KR100776828B1 - Method for intrusion detection of ubiquitous home networks environment, recording medium thereof and apparatus for intrusion detection of ubiquitous home networks environment - Google Patents

Abstract

An intrusion detection method of a ubiquitous home network environment, a recording medium thereof, and an intrusion detection device in the ubiquitous home network environment are provided to offer detailed information on an attacking type by using clustering, to ensure expansibility and escalation of a system, and to ensure fast and efficient study and updating by targeting a class only of an attacking type while another class is not influenced when the new attacking type is detected. Classification for normal data and attacking data is performed by using a single class support vector machine from network traffic data(510). The classified attacking data is classified into passive attacks and active attacks to determine a risk level of the attacking data(520). Attacking types of the classified attacking data are classified by using multiple class support vector machines(530). Clustering using a kernel ART is performed according to each attacking type, and detailed information on the attacking types is generated(540). A coping method of a system is determined by using the risk level, the attacking types, and the detailed information(550).

Description

Intrusion detection method of ubiquitous home network environment, recording medium and intrusion detection device of ubiquitous home network environment {Method for intrusion detection of ubiquitous home networks environment, Recording medium etc and Apparatus for intrusion detection of ubiquitous home networks environment}

1 is a diagram illustrating an access path analysis in a home network environment to which the present invention is applied.

2 is a classification diagram according to attack types in a home network environment to which the present invention is applied.

3 is a conceptual diagram of an intrusion detection apparatus of a ubiquitous home network environment according to the present invention.

4 is a block diagram of an intrusion detection apparatus of a ubiquitous home network environment according to the present invention.

5 is a flowchart illustrating an intrusion detection method of a ubiquitous home network environment according to the present invention.

The present invention relates to intrusion detection, and more particularly, to an intrusion detection method in a ubiquitous home network environment, a recording medium thereof, and an intrusion detection apparatus in a ubiquitous home network environment.

According to a recent research study, since the wired / wireless technology of the home network is developed based on the existing technology, the external threats can be reflected in the home network environment. In addition, since there are more and more complex threats when building a home network that can be accessed anytime, anywhere, any device, any media, stable service and users The protection of information is very important.

Therefore, the importance of security to implement a security function from the beginning for the successful provision of services, and to protect user information and provide a stable service is emphasized more.

Such home network is a service that provides convenience at the center of life, so the user who is provided with the service has only as much concern about its dysfunction as convenience. Dysfunction includes many problems such as invasion of privacy, exposure of personal information, and theft of personal information, and the damage of the attacked user may be greater than that of the service. Therefore, in order to provide a successful service, security problems must be implemented from the outset to prevent such problems.

Home network environment requires intrusion and countermeasure system against illegal intrusion and malicious code inflow from outside for personal information protection and secure and convenient home network through security management by installing a system that integrates these solutions in house. The skill of living is essential.

Since such a security system including the conventional intrusion detection system is difficult to apply directly according to the special situation of the home network, the security system for the home network environment separately from the conventional security system should consider the following points.

First, most home network users do not have system expertise. Therefore, much of it, including system updates, needs to be automated. Second, since it is not operated by a trained security administrator, a user interface that is simple to use and easy to set policy should be simple and convenient to operate. Third, considering the cost of building a home network, it should be possible to build a system at low cost. Therefore, the system should operate lightly and lightly and operate without additional equipment or programs. Fourth, real time must be guaranteed so that home network intrusion can be handled before it affects the operation of information appliances. Fifthly, unlike conventional security products, home network devices aim to be distributed to each home, so mass production, mass supply and convenience of operation should be guaranteed.

Among the research trends on intrusion detection in wired and wireless networks, we tried to apply support vector machines (SVMs) to intrusion detection, which show very good performance in terms of pattern classification and function approximation. Research is being actively researched.

The first class uses the nature of the binary classifier, Support Vector Machine (SVM), to split the normal data and the attack data into two classes, and the second class is the one-class SVM. This is a method to implement an abnormal detection model using.

However, both of these methods only classify normal and abnormal data and do not provide additional information on the type of attack detected.

Finally, the third class constructs a multi-class SVM with a structure that trains a relatively large number of binary classifiers, support vector machines, to classify normal data and various attack types. This method is more advanced than the above two methodologies, but it is still different from the intelligent intrusion detection system, where the performance of the system is not only dependent on the quality of the learning data, but also requires a lot of learning time and can be practically applied to practical applications. It is far.

Therefore, the intrusion detection method does not provide additional information on the type of attack, and the performance of the system is not only dependent on the quality of the training data, but also requires a lot of learning time. There is a problem that cannot be determined.

Therefore, the first technical problem to be achieved by the present invention is to provide detailed information on the attack type by using clustering, to guarantee the system's incrementality and scalability, and to not affect other classes when detecting a new attack type. In this class, we can guarantee fast and efficient learning and update only for the class of attack type, and provide intrusion detection method of ubiquitous home network environment to determine systematic response method for detected attack type.

A second technical object of the present invention is to provide a computer-readable recording medium recording a program for executing the above-described intrusion detection method of a ubiquitous home network environment on a computer.

The third technical problem to be achieved by the present invention is to provide an intrusion detection apparatus of the ubiquitous home network environment to which the intrusion detection method of the ubiquitous home network environment is applied.

In order to achieve the first technical problem, the present invention performs classification of normal data and attack data using a single class support vector machine from network traffic data, and classifies the classified attack data into a passive attack and an active attack. Determining a risk level of the attack data; classifying an attack type of the classified attack data using a multi-class support vector machine; performing clustering using kernel ATI for each of the attack types; It provides a method for detecting intrusion in a ubiquitous home network environment, including generating detailed information about the network and determining a corresponding method of the system using the risk level, the attack type, and the detailed information.

In order to achieve the second technical problem, the present invention provides a computer-readable recording medium having recorded thereon a program for executing the above-described intrusion detection method of a ubiquitous home network environment on a computer.

In order to achieve the above-mentioned third technical problem, the present invention is a single class support vector machine which is trained by normal data and performs classification on normal data and attack data from network traffic data, passive attack and active classification of the classified attack data. A type classification unit for classifying an attack data to determine a risk level of the attack data, a multi-class support vector machine for classifying attack types of the classified attack data, and performing clustering for each attack type to obtain detailed information about the attack type. Provided is an intrusion detection apparatus of a ubiquitous home network environment including a kernel ATI to generate and an intrusion response system that determines a system response method using the risk level, the attack type, and the detailed information.

In addition, in order to achieve the third technical problem described above, the present invention is a single class support vector machine that is trained by normal data and performs classification on normal data and attack data from network traffic data, and passive attacks on the classified attack data. And a type classification unit for setting the risk level of the active attack to be higher than the risk level of the passive attack, a multi-class support vector machine for classifying the attack types of the classified attack data, and clustering by the attack type. Determine a corresponding method of the system using the kernel ATI and the risk level, the attack type, and the detailed information to generate detailed information on the attack type, and according to the determined method, a security sensor, a biosensor, Light sensor, temperature sensor and the above An intrusion detection apparatus of a ubiquitous home network environment including an intrusion response system for controlling home devices connected to a network is provided.

The present invention relates to a new intrusion detection model considering the ubiquitous home network environment as a model that maintains the advantages of the conventional intrusion detection method and the misuse detection model and abnormal detection model, but complements the disadvantages. The present invention relates to a home network intrusion detection system, and more particularly, to a home network multi-step multi-class intrusion detection system (HNMMIDS).

Intrusion detection model suitable for home network environment should satisfy the above considerations to protect user's information, while maintaining advantages of misuse detection and anomaly detection in wired and wireless network environment, but it is difficult to find new attack type. When discovering the type of attack, you need to overcome the limitation of not being able to respond properly because additional details are not known.

The present invention provides a method for detecting intrusion in a home network using a hierarchical structure of a kernel class, kernel class, or kernel art, which is a clustering algorithm of incremental update. do.

The present invention is an intrusion detection methodology considering the ubiquitous home network environment. In order to design an intrusion detection model suitable for home network environment, data mining and machine learning techniques applied in wired and wireless networks are utilized.

In the present invention, it is used to ensure the safety of privacy invasion, privacy protection, theft of personal information, etc. in the ubiquitous home network.

Intrusion detection method of the ubiquitous home network environment according to the present invention is performed by the following process. In other words, the intrusion detection method of the ubiquitous home network environment according to the present invention is a single class support vector machine trained by the normal data. Categorizing the two types of attacks into one granular type of attack by a multi-class support vector machine and providing additional information about the type of attack to the intrusion response system. If more detailed information is required, clustering for each attack type is performed by Kernel-ART, and attack-specific labeling can be achieved by using concept vectors without calculating a separate representative vector to summarize the contents of each cluster. Steps to provide risk level information and information on the attack data. Minimize damage by determining the countermeasures such as re-authentication, power off, and access control using the information of each type and detailed information on the attack.

That is, the present invention classifies the primary classification of the normal data and the attack data from the network traffic data, classifies the data classified as the attack into one attack type by the multi-class support vector machine, and provides more detailed information about the attack. For each type of attack, clustering is performed by Kernel-ART, which includes minimizing the damage by determining the risk level information and determining the response method based on the attack type information.

Hereinafter, with reference to the drawings will be described a preferred embodiment of the present invention. However, embodiments of the present invention illustrated below may be modified in various other forms, and the scope of the present invention is not limited to the embodiments described below.

1 is a diagram illustrating an access path analysis in a home network environment to which the present invention is applied.

The access path in the home network environment is divided into the access through the home network and the access through the home network. The outdoor network is a method of accessing through the internet network currently used by the external wired network and the external wireless network, and the home network is an approach using a protocol such as PLC or 802.11.

2 is a classification diagram according to attack types in a home network environment to which the present invention is applied.

Attack types in the home network are largely classified into passive attack and active attack. Passive attacks are subdivided into traffic analysis of transmitted / received data, analysis of data transmitted / received between wirelessly connected home devices, and breaches the privacy of service users by observing data transmitted / received in wired / wireless sections. Active attacks are subdivided into denial of service (DoS) such as service interruption and service failure, attack on the system itself, forgery of communication data, illegal access of home device, and invasion of privacy inside home through web camera.

3 is a conceptual diagram of an intrusion detection apparatus of a ubiquitous home network environment according to the present invention.

The support vector machine is very effective for pattern classification and function approximation by guaranteeing the global optimum of a given problem. Therefore, by using the support vector machine as a single class classifier (one-class SVM) that independently represents only the class, the decision boundary can be selected to classify the various attack types of the intrusion detection system.

-차원 입력공간상에 존재하는

-개의 데이터의 집합

이 주어졌을 경우, 각각의 클래스를 분류하기 위한 다 중 클래스 분류기는 각 클래스의 학습 데이터를 포함 하면서 체적을 최소화 하는 구체(sphere)를 구하는 문제로 정의되며, 다음의 최적화 문제를 통하여 수식화 된다.

Existing in the dimensional input space

Set of-data

Given this, the multi-class classifier for classifying each class is defined as the problem of finding a sphere that minimizes the volume while including the learning data of each class, and is formulated through the following optimization problem.

는

-번째 클래스를 표현하는 구체의 중심이고,

: 구체의 반경의 제곱이며,

는

-번째의 클래스에 속한

-번째 학습 데이터

가 구체에서 벗어나는 정도를 나타내는 벌점 항이고,

는 상대적 중요성을 조정하는 상수(trade-off constant)이다.here,

Is

The center of the sphere representing the -th class,

Is the square of the radius of the sphere,

Is

Belonging to the first class

-Th training data

Is the penalty term for the degree of deviation from the sphere,

Is a trade-off constant.

을 도입한다.Lagrange function to find the dual problem of equation (1)

Introduce.

이다.only,

to be.

에 대해서는 최소 값을 변수

에 대해서는 최대 값을 가져 야 함으로, 아래의 조건식을 만족해야 한다.Equation 2 is a variable

The minimum value for the variable

Since it should have the maximum value for, the following conditional expression must be satisfied.

에 대입하면, 다음의 쌍대 문제를 얻는다.Lagrange function

Substituting into, we get the following dual problem:

를 통하여 정의되는 고차원의 특징 공간(feature space)

위에서 정의되는 구체를 사용하는 방향으로 확장될 수 있다. 각각의 클래스는 각자의 특징공간에서 자신의 경계를 보다 정확하게 표현할 수 있으므로, 시스템의 학습은 각각의 클래스들이 매핑되는 특징공간의 독립성을 고려하여 아래의 QP 문제의 해답을 얻음으로써 이루어진다.Spheres defined above the input space can only represent very simple regions. Kernel fuctions to overcome this limitation

Higher feature space defined by

It may extend in the direction of using the spheres defined above. Since each class can express its boundary more accurately in its own feature space, the learning of the system is done by considering the independence of the feature space to which each class is mapped.

이 성립함으로 수학식 5 는 아래와 같이 단순화 된다.In particular, when using a Gaussian kernel,

With this, Equation 5 is simplified as follows.

In the application process after the end of learning, the decision function of each class is defined as follows.

값은 각 클래스의 특징 공간상의 경계로부터 해당 테스트 데이터와의 절대 거리를 의미함으로, 서로 다른 특징 공간상의 절대 거리를 비교하여 소속 클래스를 결정하는 것은 바람직하지 않다. 따라서, 특징 공간상의 절대거리

를 특징 공간상에서 정의되는 구형체의 반경

로 나눔으 로서 상대적 거리

를 계산하고, 상대 거리가 가장 큰 클래스를 입력 데이터

의 소속 클래스로 결정한다.Output of a single support vector machine defined in different feature spaces

Since the value represents the absolute distance from the boundary of the feature space of each class with the corresponding test data, it is not desirable to determine the belonging class by comparing the absolute distances of different feature spaces. Thus, absolute distance in feature space

The radius of a sphere defined in space

Divided by relative distance

Calculate and enter the class with the largest relative distance data

Decide on your class.

The overall system configuration of FIG. 3 is performed in five steps. A more detailed description of each step follows.

First, classify the normal data and the attack data. Next, the data classified as an attack are classified into a passive attack and an active attack. Classified as one type of attack by multi-class support vector machines for passive and active attacks. Next, when more detailed information about the attack is required, clustering for each attack type is performed by Kernel-ART. Kernel ALT is also called kernel art.

Finally, respond with detailed information about the attack.

4 is a block diagram of an intrusion detection apparatus of a ubiquitous home network environment according to the present invention.

An intrusion detection apparatus of a ubiquitous home network environment according to an embodiment of the present invention is as follows.

The single class support vector machine 410 classifies normal data and attack data from network traffic data. In addition, the single class support vector machine 410 is learned from normal data.

The type classifier 420 classifies the classified attack data into a passive attack and an active attack to determine a risk level of the attack data. Preferably, the type classifier 420 may include a single class support vector machine for classifying passive and active attacks. Preferably, the type classifier 420 may set the risk level of the active attack to be higher than the risk level of the passive attack.

The multi-class support vector machine 430 classifies the attack type of the classified attack data. At this time, the attack type is a denial of service (DoS) such as invasion of privacy of a service user, service interruption and service failure, an attack on the system itself, a forgery of communication data, illegal access of a home device, a web camera, etc. Privacy violations, and the like.

The kernel ATI 440 performs clustering for each attack type to generate detailed information about the attack type. That is, the detailed information is the result of clustering. The kernel ALT 440 may also be referred to as kernel art.

The intrusion response system 450 uses the risk level, attack type, and details to determine how to respond to the system. Preferably, the intrusion response system 450 may determine a response method of any one of re-authentication, power off, or access control according to the risk level, the attack type, and the detailed information.

An intrusion detection apparatus of a ubiquitous home network environment according to another embodiment of the present invention is as follows.

The single class support vector machine 410 classifies normal data and attack data from network traffic data. In addition, the single class support vector machine 410 is learned from normal data.

The type classifier 420 classifies the classified attack data into a passive attack and an active attack, and sets the risk level of the active attack to be higher than the risk level of the passive attack.

The multi-class support vector machine 430 classifies the attack type of the classified attack data.

The kernel ATI 440 performs clustering for each attack type to generate detailed information about the attack type.

The intrusion response system 450 uses the risk level, attack type, and details to determine how to respond to the system.

The intrusion response system 450 uses the risk level, the attack type, and the detailed information to determine how to respond to the system, and according to the determined response method, the security sensor, biosensor, light sensor, temperature sensor, and home devices connected to the network are determined. To control.

5 is a flowchart illustrating an intrusion detection method of a ubiquitous home network environment according to the present invention.

First, normal data and attack data are classified from network traffic data (S510).

Preferably, this process (510) may be a process of performing classification on the normal data and the attack data using a single class support vector machine learned from the normal data. Preferably, this process (step 510) may include generating a first alert to the intrusion response system when the attack data is classified.

Next, the classified attack data is classified into a passive attack and an active attack to determine a risk level of the attack data (step 520).

Preferably, the process 520 may include analyzing data transmitted / received between home devices from traffic of the attack data and analyzing data transmitted / received in a wired / wireless section. Preferably, this process (step 520) is based on the above analysis results, the attack data is a passive attack or distributed service denial attack that violates the privacy of the service user, the attack on the system itself, forgery of communication data, home devices It may include a process of classifying an active attack corresponding to an illegal access or a privacy violation inside a home. Preferably, this process (520) may include generating a second alert to the intrusion response system according to the classification result.

At this time, the risk level of the active attack may be set higher than the risk level of the passive attack.

Once the risk level is determined, the attack type of the classified attack data is classified using the multi-class support vector machine (S530). In this case, only the classifier of the corresponding class may be relearned as a learning method of incremental update.

Next, clustering using kernel ALT for each attack type is performed to generate detailed information on the attack type (step 540). In this case, labeling for each attack type may be provided using a concept vector to summarize the contents of each cluster.

Finally, the risk level, attack type, and details are used to determine how the system responds (step 550). In this case, any one of re-authentication, power off, or access control may be determined according to the risk level, attack type, and detailed information.

Therefore, the present invention is an intrusion detection model in consideration of the ubiquitous home network environment, while maintaining the advantages of the misuse detection and abnormal detection model in the conventional network environment, the disadvantages are complementary models. In particular, it is a new intrusion detection model considering the home network environment unlike the conventional security system because it is difficult to apply the security system, including the conventional intrusion detection system directly to the home network environment.

Preferably, a program for executing the intrusion detection method of the ubiquitous home network environment of the present invention on a computer may be provided by recording on a computer-readable recording medium.

The invention can be implemented via software. When implemented in software, the constituent means of the present invention are code segments that perform the necessary work. The program or code segments may be stored on a processor readable medium or transmitted by a computer data signal coupled with a carrier on a transmission medium or network.

The computer-readable recording medium includes all kinds of recording devices in which data is stored which can be read by a computer system. Examples of computer-readable recording devices include ROM, RAM, CD-ROM, DVD ± ROM, DVD-RAM, magnetic tape, floppy disks, hard disks, optical data storage devices, and the like. The computer readable recording medium can also be distributed over network coupled computer devices so that the computer readable code is stored and executed in a distributed fashion.

Although the present invention has been described with reference to one embodiment shown in the drawings, this is merely exemplary and will be understood by those of ordinary skill in the art that various modifications and variations can be made therefrom. However, such modifications should be considered to be within the technical protection scope of the present invention. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

As described above, according to the present invention, clustering can be used to provide detailed information on the attack type, to guarantee the incremental and scalability of the system, and to not affect other classes when detecting a new attack type. It can guarantee fast and efficient learning and updating only for the class of the attack type, and it is effective to determine the systematic response method to the detected attack type.

Claims (11)

Performing classification on the normal data and the attack data using a single class support vector machine from the network traffic data; Classifying the classified attack data into a passive attack and an active attack to determine a risk level of the attack data; Classifying an attack type of the classified attack data using a multi-class support vector machine; Generating detailed information on the attack type by performing clustering using kernel ATI for each attack type; And And determining the countermeasure of the system using the risk level, the attack type, and the detailed information. The method of claim 1, wherein the single class support vector machine, Intrusion detection method of the ubiquitous home network environment, characterized in that learned by the normal data. The method of claim 1, The classification of the normal data and the attack data may be performed. When the attack data is classified, intrusion detection method of the ubiquitous home network environment further comprising the step of generating a first warning to the intrusion response system. The method of claim 1, The classification into the passive attack and the active attack Analyzing data transmitted / received between home devices from the traffic of the attack data, and analyzing data transmitted / received in a wired / wireless section; According to the analysis results, the attack data is a passive attack or a distributed denial of service attack that infringes the privacy of a service user, an attack on the system itself, a forgery on communication data, an illegal access to a home device, and an active attack corresponding to a privacy violation inside a home. Classifying to; And And generating a second warning to the intrusion response system according to the classification result. Intrusion detection method of a ubiquitous home network environment, characterized by the above-mentioned. The method of claim 1, Categorizing the attack type of the classified attack data is Intrusion detection method of a ubiquitous home network environment comprising the step of re-learning only the classifier of the class in a learning method of incremental update. The method of claim 1, Generating detailed information about the attack type Intrusion detection method of a ubiquitous home network environment comprising the step of providing labeling by attack type using the concept vector to summarize the contents of each cluster. The method of claim 1, Determining a risk level of the attack data The risk level of the active attack is set higher than the risk level of the passive attack, Determining how to respond to the system And determining a corresponding method of re-authentication, power off, or access control according to the risk level, the attack type, and the detailed information. A computer-readable recording medium having recorded thereon a program for executing the method of claim 1 on a computer. A single class support vector machine that is learned by normal data and performs classification on normal data and attack data from network traffic data; A type classification unit for classifying the classified attack data into a passive attack and an active attack to determine a risk level of the attack data; A multi-class support vector machine for classifying attack types of the classified attack data; Kernel ATI for performing clustering for each attack type to generate detailed information about the attack type; And Intrusion detection apparatus of the ubiquitous home network environment including the intrusion response system for determining the response method of the system using the risk level, the attack type and the detailed information. The method of claim 9, The type classification unit The risk level of the active attack is set higher than the risk level of the passive attack, The intrusion response system Intrusion detection apparatus of the ubiquitous home network environment, characterized in that for determining the corresponding one of the re-authentication, power off or access control according to the risk level, the attack type and the detailed information. A single class support vector machine that is learned by normal data and performs classification on normal data and attack data from network traffic data; A type classification unit for classifying the classified attack data into a passive attack and an active attack to set a risk level of the active attack to be higher than a risk level of the passive attack; A multi-class support vector machine for classifying attack types of the classified attack data; Kernel ATI for performing clustering for each attack type to generate detailed information about the attack type; And The risk level, the attack type and the detailed information are used to determine the corresponding method of the system, and to control the security sensor, biosensor, light sensor, temperature sensor and home devices connected to the network according to the determined corresponding method. Intrusion detection device of a ubiquitous home network environment including a corresponding system.

Images