KR101394591B1 - Method, system and computer-readable recording medium for detecting intrusion of network - Google Patents

Abstract

The present invention relates to a method, a system and a computer readable recording medium for detecting intrusion into a network. The method for detecting the intrusion into the network by using a clustering method according to the present invention comprises the steps of (a) acquiring a cluster including a learned data set and a plurality of security sample units positioned at arbitrary positions and including information on cluster center; (b) calculating a fitness value of each security sample unit; (c) selecting a specific security sample unit among the security sample units and updating the information on the cluster center of the specific security sample unit by using the specific security sample unit; (d) classifying learned data included in the specific security sample unit according to a cluster on the cluster center by using the updated cluster center; (e) selecting the security sample unit having the largest fitness value among the security sample units; and (f) detecting a network packet by using the cluster center of the selected security sample unit.

Description

[0001] METHOD, SYSTEM AND COMPUTER READABLE RECORDING MEDIUM FOR DETECTING INTRUSION OF NETWORK [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method, system and computer readable medium for detecting intrusion of a network, and more particularly, to a method for detecting an intrusion of a network using a clustering technique, A system, and a computer-readable recording medium.

Conventional technologies for a secure Internet in general include intrusion detection techniques for cyber attacks such as hacking or abnormal excessive traffic. Such intrusion detection technology can be divided into misuse detection technology and abnormal detection technology as follows.

First, misuse detection technology is a method to predefine characteristic information of known attack type and perform detection based on it. Anomaly detection technology does not define characteristics of a specific attack type in advance, It is a method to judge an attack as data beyond the profile of the action. To generate such a model of the technology, a detection model is generated through a learning process using algorithms such as SVM, SOM, and K-means. K-means algorithms are used to cluster learning data and classify test data, but they can not grasp the detailed characteristics of detected attacks, and thus they are widely used.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems, and it is an object of the present invention to provide a secure sample unit which can update information of a cluster center included in a security sample unit, The success rate can be increased.

According to a first technical aspect of the present invention, there is provided a method for detecting a network intrusion using a clustering method, the method comprising: (a) detecting a cluster including a learned data set and center information of the cluster disposed at an arbitrary position; (B) calculating the fitness of each security sample unit; (c) selecting a particular security sample unit from among the plurality of security sample units and using the specific security sample unit Classifying the learned data included in the specific security sample unit into clusters for the cluster center using the updated cluster center, (e) ) Selecting a security sample unit with a high degree of fidelity among the plurality of security sample units; and (f) Lt; RTI ID = 0.0 > a < / RTI > cluster center of the network.

In the step (e), it is possible to select a security sample unit having a great degree of fitness among a plurality of security sample units generated by repeating the steps (b) to (d) at least once.

(C) selecting, as the specific security sample unit, a first security sample unit and a second security sample unit each having a high degree of fitness, and (i) selecting, from among the cluster centers included in the second security sample unit, A cluster center closest to the cluster center of the first secure sample unit and (ii) a cluster center of the first secure sample unit to update the cluster center of the first secure sample unit.

In the step (c), the cluster center of the specific security sample unit is updated by a value set by the user, and the variation may be larger as the fitness of the security sample unit is lower.

In the step (d), if the number of cluster centers included in the specific security sample unit is two or more, the learning data included in the specific security sample unit can be classified into clusters for each cluster center.

(B) to (d) are repeated several times, the security sample unit having the lowest fitness among the security sample units generated after the (b) to (d) The security sample unit generated after the (N-1) -th step is changed to the security sample unit having the highest fitness.

Further, in each security sample unit, the smaller the sum of the distances between the cluster center and each data included in the cluster, the greater the fitness can be judged.

In step (d), the learned data may be classified using a k-means algorithm.

In the step (f), it is possible to determine whether or not the network packet is intruded by using the cluster center and the distance of the network packet and the selected security sample unit.

According to a second technical aspect of the present invention, there is provided a system for detecting a network intrusion using a clustering technique, the system comprising: a cluster including a learned data set; and a plurality of A fitness calculator for acquiring a security sample unit and calculating a fitness of each security sample unit, a selection unit for selecting a specific security sample unit among the plurality of security sample units, A cluster update unit that updates the information and classifies the learned data included in the specific security sample unit into the cluster for the cluster center using the updated cluster center and a security update unit that classifies security samples Unit, and the selected security sample unit cluster And a network security monitoring unit for detecting network packets using the network center.

According to the present invention, there is provided a method for detecting an intrusion of a network using a clustering technique, comprising: updating a cluster center included in a plurality of security sample units to select a security sample unit having a high degree of fitness, , Thereby increasing the success rate of intrusion detection.

1 is a block diagram illustrating a system for detecting an intrusion of a network according to an exemplary embodiment of the present invention.
FIG. 2 is a flowchart illustrating a method of detecting an intrusion of a network according to an exemplary embodiment of the present invention. Referring to FIG.
FIG. 3 is a diagram for explaining updating of cluster center information according to an embodiment of the present invention. Referring to FIG.
4 is a diagram for explaining a method of detecting a network packet using a cluster center included in a selected security sample unit.

The following detailed description of the invention refers to the accompanying drawings, which illustrate, by way of illustration, specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that the various embodiments of the present invention are different, but need not be mutually exclusive. For example, certain features, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the invention in connection with an embodiment. It is also to be understood that the position or arrangement of the individual components within each disclosed embodiment may be varied without departing from the spirit and scope of the invention. The following detailed description is, therefore, not to be taken in a limiting sense, and the scope of the present invention is to be limited only by the appended claims, along with the full scope of equivalents to which such claims are entitled, if properly explained. In the drawings, like reference numerals refer to the same or similar functions throughout the several views.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings, so that those skilled in the art can easily carry out the present invention.

1 is a block diagram illustrating a system for detecting an intrusion of a network according to an exemplary embodiment of the present invention.

1, a system for detecting an intrusion of a network according to the present invention may include a fitness calculation unit 110, a cluster update unit 120, a network security monitoring unit 130, and a control unit 100 . First, the fitness calculator 110 according to an embodiment of the present invention performs a function of acquiring a plurality of security sample units (so-called individuals) in a system for detecting a network intrusion using a clustering technique. The secure sample unit comprises a cluster of learned data sets and a cluster of clusters located at an arbitrary location, each secure sample unit comprising the same learned data set, There may be multiple centers of clusters and clusters involved. For reference, the learned data may be data already known by the user. In addition, the fitness calculator 110 according to the present invention can calculate the fitness value of the secure sample unit. The fitness of the secure sample unit can be calculated using Equation (1) below.

As f (x) is a fitness function, the larger the value of the distance between each cluster data center and the cluster data, the larger the value of Jc. In other words, a low fitness indicates that a false positive rate may be high if the center of the cluster is located at an inappropriate position and is far away from the data contained in the cluster, . On the contrary, the smaller the sum of the distance between each data included in the cluster and the center of the cluster is, the greater the fitness becomes. This means that the success rate of intrusion detection is high in detecting the intrusion of the network into the center of the cluster .

The cluster updating unit 120 according to an embodiment of the present invention may select a specific security sample unit from among a plurality of security sample units and update the cluster center information of a specific security sample unit using the selected specific security sample unit . Updating the cluster center information of a specific security sample unit may be a process for locating the center of the cluster with high success rate of intrusion detection of the network. Hereinafter, a method for updating cluster center information of a specific security sample unit will be described in detail. As one method of updating the cluster center information, first, two security sample units having a large fitness among a plurality of security sample units are selected. When it is desired to update the cluster center information A'1 of the first security sample unit among the selected two security sample units, the cluster center A'1 of the first security sample unit among the cluster centers included in the second security sample unit The center B'1 may be selected and the cluster center information of the first security sample unit may be updated from A'1 to A 'according to the following equation (2).

At this time, the cluster center B'1 of the second security sample unit used for updating the information of the cluster center A'1 of the first security sample unit is updated to the cluster center having the information of B 'according to the following equation (3) (So-called crossover process of the genetic algorithm).

For reference, r in Equations 2 and 3 may be a random variable between 0 and 1 with no conditions. When there are a plurality of cluster centers included in the security sample unit, the information updating process of the cluster center may be repeated using equations (2) and (3) for the center of each cluster.

As another method of updating the cluster center information, the cluster center of the specific security sample unit can be updated by changing the value set by the user. That is, as shown in Equation (4), the cluster center X1 of the specific security sample unit can be changed by the user's set M and updated to the cluster center having the information of X.

At this time, the M value may be changed according to the fitness of the specific security sample unit. The larger the fitness value, the smaller the M value and the lower the fitness value, the larger the M value (so-called genetic algorithm mutation process). That is, the probability of forming a security sample unit having a high degree of fitness can be increased by changing the center of the cluster to a security sample unit, which is expected to have a low probability of intrusion detection due to low fitness. In the case of a security sample unit with a high fitness, it is expected that the success rate of the intrusion detection of the network is high, so that the change rate of the center of the cluster can be reduced.

The cluster updating unit 120 according to an embodiment of the present invention can perform a function of classifying the learned data included in a specific security sample unit into a cluster for the cluster center using the updated cluster center. Classifying the learned data may be a process for determining which clusters for which clustered center each of the learned data is included and calculating the fitness of future secure sample units. In this case, the data can be classified using the k-means algorithm. When there are a plurality of cluster centers included in a specific security sample unit, the learned data can be classified into clusters for each cluster center. In this case, when the cluster update unit 120 is repeatedly operated to generate a secure sample unit, the security sample unit having the lowest fitness among the security sample units generated by operating the cluster update unit 120 N times, The security sample unit 120 may be replaced with the security sample unit having the highest fitness among the generated security sample units.

The network security monitoring unit 130 according to an exemplary embodiment of the present invention selects one of the plurality of security sample units generated through the cluster updating unit 120 having a large degree of fitness, And performs a function of detecting a packet. At this time, it is possible to determine whether the network packet is malicious information or normal information by searching the cluster center close to the network packet.

FIG. 2 is a flowchart for explaining a method of detecting intrusion of a network according to an embodiment of the present invention. FIG. 3 is a view for explaining updating of cluster center information according to an embodiment of the present invention. For convenience of explanation in FIG. 3, a process of updating information of a cluster center of one specific security sample unit according to a step is shown. Hereinafter, a method for detecting an intrusion of a network will be described in detail with reference to FIGS. 2 and 3. FIG.

A method for detecting an intrusion of a network according to an embodiment of the present invention starts with obtaining a secure sample unit (S210). For example, the secure sample unit includes the learned data 30 and the cluster centers C1, C2, and initially the cluster centers C1, C2 can be located at any location, such as the secure sample unit 310. [ The learned data of FIG. 3 and the network packet to be described below with reference to FIG. 4 can be represented by a dot after the number of features included in the data or network packet is digitized through a predetermined algorithm. The secure sample units 320 to 360 are security sample units according to the process in which the cluster center of the 310 secure sample units are updated step by step. The learned data 30 of the secure sample unit can be classified into clusters for each cluster center depending on the distance from each cluster center. That is, the data represented in black in the 310 secure sample units can be classified in red and blue, as is the data in 320 secure sample units. The learned data 30 indicated in red belongs to the cluster center C1, and the learned data 30 indicated in blue belongs to the cluster center C2.

After the learned data 30 is classified for each of the cluster centers C1 and C2 arbitrarily arranged like the security sample unit 320, the fitness of the secure sample unit can be calculated (S220). After calculating the fitness of the secure sample unit, the information of the cluster center of the secure sample unit may be updated (S230). The cluster centers C1, C2 of the 330 secure sample units may be updated from the cluster centers C1, C2 of 320 secure sample units. In FIG. 3, although only one security sample unit is illustrated for the sake of convenience, a plurality of security sample units such as 320 security sample units may exist (however, information of cluster centers may be different for each security sample unit) ), A specific security sample unit among a plurality of security sample units can be selected and updated to a cluster center of 330 security sample units by the method according to Equations 1 to 4 described above. When the information of the cluster center of the secure sample unit is updated, the learned data can be classified according to the information of the updated cluster center (S240). Referring to 320 secure unit samples and 340 secure unit samples, it can be seen that the learned data is classified differently as the cluster center changes.

According to an embodiment of the present invention, the process of calculating the fitness of the secure sample unit, updating the cluster center information, and classifying the learned data according to the updated cluster center may be repeated several times. Accordingly, the cluster centers C1 and C2 of the 340 secure sample units are updated to the cluster centers C1 and C2 of the 350 secure sample units, and the learned data 30, such as 360 security sample units, is updated according to the information of the updated cluster center Can be classified. The process of updating the security sample unit from 340 to the cluster center of the security sample unit of 350 is the same as the process of updating from the security sample unit of 320 to the cluster center of 330 of the secure sample unit. The above process is repeated to select a security sample unit having a high degree of fitness (S250), and the network packet may be detected according to the cluster center included in the selected security sample unit (S260).

4 is a diagram for explaining a method of detecting a network packet using a cluster center included in a selected security sample unit. The rounded points are network packets 410 that should be judged to be malicious, and C1 and C2 are optimal cluster centers selected according to one embodiment of the present invention. Referring to FIG. 4, the information of the network packet 410 can be known by using the distance between the cluster centers C1 and C2 and the network packet 410. For example, when the cluster center C1 is related to normal data and C2 The network packet indicated by the red dot has information similar to that of the cluster center C1 and the network packet indicated by the blue dot has information similar to the cluster center C2.

The embodiments of the present invention described above can be implemented in the form of program instructions that can be executed through various computer components and recorded on a computer-readable recording medium. The computer-readable recording medium may include program commands, data files, data structures, and the like, alone or in combination. The program instructions recorded on the computer-readable recording medium may be those specially designed and constructed for the present invention or may be those known and used by those skilled in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules for performing the processing according to the present invention, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, Those skilled in the art will appreciate that various modifications, additions and substitutions are possible, without departing from the scope and spirit of the invention as disclosed in the accompanying claims.

Therefore, the spirit of the present invention should not be construed as being limited to the above-described embodiments, and all of the equivalents or equivalents of the claims, as well as the following claims, I will say.

100:
110: fitness calculator
120: Cluster Update Unit
130: Network security monitoring unit
C1, C2: Cluster Center
30: Learned data
410: network packet

Claims (19)

A method for detecting a network intrusion using a clustering technique,
(a) obtaining a plurality of security sample units including a cluster including a learned data set and center information of the cluster disposed at an arbitrary position;
(b) calculating a fitness of each secure sample unit;
(c) selecting a specific security sample unit among the plurality of security sample units and updating the cluster center information of the specific security sample unit using the specific security sample unit;
(d) classifying the learned data included in the specific security sample unit into clusters for the cluster center using the updated cluster center;
(e) repeating the steps (b) to (d) at least once to generate a plurality of security sample units including the updated cluster center information, and generating a plurality of security sample units, Selecting a unit; And
(f) detecting a network packet using the cluster center of the selected secure sample unit,
In the case of repeating the steps (b) to (d)
The security sample unit having the lowest relevance among the security sample units generated after the steps (b) to (d) progresses N times is a security sample unit that is generated after the steps (b) to (d) Wherein the security sample unit is replaced with the security sample unit having the greatest fitness among the units. delete The method according to claim 1,
In the step (c)
Selecting a first security sample unit and a second security sample unit having a high degree of fitness as the specific security sample unit, and selecting (i) a cluster center of the first security sample unit among the cluster centers included in the second security sample unit, And (ii) the cluster center of the first secure sample unit is used to update the cluster center of the first secure sample unit. The method according to claim 1,
In the step (c)
Wherein the cluster center of the specific security sample unit is updated and changed by a value set by the user, and the change amount is larger as the fitness of the security sample unit is lower. The method according to claim 1,
The step (d)
And classifying the learning data included in the specific security sample unit into clusters for each cluster center if the number of cluster centers included in the specific security sample unit is two or more. delete The method according to claim 1,
For each secure sample unit,
Wherein the smaller the sum of the distances between the cluster center and each of the data included in the cluster, the greater the fitness of the network intrusion detection method. The method according to claim 1,
In the step (d)
And classifying the learned data using a k-means algorithm. The method according to claim 1,
In the step (f)
Wherein the network intrusion detection method comprises determining whether an intrusion is made using the network packet and the distance between the cluster center and the selected security sample unit. A system for detecting a network intrusion using a clustering technique,
A fitness calculator for acquiring a cluster including the learned data set and a plurality of security sample units including center information of the cluster disposed at an arbitrary position and calculating a fitness of each security sample unit;
Selecting a specific security sample unit among the plurality of security sample units and updating the cluster center information of the specific security sample unit using the specific security sample unit, A cluster updating unit for classifying the learned data into clusters for the cluster center; And
Generating a plurality of security sample units including the updated cluster center information, selecting a security sample unit having a large fitness among the generated plurality of security sample units, and using the cluster center of the selected security sample unit, And a network security monitoring unit that detects the network security monitoring unit,
The network security monitoring unit,
When the cluster update unit is repeatedly operated to generate a plurality of secure sample units,
The security sample unit having the lowest fitness among the security sample units generated by operating the cluster update unit N times is replaced with the security sample unit having the highest fitness among the security sample units generated by operating the cluster update unit in the N- The network intrusion detection system comprising: delete 11. The method of claim 10,
The cluster updating unit,
Selecting a first security sample unit and a second security sample unit having a high degree of fitness as the specific security sample unit, and selecting (i) a cluster center of the first security sample unit among the cluster centers included in the second security sample unit, And (ii) the cluster center of the first secure sample unit to update the cluster center of the first secure sample unit. 11. The method of claim 10,
The cluster updating unit,
Wherein a cluster center of the specific security sample unit is updated by changing a value set by a user and a change amount of the security sample unit is larger as the fitness of the security sample unit is lower. 11. The method of claim 10,
The cluster updating unit,
And classifies the learning data included in the specific security sample unit into clusters for each cluster center if the number of cluster centers included in the specific security sample unit is two or more. delete 11. The method of claim 10,
For each secure sample unit,
Wherein the smaller the sum of the distances between the cluster center and each of the data included in the cluster, the greater the fitness of the network intrusion detection system. 11. The method of claim 10,
The cluster updating unit,
And classifies the learned data using a k-means algorithm. 11. The method of claim 10,
The network security monitoring unit,
Wherein the network intrusion detection system determines whether an intruder is intruding using the network packet and the distance between the cluster center and the selected security sample unit. delete

Images