pattern analysis.

Images