KR20220170687A - Method, apparatus, computer-readable storage medium and computer program for detecting attack data - Google Patents

Abstract

An attack data detection method performed by an attack data detection device according to an embodiment includes the steps of: performing data preprocessing corresponding to the type of data input from the outside; calculating a value output by passing the preprocessed data in a previously learned deep learning model and calculating a loss value between the preprocessed data; and checking whether the data is attack data based on a comparison between the calculated loss value and a threshold value. The threshold value may be a percentage value of a plurality of loss values calculated in a learning process of the previously learned deep learning model.

Description

Attack data detection method, device, computer readable recording medium and computer program

The present invention relates to a method and apparatus for detecting attack data, a computer readable recording medium, and a computer program.

Recently, with the development of information and communication technologies, the size of the network environment has expanded very rapidly, and at the same time, cyber threats to the network environment have also begun to increase.

Accordingly, most companies operate a Network based Intrusion Detection System (NIDS) with the goal of reporting cyber threats to administrators when various security attacks occur in preparation for cyber threats on the network.

At this time, existing network intrusion detection systems have mainly used a signature based detection method as a misuse detection method. Specifically, the signature-based detection method is a method in which patterns are defined for frequently used attacks through security experts, and the attack is detected based on input traffic and comparison.

However, when the signature-based detection method is used, new attacks other than known attacks such as APT (Advance Persistent Threat) cannot be detected, and to detect a new attack, it takes time to create a signature for the new attack There is a problem of excessive cost.

Accordingly, as a method for detecting a new attack, an abnormality detection method has been proposed. Specifically, the abnormality detection method is a method of performing modeling on normal behavior and detecting anomaly behavior through a model modeled on the normal behavior. Therefore, the method for detecting anomalies can also detect an unknown attack (zero-day attack).

In contrast, a machine learning technique has recently been introduced to perform an anomaly detection method, and the machine learning technique has the advantage of being able to model from data and to infer prediction results through the modeled data. In machine learning, in order to distinguish between normal and abnormal, the binary classification method should be used.

However, many data generated in the real world exist as imbalanced data in which data are distributed disproportionately for each class. This is because the data of the minor class is significantly more This is because it consists of less data.

On the other hand, since the proportion of network intrusion data is about 1% of the total data, when a machine learning model is trained using this imbalanced data, there is a problem that learning to detect attack data for network intrusion detection is not performed properly. could have occurred

For example, if a supervised learning-based machine learning model is trained using a training data set containing imbalanced data, the performance of classifying attack data for network intrusion detection may deteriorate. It can be. This is because the detection rate of the minority class is lowered because the decision boundary of the machine learning model is learned to be biased toward the majority class.

Therefore, there is a need for a technology capable of detecting a new attack (attack data) regardless of imbalanced data that frequently occurs in an actual network environment.

Korean Registered Patent Publication, No. 10-2027389 (registered on September 25, 2019)

The problem to be solved by the present invention is to provide an attack data detection method, apparatus, computer readable recording medium and computer program.

In addition, in order to prevent the decision boundary of the model from being learned to be biased toward multiple classes through such an attack data detection method, device, computer readable recording medium, and computer program, an auto-encoder-based deep learning model pre-learned using only normal data Being able to detect new attack data through can be included in the problem to be solved by the present invention.

However, the problem to be solved by the present invention is not limited to those mentioned above, and another problem to be solved that is not mentioned can be clearly understood by those skilled in the art from the description below. will be.

An attack data detection method according to an embodiment of the present invention includes the steps of performing data preprocessing corresponding to the type of data input from the outside in the attack data detection method performed by the attack data detection apparatus, and Calculating a loss value between an output value and the preprocessed data by passing the preprocessed data through a deep learning model, and checking whether the data is attack data based on a comparison between the calculated loss value and a threshold value. The threshold value may be a percentage value of a plurality of loss values calculated in a learning process of the pre-learned deep learning model.

In addition, the pre-learned deep learning model inputs normal data to an auto-encoder, compresses the normal data to a dimension lower than that of the normal data, and then restores the normal data to a dimension of the normal data and outputs a vector value through the process of outputting the normal data. It may be pre-learned so that the features of may be extracted.

In addition, the pre-learned deep learning model may be pre-learned such that a loss value between a value output by passing the normal data through the deep learning model and the normal data is reduced.

In addition, the step of detecting the presence or absence of attack data may include identifying the data as the attack data when the calculated loss value exceeds the threshold value, and storing the data when the calculated loss value is less than or equal to the threshold value. This can be verified with normal data.

In addition, in the step of performing the preprocessing, if the data received from the outside is first type data, encoding the first type data into an integer type and then performing a one-hot encoding process to The method may include outputting a vector value and, if the data received from the outside is second type data, performing min-max normalization on the second type data.

An apparatus for detecting attack data according to an embodiment of the present invention includes an input/output unit for receiving data from the outside; Memory; and a processor electrically connected to the memory, wherein the processor performs data preprocessing corresponding to the type of data received from the outside, passes the preprocessed data through a pre-learned deep learning model, and outputs a value. and, calculating a loss value between the preprocessed data, and determining whether or not the data is attack data based on a comparison between the calculated loss value and a preset threshold, and the preset threshold is the pre-learned It may be a percentage value of a plurality of loss values calculated in the learning process of the deep learning model.

In addition, the pre-learned deep learning model inputs normal data to an auto-encoder, compresses the normal data to a dimension lower than that of the normal data, and then restores the normal data to a dimension of the normal data and outputs a vector value through the process of outputting the normal data. It may be pre-learned so that the features of may be extracted.

In addition, the pre-learned deep learning model may be pre-learned such that a loss value between a value output by passing the normal data through the deep learning model and the normal data is reduced.

In addition, the processor may identify the data as the attack data when the calculated loss value exceeds the threshold value, and identify the data as normal data when the calculated loss value is less than or equal to the threshold value. there is.

In addition, when the data received from the outside is first type data, the processor performs a one-hot encoding process on the first type data to output a vector value, and inputs the first type data. If the received data is second type data, min-max normalization may be performed on the second type data.

Since the attack data detection apparatus according to an embodiment of the present invention uses a deep learning model previously trained using normal data, it can more accurately detect whether an attack is detected than a deep learning model learned with imbalanced data.

In addition, the attack data detection apparatus according to an embodiment of the present invention sets a percentage of a plurality of loss values (reconstruction loss values) calculated in the process of learning an auto-encoder-based deep learning model as a threshold value, and sets the set threshold value Since the presence or absence of attack data is determined based on , it is possible to detect new attack data other than normal data.

However, the effects obtainable in the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below. You will be able to.

1 is a block diagram of an attack data detection device according to an embodiment of the present invention.
2 is a diagram for explaining the operation of an auto encoder.
3 is a graph showing normal data and attack data confirmed through a pre-learned deep learning model according to an embodiment of the present invention.
4 is a graph showing loss value distributions of normal data and attack data output through an attack data detection device according to an embodiment of the present invention.
5 is a graph comparing performance of a learning model using an auto-encoder and a learning model learned through supervised learning.
6 is a diagram showing an anomaly detection confusion matrix for an attack data detection apparatus according to an embodiment of the present invention.
7 is an exemplary flowchart of a procedure of a method for detecting attack data according to an embodiment of the present invention.

Advantages and features of the present invention, and methods of achieving them, will become clear with reference to the detailed description of the following embodiments taken in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various different forms, and only these embodiments make the disclosure of the present invention complete, and common knowledge in the art to which the present invention belongs. It is provided to completely inform the person who has the scope of the invention, and the present invention is only defined by the scope of the claims.

In describing the embodiments of the present invention, if it is determined that a detailed description of a known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted. In addition, terms to be described later are terms defined in consideration of functions in the embodiment of the present invention, which may vary according to the intention or custom of a user or operator. Therefore, the definition should be made based on the contents throughout this specification.

1 is a block diagram of an attack data detection device according to an embodiment of the present invention.

The attack data detection device 100 according to an embodiment of the present invention is a device that can check the presence or absence of attack data using a deep learning model pre-learned through an auto-encoder-based single-class learning method.

Here, the one-class learning method corresponds to semi-supervised learning as a method of learning only samples (data) of a specific class.

This single-class learning method can be easily applied in a network intrusion detection environment in which most samples correspond to normal samples. After training using only samples, an attack behavior (whether it is attack data or not) can be detected based on the loss value (or reconstruction error) between input data and data that has passed through the auto-encoder model.

Referring to FIG. 1 , an attack data detection device 100 according to an embodiment of the present invention may include an input/output unit 101, a communication unit 102, a memory 110 and/or a processor 120.

The input/output unit 101 transmits, for example, commands or data input from a user or other external device to other component(s) of the attack data detection device 100 according to an embodiment, or to one side. Commands or data received from other component(s) of the attack data detection device 100 may be output to a user or an external device.

As an embodiment, the input/output unit 101 may receive data from the outside. For example, the input/output unit 101 may receive data from a user, and the input/output unit 101 may include a keyboard, mouse, touch pad, and the like.

Here, the data may be normal data or attack data, the normal data may be at least one of text, image, and video containing information that does not cause damage to the network, and attack data may cause damage to the network. It may be at least one of a text image and a video including a. For example, the attack data may be data of Dos, Probe, U2R, and R2L types.

The communication unit 102 may support establishment of a wired or wireless communication channel between the attack data detection device 100 and an external device and communication through the established communication channel.

The memory 110 includes various data, for example, software ( Example: a program) and input data or output data for commands related thereto may be stored. The memory 110 may include volatile memory or non-volatile memory.

The processor 120 (also referred to as a control unit, control unit, or control circuit) is connected to at least one other component (eg, hardware component (eg, input/output unit 101, communication unit 102) of the attack data detection device 100 and/or the memory 110) or a software component), and may perform various data processing and calculations.

Also, the processor 120 may load and process commands or data received from at least one of the other components into a volatile memory, and store various data in a non-volatile memory.

To this end, the processor 120 may be a dedicated processor (for example, an embedded processor) or a general-purpose processor capable of performing corresponding operations by executing one or more software programs stored in a memory device. processor) (eg, CPU or application processor or micro controller unit (MCU)).

More specifically, the processor 120 performs data pre-processing corresponding to the type of data input from the outside through the input/output unit 101, and passes the pre-processed data through a pre-learned deep learning model to obtain output values and pre-processing. It is possible to calculate a loss value between the generated data, and check whether the data received through the input/output unit 101 is attack data based on the comparison between the calculated loss value and the threshold value.

In more detail, a method of performing preprocessing corresponding to the type of data received from the outside in the input/output unit 101 in the processor 120 will be described.

As an embodiment, when data received from the outside through the input/output unit 101 is first type data, the processor 120 encodes the first type data into an integer type and then performs one-hot encoding. By performing the process and outputting a vector value, data received from the outside in the input/output unit 101 may be preprocessed.

As another embodiment, the processor 120, when data received from the outside in the input/output unit 101 is second type data, performs min-max normalization on the second type data, so that 0 to 1 By outputting a value in between, the input/output unit 101 may pre-process data received from the outside.

Hereinafter, a method of pre-processing data in the processor 120 will be described. In addition, the method of preprocessing data in the processor 120 can also be applied to a training data set of a pre-learned deep learning model. there is.

The processor 120 may remove the preset characteristics when input data includes preset characteristics (eg, difficulty, num_outbound_cmds characteristics).

Thereafter, the processor 120 may change the characteristics of data input from the input/output unit 101 to values between 0 and 1 through a data normalization process.

As an embodiment, when data input from the input/output unit 101 is first type data, the processor 120 encodes the first type data into an integer type and then performs a one-hot encoding process. You can output a vector value by doing

In this case, the first type data may be nominal type data, and when one-hot encoding is performed after encoding the nominal type data into an integer type, the dimension of the data may increase.

As another embodiment, when the data input from the input/output unit 101 is the second type data, the processor 120 may perform min-max normalization as shown in Equation 1 below.

In this case, when minimum and maximum normalization is performed on the second type data, the difference in the range of attribute values may be changed to a common scale without distorting, and the second type data may be numeric type data.

Also, when the processor 120 receives third type data, it may not perform data preprocessing, and for example, the third type data may be binary type data.

The processor 120 calculates a loss value between the output value and the preprocessed data by passing the preprocessed data through a pre-learned deep learning model after data input from the outside is preprocessed by the input/output unit 101, and the calculated Based on the comparison between the loss value and the threshold value, it is possible to determine whether data received from the input/output unit 101 is attack data.

Here, the pre-learned deep learning model may be a deep learning model learned based on an auto-encoder, and the auto-encoder will be described in detail with reference to FIG. 2 below.

2 is a diagram for explaining the operation of an auto encoder.

Referring to FIG. 2 , the autoencoder 10 is an unsupervised neural network that approximates an input value and an output value to the same value.

The auto-encoder may include an encoder 11 (Encoder) and a decoder 13 (Decoder), and a structure in which the encoder and the decoder are symmetric based on the code layer 12 may be formed.

In more detail, the auto-encoder 10 may learn characteristics of the input data by passing the input data through an encoder and a decoder.

The encoder 11 may receive data and perform compression in a dimension lower than that of the received data. Since the encoder 11 can perform compression with the goal of maximally preserving important information for reconstruction in the process of compressing input data, it can encode only important core information.

A value output by compressing the data received from the encoder 11 can be calculated through Equation 2 below.

는 인코더의 출력 값(또는 코드(Code)) 이고,

는 입력되는 데이터 값이고,

및

는 인코더의 파라미터이고,

는 활성함수(activation function)이다.here,

is the output value (or code) of the encoder,

is the input data value,

and

is a parameter of the encoder,

is an activation function.

는 비선형 함수와 선형 함수를 사용할 수 있으며, 선형 함수를 사용할 경우 선형 특징 추출 기법인 PCA(Principal component analysis)와 유사하게 작동될 수 있다.At this time, the activation function

can use a non-linear function and a linear function, and when a linear function is used, it can operate similarly to PCA (Principal Component Analysis), a linear feature extraction technique.

The code layer 12 is a bottleneck in which the encoder 11 and the decoder 13 overlap, and may output a result mapped to a low-dimensional latent space of input data.

The decoder 13 may receive the output vector output from the code layer and perform a process of reconstructing the received data.

A value output by reconstructing the data received from the decoder 13 can be calculated through Equation 3 below.

는 디코더(13)의 출력 값이고,

는 인코더(11)의 출력 값(또는 코드(Code) 이고,

및

는 디코더(13)의 파라미터이고,

는 활성함수(activation function)이다.here,

is the output value of the decoder 13,

Is the output value (or code) of the encoder 11,

and

is a parameter of the decoder 13,

is an activation function.

)을 이용하여, 인코더(11)에서 출력된 값(

)을 재구성한 값(

)을 출력할 수 있다.In more detail, the decoder 13 outputs the value from the encoder 11 (

), the value output from the encoder 11 (

) reconstructed (

) can be output.

)는, 인코더(11)의 입력 값(

)과 디코더(13)의 출력 값(

)간의 평균 제곱 오차(MSE: Mean Squared Error)일 수 있으며, 손실 함수(

)는 손실값 또는 재구성 손실(Reconstruction Error)로 지칭될 수 있다.On the other hand, the loss function of the auto encoder 10 (

) is the input value of the encoder 11 (

) and the output value of the decoder 13 (

), it may be a mean squared error (MSE) between, and a loss function (

) may be referred to as a loss value or reconstruction error.

)는 하기 수학식 4를 통해 계산할 수 있다.Such a loss function of the auto encoder 10 (

) can be calculated through Equation 4 below.

)는 평균 절대 오차(MAE: Mean Absolute Error)와 교차 엔트로피 오차(Cross Entropy Error) 등이 사용될 수 있으며, 오토 인코더(10)는 손실 함수(또는 손실값 또는 재구성 손실)을 최소화하도록 학습할 수 있다.At this time, the loss function of the auto encoder 10 (

) may use Mean Absolute Error (MAE) and Cross Entropy Error, etc., and the autoencoder 10 may learn to minimize the loss function (or loss value or reconstruction loss). .

On the other hand, the stacked auto encoder is a model in which the auto encoder 10 has a plurality of hidden layers, and since it has a deeper layer than a single auto encoder 10, it is more complex than the data learned in the auto encoder 10. You can learn about data.

At this time, the attack data detection device 10 according to an embodiment of the present invention may check the presence or absence of attack data by using the auto-encoder 10 or a pre-learned deep learning model based on the stacked auto-encoder.

Again, referring to FIG. 1, the pre-learned deep learning model used to detect the presence or absence of attack data in the attack data detection device 10 according to an embodiment of the present invention is normal data (or normal-class) and Among all data including attack data (abnormal class data), only normal data may be used to learn a loss function for normal data to be minimized.

In more detail, the attack data detection apparatus 100 according to an embodiment of the present invention inputs normal data (or normal class) to an auto-encoder, compresses it to a dimension lower than normal data, and then restores it to the dimension of normal data to obtain a vector value. It may be pre-learned to extract features of normal data through the process of outputting .

Hereinafter, normal data learned from the pre-learned deep learning model will be described.

The pre-learned deep learning model may be pre-learned using only normal data (normal data) and abnormal data (or attack data, attack) described in Table 1 below.

Here, abnormal data (or attack data, Attack) may include DoS, Probe, U2R, and R2L types.

Such a pre-learned deep learning model may be pre-learned so that a loss value (or loss function or reconstruction loss) between a value output by passing normal data through the deep learning model and normal data becomes small.

Therefore, since the pre-learned deep learning model is learned only for the features of normal data (or normal class) based on the auto-encoder, samples that are not used for learning that pass through the pre-learned deep learning model (e.g. , attack data) has a high loss function (or loss value or reconstruction loss), so it is possible to derive an effect of detecting a new type of attack data using the loss function.

For example, if new data that has not been trained in the pre-learned deep learning model is similar to the normal data used for training of the pre-trained deep learning model, the new data and the new data are passed through the pre-trained deep learning model. After that, the loss value with the output value may be less than the threshold value. In addition, if the new data is attack data that includes abnormal behavior that is not at all similar to the normal data used for learning the pre-learned deep learning model, after the new data and the new data pass through the pre-learned deep learning model, The loss value with the output value may exceed the threshold value.

Therefore, the attack data detection apparatus 100 according to an embodiment of the present invention sets a percentage value for a plurality of loss values calculated in the learning process of a pre-learned deep learning model as a threshold value, and based on the set threshold value can detect attack data.

)이 결정되며, 본 발명의 실시예에 따른 공격 데이터 탐지 장치(100)는 임계값(

)을 기준으로 정상 데이터 및 공격 데이터를 구분할 수 있다.For example, the threshold (

) is determined, and the attack data detection apparatus 100 according to an embodiment of the present invention has a threshold value (

), normal data and attack data can be distinguished.

Hereinafter, a detailed description of the threshold value of the attack data detection device 100 according to an embodiment of the present invention will be described in detail with reference to FIG. 4 .

For example, the processor 120 pre-processes data input from the outside in the input/output unit 101, passes the pre-processed data through a pre-learned deep learning model, and determines the loss value between the output value and the pre-processed data. When the set threshold value is exceeded, the input/output unit 101 may check data received from the outside as attack data. In addition, the processor 120, after pre-processing the data input from the outside in the input/output unit 101, passes the pre-processed data through a pre-learned deep learning model so that the loss value between the output value and the pre-processed data is a preset threshold. If the value is less than or equal to the value, the input/output unit 101 may check data received from the outside as normal data.

Here, the normal data may be at least one of text, image, and video containing information that does not cause damage to the network, and the attack data may be at least one of text image and video containing information that may cause damage to the network. can For example, the attack data may be data of Dos, Probe, U2R, and R2L types.

3 is a graph showing normal data and attack data confirmed through a pre-learned deep learning model according to an embodiment of the present invention.

Referring to FIG. 3, although normal data and attack data are distinguished through the output value of the pre-learned deep learning model, it can be confirmed that linear separation between normal data and attack data is not possible. Accordingly, a non-linear relationship from normal data It can be confirmed that separation of normal data and attack data is possible only when a learning model capable of modeling them is used.

Therefore, the attack data detection apparatus 100 according to an embodiment of the present invention performs learning using a deep learning model capable of nonlinear separation, and then detects the presence or absence of attack data using the previously learned deep learning model. In the learned deep learning model, the activation function of the auto encoder was also used as a nonlinear function to perform modeling.

4 is a graph showing loss value distributions of normal data and attack data output through an attack data detection device according to an embodiment of the present invention.

In the loss value distribution graph of FIG. 4 , the x-axis represents the loss value, and the y-axis represents the density of the loss value.

Referring to FIG. 4 , distribution graph data 400 located on the left is a loss value distribution of normal data (Normal), and distribution graph data 410 located on the right is a loss value distribution of attack data (Attack).

At this time, it can be confirmed that the loss value distribution of normal data and the loss value distribution of attack data are located apart from each other, and using the boundary between the loss value distribution of normal data and the loss value distribution of attack data as a threshold, It can be used to classify data and attack data.

For example, a boundary between a loss value distribution of normal data and a loss value distribution of attack data calculated in the learning process of a deep learning model may be set as a threshold value.

Therefore, when the attack data detection apparatus 100 according to an embodiment of the present invention passes the data input to the deep learning model and the data input to the pre-learned deep learning model, and the loss value between the output value is less than the threshold value, It is detected as normal data, and when the loss value exceeds the threshold value, it can be detected as attack data.

Hereinafter, attack data detection performance of the attack data detection apparatus 100 according to an embodiment of the present invention will be described with reference to FIGS. 5 and 6 .

First, in order to evaluate the performance of the attack data detection device 100 according to an embodiment of the present invention, the performance was compared using a confusion matrix, and accuracy, precision, and recall were compared. ), the performance of each model was compared and analyzed for the F1 score.

Hereinafter, the confusion matrix of the attack data detection device 100 according to an embodiment of the present invention can be represented as shown in Table 2 below.

Among the performance analyzed using the chaos matrix, accuracy refers to the ratio of the number of correctly predicted samples out of all samples. The higher the accuracy, the better the deep learning model. can be calculated through

More specifically, accuracy refers to the ratio of correctly predicting normal data (or normal traffic) and attack data (or attack traffic) in the entire training data set. In this case, a deep learning model using a training data set including imbalanced data may have low accuracy.

Precision refers to the ratio of the number of samples actually belonging to the positive class among samples output as belonging to the positive class, and can be calculated through Equation 6 below.

Recall refers to the ratio of the number of samples output as belonging to the positive class among samples belonging to the actual positive class, and can be calculated through Equation 7 below.

At this time, since precision and recall are mutually complementary evaluation indicators, if one value is forcibly increased, the other value may decrease. Therefore, the F1 Score can be checked. It is used for accurate evaluation and refers to the harmonic average of precision and recall.

At this time, the F1 Score can be calculated through Equation 8 below.

5 is a graph comparing performance of a learning model using an auto-encoder and a learning model learned through supervised learning.

Table 3 below is a table showing numerical values for the graph of FIG. 5 .

Referring to FIG. 5 and Table 3, learning models (Random Forest, Logistic Regression, Deep Neural Network, SVM, K-Neighbors) learned by the supervised learning method are trained with a training data set including normal data and attack data. and the auto encoder-based learning model (Stacked Auto Encoder) was learned with a training data set using only normal data.

Looking at this, when comparing the learning models learned by the supervised learning method and the auto-encoder-based learning model, the auto-encoder-based learning model has better performance (Accuracy, Precision, Recall, It can be seen that the value for F1 Score) is higher, and it can be seen that the value for performance shows a difference of up to about 10%.

Table 4 below shows detailed classification results for each performance (Precision, Recall, F1 Score, Support) and data (Normal, Attack) of the attack data detection device 100 according to an embodiment of the present invention.

Referring to Table 4, the precision and recall values are affected by the classification decision threshold, and the relationship between the two is a trade off relationship. If one index is excessively high, performance degradation occurs. However, it can be confirmed that the attack data detection apparatus 100 according to the embodiment of the present invention shows high values in both precision and recall values.

6 is a diagram showing an anomaly detection confusion matrix for an attack data detection apparatus according to an embodiment of the present invention.

Referring to FIG. 6, as a result of analyzing the learning result of the attack data detection device 100 according to an embodiment of the present invention with a confusion matrix, it is found that both normal data and attack data show high values. You can check.

7 is an exemplary flowchart of a procedure of a method for detecting attack data according to an embodiment of the present invention. The attack data detection method of FIG. 7 can be performed by the attack data detection device 100 shown in FIG. 1 . In addition, the attack data detection method shown in FIG. 7 is only exemplary.

Referring to FIG. 7 , the processor 120 may perform data preprocessing corresponding to the type of data input from the outside through the input/output unit 101 (step S10).

As an embodiment, when data received from the outside through the input/output unit 101 is first type data, the processor 120 encodes the first type data into an integer type and then performs one-hot encoding. By performing the process and outputting a vector value, data received from the outside in the input/output unit 101 may be preprocessed.

As another embodiment, the processor 120, when data received from the outside in the input/output unit 101 is second type data, performs min-max normalization on the second type data, so that 0 to 1 By outputting a value in between, the input/output unit 101 may pre-process data received from the outside.

Thereafter, the processor 120 may calculate a loss value (or loss function, or reconstruction loss) between the output value and the preprocessed data by passing the preprocessed data through the pre-learned deep learning model (step S20).

Thereafter, the processor 120 may check whether the data received from the input/output unit 101 is attack data based on the comparison between the calculated loss value and the threshold value (step S30).

For example, the processor 120 pre-processes data input from the outside in the input/output unit 101, passes the pre-processed data through a pre-learned deep learning model, and determines the loss value between the output value and the pre-processed data. When the set threshold value is exceeded, the input/output unit 101 may check data received from the outside as attack data.

In addition, the processor 120, after pre-processing the data input from the outside in the input/output unit 101, passes the pre-processed data through a pre-learned deep learning model so that the loss value between the output value and the pre-processed data is a preset threshold. If the value is less than or equal to the value, the input/output unit 101 may check data received from the outside as normal data.

As described above, since the attack data detection device according to an embodiment of the present invention uses a deep learning model pre-trained using normal data, it accurately detects whether or not an attack is detected than a deep learning model learned with imbalanced data. can detect

In addition, the attack data detection apparatus according to an embodiment of the present invention sets a percentage of a plurality of loss values (reconstruction loss values) calculated in the process of learning an auto-encoder-based deep learning model as a threshold value, and sets the set threshold value Since the presence or absence of attack data is determined based on , it is possible to detect new attack data other than normal data.

Combinations of each block of the block diagram and each step of the flowchart accompanying the present invention may be performed by computer program instructions. Since these computer program instructions may be loaded into an encoding processor of a general-purpose computer, special-purpose computer, or other programmable data processing equipment, the instructions executed by the encoding processor of the computer or other programmable data processing equipment are each block or block diagram of the block diagram. Each step in the flow chart creates means for performing the functions described. These computer program instructions may also be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular way, such that the computer usable or computer readable memory It is also possible for the instructions stored in to produce an article of manufacture containing instruction means for performing the function described in each block of the block diagram or each step of the flow chart. The computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operational steps are performed on the computer or other programmable data processing equipment to create a computer-executed process to generate computer or other programmable data processing equipment. It is also possible that the instructions performing the processing equipment provide steps for executing the functions described in each block of the block diagram and each step of the flowchart.

Additionally, each block or each step may represent a module, segment or portion of code that includes one or more executable instructions for executing specified logical function(s). It should also be noted that in some alternative embodiments it is possible for the functions recited in blocks or steps to occur out of order. For example, two blocks or steps shown in succession may in fact be performed substantially concurrently, or the blocks or steps may sometimes be performed in reverse order depending on their function.

The above description is merely an example of the technical idea of the present invention, and various modifications and variations can be made to those skilled in the art without departing from the essential qualities of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention, but to explain, and the scope of the technical idea of the present invention is not limited by these embodiments. The protection scope of the present invention should be construed according to the claims below, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

100: attack data detection device
101: input/output unit
102: communication department
110: memory
120: processor

Claims (12)

In the attack data detection method performed by the attack data detection device,
Performing data preprocessing corresponding to the type of data input from the outside;
Calculating a loss value between an output value and the preprocessed data by passing the preprocessed data through a pre-learned deep learning model;
Checking whether the data is attack data based on a comparison between the calculated loss value and a threshold value;
The threshold is
Percentage value of a plurality of loss values calculated in the learning process of the pre-learned deep learning model
How to detect attack data. According to claim 1,
The pre-learned deep learning model,
It is pre-learned to extract the features of the normal data through a process of inputting normal data to an auto-encoder, compressing it to a dimension lower than that of the normal data, restoring it to the dimension of the normal data and outputting a vector value
How to detect attack data. According to claim 2,
The pre-learned deep learning model,
Pre-learned so that the loss value between the value output by passing the normal data through the deep learning model and the normal data is small
How to detect attack data. According to claim 1,
The step of detecting the presence or absence of attack data is,
When the calculated loss value exceeds the threshold value, the data is identified as the attack data;
When the calculated loss value is less than the threshold value, confirming the data as normal data
How to detect attack data. According to claim 1,
Performing the preprocessing step,
If the data received from the outside is first type data, encoding the first type data into an integer type and then performing a one-hot encoding process to output a vector value;
When the data received from the outside is second type data, performing minimum-max normalization on the second type data
How to detect attack data. an input/output unit that receives data from the outside;
Memory; and
A processor electrically connected to the memory;
the processor,
Perform data pre-processing corresponding to the type of data input from the outside, pass the pre-processed data through a pre-learned deep learning model, calculate a loss value between an output value and the pre-processed data, Based on a comparison between a loss value and a preset threshold, it is determined whether the data is attack data;
The preset threshold is,
Percentage value of a plurality of loss values calculated in the learning process of the pre-learned deep learning model
Attack data detection device. According to claim 6,
The pre-learned deep learning model,
It is pre-learned to extract the features of the normal data through a process of inputting normal data to an auto-encoder, compressing it to a dimension lower than that of the normal data, restoring it to the dimension of the normal data and outputting a vector value
Attack data detection device. According to claim 7,
The pre-learned deep learning model,
Pre-learned so that the loss value between the value output by passing the normal data through the deep learning model and the normal data is small
Attack data detection device. According to claim 6,
the processor,
When the calculated loss value exceeds the threshold, confirming the data as the attack data;
When the calculated loss value is less than the threshold value, confirming the data as normal data
Attack data detection device. According to claim 6,
the processor,
When the data received from the outside is first type data, the first type data is encoded into an integer type, and then a one-hot encoding process is performed to output a vector value;
When the data input from the outside is second type data, performing minimum-max normalization on the second type data
Attack data detection device. A computer-readable recording medium storing a computer program,
When the computer program is executed by a processor,
Performing data pre-processing corresponding to the type of data input from the outside;
Calculating a loss value between an output value and the preprocessed data by passing the preprocessed data through a pre-learned deep learning model;
An instruction for causing the processor to perform a method including determining whether the data is attack data based on the comparison between the calculated loss value and a threshold value;
The threshold is
Percentage value of a plurality of loss values calculated in the learning process of the pre-learned deep learning model
A computer-readable recording medium. As a computer program stored on a computer-readable recording medium,
When the computer program is executed by a processor,
Performing data pre-processing corresponding to the type of data input from the outside;
Calculating a loss value between an output value and the preprocessed data by passing the preprocessed data through a pre-learned deep learning model;
An instruction for causing the processor to perform a method including determining whether the data is attack data based on the comparison between the calculated loss value and a threshold value;
The threshold is
Percentage value of a plurality of loss values calculated in the learning process of the pre-learned deep learning model
computer program.

Images