KR101927100B1 - Method for analyzing risk element of network packet based on recruuent neural network and apparatus analyzing the same - Google Patents

Abstract

The present invention relates to a technology for analyzing a risk of a network packet based on a cyclic neural network, comprising: a packet input unit for receiving successive first and second packets from a transmitting end in a session; A first risk factor determiner for predicting a data characteristic and determining a risk factor based on a degree of similarity between a data characteristic of the next packet and a data characteristic of the second packet; And a loop neural network learning unit for performing a loop neural network learning on the second packet when the re-crystallization proceeds, thereby updating the circular neural network model.

Description

TECHNICAL FIELD [0001] The present invention relates to a method of analyzing a risk of a network packet based on a cyclic neural network, and a cyclic neural network based network packet analyzing apparatus,

The present invention relates to a technology for analyzing a risk of a network packet based on a cyclic neural network, and more particularly, to a technique for analyzing a risk of a network packet by implementing a circular neural network model according to each failure situation, And an apparatus for analyzing a risk of a packet.

Conventional network performance and failure monitoring techniques only check the transmission performance and the communication failure by monitoring the size and frequency component of the received data. Recently, due to the emergence of various types of wired and wireless multimedia services based on Internet of Things (IoT), the risk from various external intrusions such as viruses has been continuously increasing as it has evolved into an open network form.

Since the physical layer of the next generation network is highly likely to use a large capacity optical link accommodating the Internet based wired and wireless multimedia services, it is necessary to monitor the real time performance of the network in order to transmit the large amount of data stably.

Korean Patent Laid-Open No. 10-2015-0110065 relates to a malicious code detection method and system based on executable file monitoring, wherein the executable file monitoring agent extracts executable file information from a packet exchanged between the control network and the local control network, And transmits the generated malicious code to the malicious code detection device, and the malicious code detection device starts a technique for determining whether the malicious code is infected with the execution file based on the received execution file information.

Korean Patent Laid-Open No. 10-2011-0057628 relates to an apparatus and method for analyzing a malicious file information-based association collected on a network, and relates to information collected on a network, a scenario definition table based on a malicious code propagation path, Of the attacked server, the attacked server, and the attacked state information based on the information of the suspected malicious file as a malicious file after comparing the associations between the tables. Technology.

Korean Patent Publication No. 10-2015-0110065 (Oct. 20, 2015) Korean Patent Publication No. 10-2011-0057628 (June 1, 2011)

One embodiment of the present invention is to provide a cyclic neural network based network capable of analyzing the risk factors of network packets by implementing a circular neural network model according to each failure situation and using the learned circular neural network model through data (or signal) And to provide a device for analyzing the risk of a packet.

An embodiment of the present invention provides a device for analyzing a risk of a network packet based on a circular neural network capable of learning a circular neural network model in which a network is implemented after implementing a circular neural network model corresponding to each failure situation .

Among the embodiments, the apparatus for analyzing a network packet based on a cyclic-neural network includes a packet input unit for receiving first and second consecutive packets in a session from a transmitting end, a cyclic neural network model applied to the first packet, A first risk factor determiner for predicting a characteristic of the second packet and determining a risk factor based on a similarity between the data characteristic of the next packet and the data characteristic of the second packet; And a circular neural network learning unit for performing a circular neural network learning on the second packet when the recrystallization proceeds, thereby updating the circular neural network model.

The first risk factor determiner may determine that the session is safe if the data characteristics of the next packet are predicted to be normal and the similarity is greater than or equal to the specific criterion.

The first risk factor determiner may determine that the data characteristic of the next packet is predicted to be abnormal and that the session is unstable if the similarity is higher than the specific criterion. The first risk factor determiner may verify the session by performing Deep Packet Inspection (DPI) on the packets transmitted and received during a past specific time through the session.

The second risk factor determiner may generate a virtual machine dedicated to the session, and may isolate the first and second packets through the virtual machine to detect the presence or absence of a malicious code. And the second risk factor determiner may execute a circular neural network learning agent in the virtual machine before executing the quarantine to extract data characteristics of the second packet.

The second risk factor determiner may provide the loop neural network learning unit with the existence of the malicious code and the data characteristic of the second packet through the loop neural network learning agent after the quarantine execution. The second risk determining unit may calculate a probability of existence of a malicious code indicating the possibility that the malicious code is present based on at least one of a resource permission request content and a resource usage amount appearing when the first and second packets are quarantined. The second risk determining unit may determine that the malicious code exists if the probability of existence of the malicious code exceeds a specific criterion.

The Cyclic Neural Network Learning Unit may perform supervised learning based on the second packet and the redetermined risk component for predicting the data characteristics of the next packet. Wherein the loop neural network learning unit receives the data characteristic of the second packet through the loop neural network learning agent and whether the malicious code exists in the first and second packets as the redetermined risk element, .

The data characteristic may correspond to a compressed bitmap of data included in the packet.

Among the embodiments, a method for analyzing a risk of a network packet based on a circular neural network is performed in a risk analyzing apparatus for a network packet based on a circular neural network. The method comprises the steps of: (a) receiving first and second consecutive packets in a session from a transmitting end; (b) applying a circular neural network model to the first packet to predict data characteristics of the next packet, Determining a risk factor based on a degree of similarity between a data characteristic and a data characteristic of the second packet; (c) if the similarity is less than a specific criterion, performing a risk analysis on the second packet to re- And (d) performing recurrent neural network learning on the second packet when the recrystallization proceeds, thereby updating the circular neural network model.

The step (b) may include determining that the data characteristic of the next packet is normal and that the session is secure if the similarity is greater than the specific criterion.

The step (b) may include determining that the data characteristic of the next packet is predicted to be abnormal and the session is unstable if the similarity is greater than the specific criterion. The step (b) may further include a step of performing Deep Packet Inspection (DPI) on packets that have been transmitted and received during a specific time in the past through the session to verify the session.

The step (c) may include generating a virtual machine dedicated to the session, and isolating the first and second packets through the virtual machine to detect the presence or absence of the malicious code. The step (c) may further include the step of executing a circular neural network learning agent in the virtual machine before executing the isolation to extract data characteristics of the second packet.

The step (d) may include performing supervised learning based on the second packet and the redetermined risk element for prediction of a data characteristic of the next packet. The step (d) includes receiving data characteristics of the second packet through the CNN learning agent and whether the malicious code exists in the first and second packets as the re-determined risk element, The method comprising the steps of:

The disclosed technique may have the following effects. It is to be understood, however, that the scope of the disclosed technology is not to be construed as limited thereby, as it is not meant to imply that a particular embodiment should include all of the following effects or only the following effects.

The apparatus for analyzing a network packet based on a cyclic neural network according to an embodiment of the present invention realizes a cyclic neural network model according to each fault situation and uses a cyclic neural network model learned through data (or signal) The risk factors of

The apparatus for analyzing the risk of a network packet based on a cyclic neural network according to an embodiment of the present invention can implement a cyclic neural network model corresponding to each fault situation and then learn a cyclic neural network model in which the network is implemented.

1 is a view for explaining a risk element analysis system of a network packet based on a cyclic neural network according to an embodiment of the present invention.
FIG. 2 is a block diagram illustrating an apparatus for analyzing a risk of a network packet based on a cyclic-neural network in FIG.
FIG. 3 is a flowchart illustrating in detail a risk element analysis process of a network packet based on a circular neural network.
4 is a flow chart for explaining a risk analysis process of a network packet based on a circular neural network.

The description of the present invention is merely an example for structural or functional explanation, and the scope of the present invention should not be construed as being limited by the embodiments described in the text. That is, the embodiments are to be construed as being variously embodied and having various forms, so that the scope of the present invention should be understood to include equivalents capable of realizing technical ideas. Also, the purpose or effect of the present invention should not be construed as limiting the scope of the present invention, since it does not mean that a specific embodiment should include all or only such effect.

Meanwhile, the meaning of the terms described in the present application should be understood as follows.

The terms "first "," second ", and the like are intended to distinguish one element from another, and the scope of the right should not be limited by these terms. For example, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component.

It is to be understood that when an element is referred to as being "connected" to another element, it may be directly connected to the other element, but there may be other elements in between. On the other hand, when an element is referred to as being "directly connected" to another element, it should be understood that there are no other elements in between. On the other hand, other expressions that describe the relationship between components, such as "between" and "between" or "neighboring to" and "directly adjacent to" should be interpreted as well.

It is to be understood that the singular " include " or "have" are to be construed as including the stated feature, number, step, operation, It is to be understood that the combination is intended to specify that it does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

In each step, the identification code (e.g., a, b, c, etc.) is used for convenience of explanation, the identification code does not describe the order of each step, Unless otherwise stated, it may occur differently from the stated order. That is, each step may occur in the same order as described, may be performed substantially concurrently, or may be performed in reverse order.

The present invention can be embodied as computer-readable code on a computer-readable recording medium, and the computer-readable recording medium includes all kinds of recording devices for storing data that can be read by a computer system . Examples of the computer-readable recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like, and also implemented in the form of a carrier wave (for example, transmission over the Internet) . In addition, the computer-readable recording medium may be distributed over network-connected computer systems so that computer readable codes can be stored and executed in a distributed manner.

All terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs, unless otherwise defined. Commonly used predefined terms should be interpreted to be consistent with the meanings in the context of the related art and can not be interpreted as having ideal or overly formal meaning unless explicitly defined in the present application.

1 is a view for explaining a risk element analysis system of a network packet based on a cyclic neural network according to an embodiment of the present invention.

Referring to FIG. 1, the RNetwork-based network packet risk analysis system 100 includes a transmitting end 110, a receiving end 120, and a risk analysis device 130 of a circular network-based network packet.

(OLT) 110 is a transmission terminal that can be managed by a communication service provider, for example, a broadband service connection function such as an interface function in a packet switched public data network (PSPDN) to an optical line terminal . The transmitting terminal 110 can transmit data (signal) of the network to the receiving terminal 120.

The optical network unit (ONU) 120 is a receiving terminal for a communication service user, for example, a light network terminating apparatus that converts an optical signal received through an optical fiber in an optical communication network into an electrical signal, Can be converted into an optical signal. The receiving end 120 can receive data (signal) from the transmitting end 110.

The risk analysis device 130 of the network packet based on the Cyclic Neural Network constructs a risk analysis server of the network packet based on the Cyclic Neural Network and transmits the data transmitted from the transmitting end 110, which is located between the transmitting end 110 and the receiving end 120, Signal) can be analyzed through a circular neural network model to detect dangerous elements such as viruses and malicious codes. Here, a Recurrent Neural Network (RNN) is a neural network in which a connection between units constituting an artificial neural network (ANN) constitutes a directional cycle. More specifically, a circular neural network has a loop Network, and can continuously update the loop through the data (signal) transmitted from the transmitting terminal 110. [

In one embodiment, the risk analysis device 130 of the network packet based on the cyclic neural network can implement a circular neural network model according to each fault situation using the physical layer of the software-based open network. The risk analysis device 130 of the network packet based on the cyclic neural network can apply the implemented cyclic neural network model to the transmission terminal 110 and the reception terminal 120 of the network to perform pattern learning according to each fault situation. More specifically, the apparatus for analyzing the network packet based on the cyclic neural network analyzes the data (signal) received at the receiving end 120, compares the analyzed data (signal) with the learned cyclic neural network model, Malicious code, and the like, and it is possible to analyze transmission performance degradation or failure in real time and perform monitoring.

FIG. 2 is a block diagram illustrating an apparatus for analyzing a risk of a network packet based on a cyclic-neural network in FIG.

Referring to FIG. 2, the apparatus for analyzing a network packet based on a cyclic-neural network includes a packet input unit 210, a first risk determining unit 220, a second risk determining unit 230, (240) and a control unit (250).

The packet input unit 210 may be located between the transmitting terminal 110 and the receiving terminal 120 and may receive the first and second consecutive packets in the session from the transmitting terminal 110. In one embodiment, the packet input unit 210 may receive continuous data (signals) transmitted from the transmitting terminal 110 to the receiving terminal 120. In another embodiment, the packet input unit 210 may copy the continuous data (signal) transmitted and received to detect a dangerous element.

The first risk factor determining unit 220 may apply the rotation neural network {RNN_ _h} to the first packet received through the packet input unit 210 to predict the data attribute of the next packet, where the data characteristics are packet , And the compressed bitmap can be generated by compressing a hash code or extracting and compressing some data such as a bit table or the like. The first risk factor determiner 220 may calculate the similarity by comparing the data characteristic of the predicted next packet with the data characteristic of the second packet and may determine the risk factor based on the calculated similarity.

The first risk determining unit 220 can determine whether the next packet is normal or not and can determine the state of the session according to the similarity between the data characteristic of the next packet and the data characteristic of the second packet. In one embodiment, the first risk factor determiner 220 may determine that the session is secure if the data characteristic of the next packet is predicted to be normal and the similarity with the data characteristic of the second packet is more than a specific criterion.

In another embodiment, the first risk factor determination unit 220 can determine that the data quality of the next packet is predicted to be abnormal, and that the session is unstable if the degree of similarity with the data characteristic of the second packet is higher than a specific criterion. More specifically, if the data characteristic of the next packet is predicted to be abnormal, the first risk factor determination unit 220 may perform a deep packet analysis on packets that were transmitted and received during a specific time in the past through the session to verify the session . Here, Deep Packet Inspection (DPI) is a technique for grasping and analyzing data transmitted through the Internet, that is, the actual contents of a packet. For example, the first risk determining unit 220 may collect packets transmitted and received during the past one week in the session, and may analyze the collected packets in depth to perform the corresponding session verification. Through this process, the first risk factor determiner 220 can determine that the session is secure based on the in-depth packet analysis result even if the data characteristic of the next packet is predicted to be abnormal.

If the similarity between the data characteristic of the next packet and the data characteristic of the second packet is less than a specific criterion, the second risk factor determiner 230 can perform a risk analysis on the second packet to redetermine the risk factor, factor determining unit 230 may create a virtual machine VM_ _{s} of the session only to recrystallization the risk.

The second risk factor determination unit 230 through the resulting virtual machine {VM_ _s} can be executed to isolate the first and second packets, through these isolated execution second risk factor determining unit 230 is malicious The presence or absence of the code can be detected. In one embodiment, the second risk factor determining unit 230 executes the first packet and the virtual machine {VM_ _s} Recurrent Neural Network learning agent in prior to running isolate the second packet to extract the data attributes in a second packet can do.

The second risk determining unit 230 isolates and executes the first and second packets, and then determines whether a malicious code exists in the loop neural network learning unit 240 and a data characteristic of the second packet through the loop neural network learning agent And the Cyclic Neural Network Learning Unit 240 can learn and store the existence of the malicious code provided from the second risk determining unit 230 and the data characteristic of the second packet.

 The second risk determining unit 230 can calculate the probability of existence of a malicious code indicating the possibility that a malicious code exists. More specifically, the second risk determining unit 230 may calculate the probability of existence of a malicious code based on at least one of a resource permission request content and a resource usage amount appearing when the first and second packets are quarantined. For example, the second risk determining unit 230 may not be able to determine whether or not a resource (for example, [\\ xxx.xxx.xx is inaccessible] If the content of the permission request is extracted, it can be determined that the malicious code is highly likely to exist. If the resource usage amount of the network, the CPU, the memory, or the like is exceeded, the malicious code is highly likely to be present.

The second risk determining unit 230 may determine whether or not a malicious code exists according to a specific criterion, and a specific criterion for determining whether the malicious code exists or not may be preset by the user. More specifically, the second risk determining unit 230 may determine that a malicious code exists if the probability of existence of the malicious code exceeds a specific criterion.

The cyclic-like neural network learning unit 240 may perform the cyclic neural network learning on the second packet to update the cyclic neural network model if the risk re-crystallization process is performed by the second CRC unit 230. [ More specifically, the circular neural network learning unit 240 may perform supervised learning based on the second packet and the redetermined risk element for prediction of the data characteristics of the next packet. The cyclic-neural network learning unit 240 receives the data characteristic of the second packet and the re-determined risk element through the CNS learning agent to determine whether malicious code exists in the first and second packets, have.

The control unit 250 controls the overall operation of the RNAP-based network packet analyzing apparatus 130 and includes a packet input unit 210, a first risk determining unit 220, a second risk determining unit 230, And the circular neural network learning unit 240 can be controlled.

FIG. 3 is a flowchart illustrating in detail a risk element analysis process of a network packet based on a circular neural network.

The packet input unit 210 can receive the packets in the session from the transmitting terminal 110. [ More specifically, the packet input unit 210 can receive continuous packets existing in the session, that is, the first and second packets between the transmitting end 110 and the receiving end 120. [ The packet input unit 210 may provide the received first and second packets to the first and second risk factors determiner 220 and 230.

The first risk determining unit 220 may determine a risk factor by analyzing pattern characteristics of continuous packets provided from the packet input unit 210. More specifically, the first risk factor determiner 220 may predict a data characteristic of a next packet by applying a circular neural network model to the first packet to analyze a pattern of the first packet, The compressed bit map can be generated by compressing a hash code or extracting and compressing a part of data of the bit table to generate the compressed bit map. The first risk factor determiner 220 may measure the similarity by comparing the data characteristic of the predicted next packet with the data characteristic of the second packet, and the first risk factor determiner 220 may determine the risk Element can be determined.

In one embodiment, when the similarity between the data characteristics of the next packet and the data characteristics of the second packet is equal to or greater than a specific criterion, the first risk determining unit 220 determines that the data characteristic of the next packet is normal, (Step S310). The first risk determining unit 220 can predict that the data characteristic of the next packet is normal according to the result of applying the circular neural network model to the first packet (step S312). If the similarity degree is equal to or higher than a specific criterion and the data characteristic of the next packet is predicted to be normal, the first risk factor determiner 220 can determine the session as a secure session (step S314). For example, the first risk factor determiner 220 may classify a plurality of data (signals) received through a session determined as a secure session as data having no malicious code.

In another embodiment, the first risk factor determiner 220 can predict that the data characteristic of the next packet is abnormal according to a result of applying the circular neural network model to the first packet (step S316). If the similarity degree is equal to or higher than a specific criterion but the data characteristic of the next packet is predicted to be abnormal, the first risk factor determination unit 220 may perform Deep Packet Inspection (DPI) for the corresponding session (step S318).

More specifically, the first risk factor determiner 220 may perform a deep packet analysis on packets that have been transmitted / received during a specific time in the past through a session to verify the session, It is not only analyzing the pattern characteristics, but also analyzing in depth the actual contents inside the packet. For example, the first risk factor determiner 220 can collect packets transmitted and received in the past one week based on the current time point, and perform deep packet analysis on the collected packets. Through this process, the first risk factor determiner 220 can perform the session verification based on the deep packet analysis result of the past packets, and determine the session state using at least one of the secure session and the unsafe session.

If the data characteristic of the next packet is predicted to be abnormal and the in-depth packet analysis is performed and the packet is verified as an unsafe session, the first risk factor determination unit 220 may determine the session as an unsafe session (step S320). For example, the first risk factor determiner 220 may classify a plurality of data (signals) received through a determined session as an unsafe session as data having a malicious code.

If the similarity between the data characteristic of the next packet and the data characteristic of the second packet is less than a specific criterion, the second risk determining unit 230 can perform the risk analysis on the second packet and determine the risk factor again Step S322). The second risk factor determining unit 230 may generate the virtual machines {VM_ _s} of the session only for performing risk analysis of a second packet, for example, the first session is a first virtual machine {VM_ may be associated only with _s1}, a second session can be associated only with the second virtual machine VM_ _{s2} (step S324).

The second risk factor determining unit 230 executes the circular neural network learning agent that works with the resulting virtual machine VM_ _{s} is possible to extract the characteristic data of the second packet. Than when Specifically, the second risk factor determining unit 230 when generating the virtual machine associated with a particular session, and to generate a circular neural network learning agent that works with a virtual machine {RNN_LA_ _s}, the virtual machine is destroyed VM and you can terminate the interlocked circular neural network learning agent {RNN_LA_ _s}. For example, the second risk factor determining unit 230 generates a first virtual machine {VM_ _s1} associated with the first session, the first virtual machine {VM_ _s1} and the first circulation neural network learning agent {RNN_LA_ peristaltic _s1 }. Here, the cyclic neural network learning agent can be implemented as a process of the cyclic-neural network-based network packet risk analysis apparatus 130.

The second risk determining unit 230 may detect the presence or absence of a malicious code in the first and second packets. More specifically, the second risk factor determining unit 230 may detect the presence of malicious code correctly by running through to the resulting virtual machine VM_ _{s}, isolated first and second packets. For example, the second risk factor determiner 230 can detect the presence or absence of a malicious code for the first packet by executing the first packet, and execute the second packet to determine whether or not the malicious code exists for the second packet Can be detected.

The second risk factor determining unit 230 may provide a data characteristic of the presence and the second packet of the infection of Recurrent Neural Network learning unit 240 via the neural network learning cycle RNN_LA_ agent _{s}. More specifically, when the first and second packets are isolated and executed, the second risk determining unit 230 may calculate the probability of existence of a malicious code based on the content of the resource right request, Probability can be calculated.

The probability of existence of the malicious code can be calculated through the following equation (1).

[Equation 1]

MC = RE + W

(Where MC is the probability of malicious code presence, RE is the number of resource privilege requesters, and W is the deviation (%) of network, memory or CPU occupancy)

For example, the second risk determining unit 230 may determine that a malicious code is highly likely to be present if the memory usage is high but the CPU usage rate is low. If the memory usage is low but the CPU usage rate is high, Is high. That is, the second risk determining unit 230 may determine that the probability of existence of the malicious code is high if the deviation of the share of the network, the memory, or the CPU is large.

In one embodiment, the second risk determining unit 230 may determine that the malicious code does not exist if the probability of existence of the malicious code does not exceed a certain criterion (step S326). More specifically, the second risk determining unit 230 may determine that the session is secure if it is determined that no malicious code exists in the first and second packets based on the probability of existence of the malicious code.

In another embodiment, the second risk determining unit 230 may determine that the malicious code exists if the probability of existence of the malicious code exceeds a certain criterion (step S328). More specifically, if the malicious code exists in the first and second packets based on the malicious code presence probability, the second risk determining unit 240 may determine that the corresponding session is unsafe.

The Cyclic Neural Network Learning Unit 240 can learn the risk analysis results of the first and second packets analyzed through the first and second risk determining units 220 and 230 Step S330). More specifically, the cyclic-neural network learning unit 240 may perform the cyclic neural network learning on the second packet when the process of determining the risk factors again is performed through the second CRC unit 230. [ The circular neural network learning unit 240 can update the circular neural network model by performing the circular neural network learning on the second packet. For example, if it is determined that the first packet is secure through the first risk factor determination unit 220, the Cyclic Neural Network Learning Unit 240 can perform learning with respect to the first packet using a packet having no malicious code.

The Cyclic Neural Network Learning Unit 240 may perform supervised learning based on the second packet and the risk element re-determined through the second risk determining unit 230 in order to predict the data characteristic of the next packet . More specifically, the cyclic-neural network learning unit 240 receives the data characteristics of the second packet and whether or not the malicious code exists in the first and second packets as a re-determined risk element through the cyclic neural network learning agent, Can be performed. The cyclic-neural network learning unit 240 can use the learned cyclic neural network model to analyze the risk factors of the next network packet. That is, the risk analysis device 130 of the network packet based on the Cyclic Neural Network can protect a plurality of packets from the risk factors by continuously comparing and analyzing the characteristics of the continuous packets in the session and the characteristics of the learned Cyclic Neural Network model, It can maximize the survivability and reliability of the network through degradation of transmission performance, detection of failure cause and analysis of risk factors.

4 is a flow chart for explaining a risk analysis process of a network packet based on a circular neural network.

In FIG. 4, the packet input unit 210 receives the first and second consecutive packets in the session from the transmitting terminal 110 (step S410).

The first risk factor determiner 220 can apply the Cyclic Neural Network model to the first packet to predict the data characteristics of the next packet and calculate the risk factors based on the similarity between the data characteristics of the next packet and the data characteristics of the second packet (Step S420). More specifically, the first risk factor determiner 220 can determine the state of the session according to the data characteristics and similarities of the next packet. The first risk determining unit 220 can determine that the session is secure if the similarity is higher than a certain criterion and the data characteristic of the next packet is normal or else can perform the additional packet analysis to determine the state of the session.

If the degree of similarity is below a certain criterion, the second risk determining unit 230 may perform a risk analysis on the second packet to redetermine the risk factor (step S430). More specifically, the second risk determining unit 230 may generate a virtual machine dedicated to a session to perform the risk analysis on the second packet, and generate a circular neural network learning agent linked with the generated virtual machine . The second risk determining unit 230 may detect the presence or absence of a malicious code in the first and second packets through the CNN learning agent.

The cyclic-like neural network learning unit 240 may perform the cyclic neural network learning on the second packet to update the cyclic neural network model when the risk element recurrence progresses (step S440). More specifically, the circular neural network learning unit 240 can perform the circular neural network learning on the first packet and the second packet, and analyze the risk factors of the network packet using the learned circular neural network.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as set forth in the following claims And changes may be made without departing from the spirit and scope of the invention.

100: Risk analysis system for network packets based on cyclic neural networks
110:
120: Receiver
130: Cyclic neural network based network packet risk analysis device
210: Packet input section
220: first risk factor determining section
230: second risk determining section
240: Cyclic Neural Network Learning Unit
250:

Claims (20)

A packet input unit for receiving first and second consecutive packets in a session from a transmitting end;
A first risk factor determiner for applying a cyclic neural network model to the first packet to predict a data characteristic of a next packet and to determine a risk factor based on a similarity between the data characteristic of the next packet and the data characteristic of the second packet;
A second risk factor determiner for redetermining the risk factor by performing a risk analysis on the second packet if the similarity is less than a specific criterion; And
And a circular neural network learning unit for performing a circular neural network learning on the second packet when the recrystallization proceeds, thereby updating the circular neural network model,
The second risk determining unit
Generating a virtual machine dedicated to the session, isolating and executing the first and second packets through the virtual machine to detect the presence of a malicious code,
Based on at least one of a resource permission request content and a resource usage amount appearing when the first and second packets are quarantined, calculates a malicious code presence probability indicating a possibility that the malicious code is present Risk analysis equipment.
2. The apparatus of claim 1, wherein the first risk determining unit
And determines that the session is secure if the data characteristic of the next packet is predicted to be normal and the similarity is not less than the specific criterion.
2. The apparatus of claim 1, wherein the first risk determining unit
And determines that the session is unstable if the data characteristic of the next packet is predicted to be abnormal and the similarity is not less than the specific criterion.
4. The apparatus of claim 3, wherein the first risk determining unit
And the session is verified by performing Deep Packet Inspection (DPI) on the packets transmitted and received during a specific time in the past through the session.
delete 2. The apparatus of claim 1, wherein the second risk determining unit
Wherein the apparatus is configured to execute a recursive neural network learning agent in the virtual machine before executing the isolation to extract data characteristics of the second packet.
7. The apparatus of claim 6, wherein the second risk determiner
Wherein the presence / absence of the malicious code and the data characteristic of the second packet are provided to the Cyclic Neural Network Learning Unit through the Cyclic Neural Network Learning Agent after the quarantine execution.
delete 2. The apparatus of claim 1, wherein the second risk determining unit
And determines that the malicious code exists if the probability of existence of the malicious code exceeds a specific criterion.
The apparatus of claim 1, wherein the cyclic-neural network learning unit
Wherein supervised learning is performed on the basis of the second packet and the redetermined risk element for predicting a data characteristic of the next packet.
11. The apparatus of claim 10, wherein the cyclic-neural network learning unit
Wherein the learning is performed by receiving a data characteristic of the second packet and whether or not a malicious code exists in the first and second packets as the re-determined risk element through a CNS learning agent, A neural network - based network packet risk analysis device.
2. The method of claim 1,
And a compressed bitmap of the data included in the packet.
A method for analyzing a risk of a network packet based on a cyclic neural network based on a cyclic neural network,
(a) receiving first and second consecutive packets in a session from a transmitting end;
(b) applying a circular neural network model to the first packet to predict a data characteristic of a next packet, and determining a risk factor based on a similarity between the data characteristic of the next packet and the data characteristic of the second packet;
(c) if the similarity is less than a specific criterion, performing a risk analysis on the second packet and re-determining the risk factor; And
(d) performing the loop neural network learning on the second packet when the recrystallization proceeds, and updating the circular neural network model,
The step (c)
Generating a virtual machine dedicated to the session and isolating the first and second packets through the virtual machine to detect the presence of a malicious code,
And calculating a malicious code presence probability indicating a possibility that the malicious code is present based on at least one of a content of a resource permission request and a resource usage amount appearing when the first and second packets are quarantine executed. Based network packet risk analysis.
14. The method of claim 13, wherein step (b)
And determining that the session is secure if the data characteristic of the next packet is predicted to be normal and the similarity is not less than the specific criterion.
14. The method of claim 13, wherein step (b)
And determining that the session is unstable if the data characteristic of the next packet is predicted to be abnormal and the similarity is greater than or equal to the specific criterion.
16. The method of claim 15, wherein step (b)
Further comprising the step of performing a deep packet inspection (DPI) on the packets transmitted and received during the past specific time through the session to verify the session. Analysis method.
delete 14. The method of claim 13, wherein step (c)
Further comprising the step of executing a recursive neural network learning agent to the virtual machine before executing the quarantine to extract data characteristics of the second packet.
14. The method of claim 13, wherein step (d)
And performing supervised learning based on the second packet and the redetermined risk element for predicting the data characteristic of the next packet. .
20. The method of claim 19, wherein step (d)
Further comprising the step of receiving the data characteristic of the second packet through the CNS learning agent and whether the malicious code exists in the first and second packets as the re-determined risk element, and performing the map learning A method for analyzing risk factors of a network packet based on a cyclic neural network.

Images