KR102168496B1 - Environmental Analysis and Correction System for Transfer Learning and Its Method - Google Patents

Abstract

The present invention relates to an environmental analysis and correction system for transfer learning and a method thereof. More particularly, the environmental analysis and correction system comprises: an environment learning unit which learns different security environments to generate an imitation environment that imitates the security environment; an environment difference analysis unit which analyzes differences between the imitation environments generated by the environment learning unit and extracts a correction value between the security environments; and a machine learning unit which derives a predicted value that is a result of determination on a security event through machine learning. Accordingly, by trying to reconsider the difference between two different security environments, even if a label created in a different security environment is learned, a corrected prediction result that matches the security environment in which a security event occurs is derived.

Description

Environmental Analysis and Correction System for Transfer Learning and Its Method {Environmental Analysis and Correction System for Transfer Learning and Its Method}

The present invention relates to an environment analysis and correction system for transfer learning and a method thereof, and more particularly, an environment learning unit that learns different security environments to create an imitation environment that mimics the security environment, and the environment learning Including an environment difference analysis unit that analyzes the difference between the imitation environments generated from the wealth and extracts a correction value between the security environments, and a machine learning unit that derives a predicted value that is a judgment result of a security event through machine learning. For security event machine learning through transfer learning that learns data and judges whether security events occur through security logs generated in different security environments, labels created in different security environments are reconsidered. It relates to an environment analysis and correction system for transfer learning and a method thereof to derive a corrected prediction result suitable for the security environment in which a security event occurs even if it is learned.

Supervised learning-based machine learning (machine learning) models can optimize learning performance by using correct answers (labels) for user-specified data as learning data, and because they are labeled, the model is verified through machine learning. It is also relatively easy. However, in a security control environment in which a security event occurs, it is difficult to collect the label itself required to perform supervised learning. This is because the user's judgment on the security event varies according to each security environment in which the security data occurs, and therefore, it is necessary to generate learning data tailored to each different environment.

Due to these limitations, it is difficult to apply a machine learning system in the field of security control, and it takes a very long time to build a machine learning system, and because experts cannot look at the data at the center of security control, security depending on the environment There was a difficulty in having a control expert create a separate label and perform machine learning.

In the past, in order to overcome these limitations, transfer learning, which is used for machine learning by labeling data generated in one environment and moving the learning data to another environment, has been proposed. There is a problem that it is difficult to demonstrate the efficiency of transfer learning in a security control environment where events are not judged as attacks in other security environments. 1 is an example showing that such conventional transfer learning is applied to a security control environment.

Referring to FIG. 1, when a 1 GB distributed denial of service attack (DDos) per second occurs in a security environment with different network bandwidths, the event data that occurs is the same, but a network with 10 GBpsdml bandwidth has sufficient capacity to handle this. It can be replaced with an event that does not judge it as an attack and ignores it. However, when transfer learning is performed in a 10GBps bandwidth network using a label created in the above security environment with a bandwidth of 1GBps, it is possible to derive an incorrect security event prediction due to the nature of machine learning that produces the same prediction result for the same input. do.

Therefore, there is a need for a system that understands the difference between two different security environments and tries to reconsider the security events in the security environment in which the learning data is generated according to the security environment in which transfer learning is performed.

Korean Registered Patent Publication No. 10-1503701 (2015.03.12)

The present invention was devised to solve the above problems,

An object of the present invention is an environment learning unit that learns different security environments to create an imitation environment that mimics the security environment, and a correction value between the security environments by analyzing differences between the imitation environments generated from the environment learning unit. And a machine learning unit that derives a predicted value, which is a determination result of a security event through machine learning, and an environment difference analysis unit that extracts a first security environment and a security event in which learning data for machine learning is generated. The generated second security environment is learned and imitated to create a first imitation environment and a second imitation environment, and the environment difference analysis unit learns the difference between the first imitation environment and the second imitation environment according to machine learning. Security event through transfer learning, which learns the data generated in the security environment and judges whether or not a security event occurs through a security log generated in a different security environment. For machine learning, the difference between two different security environments is considered. It is to provide an environment analysis and correction system for transfer learning to derive a corrected prediction result suitable for the security environment in which a security event occurs even if the label is learned.

It is an object of the present invention to provide the environment learning unit through an environment information input unit receiving information on each security environment, an environment creation network that creates a fake security environment, and the security environment information input through the environment information input unit. Including the environment determination network that determines the environment and the actual security environment, the environment generation network and the environment determination network constitute a generative hostile neural network to create an imitation environment, and the error of transfer learning through a virtual environment like the real security environment. It is to provide an environmental analysis and correction system for transfer learning that reduces the amount of energy.

An object of the present invention is that the environment learning unit receives the information of each security environment from the first security environment and the second security environment and inputs the information to the environment information input unit, thereby creating an imitation environment and receiving the information of each security environment. It is to provide an environment analysis and correction system for transfer learning that easily creates an imitation environment.

An object of the present invention is that the environment learning unit is transmitted and/or installed in a first security environment in which learning data for transfer learning is generated and a second security environment in which a security event occurs to learn a security environment in each of the security environments. It is to provide an environment analysis and correction system for transfer learning that is recovered and generated to create an imitation environment to increase security in creating an imitation environment.

It is an object of the present invention to provide an environment difference analysis unit to learn a difference between the first and second mimic environments and the first and second mimic environments generated by the environment learning unit. This is to provide an environment analysis and correction system for transfer learning that minimizes the error in predicting results during transfer learning through the analysis of differences between the two security environments in which transfer learning is performed, including the environment difference learning unit that is learned through the transfer learning.

An object of the present invention is that the environment difference learning unit includes a noise generating network and a noise discriminating network, and the noise generating network and the noise discriminating network constitute a generative adversarial neural network, so that the difference between the first mimic environment and the second mimic environment It is to provide an environmental analysis and correction system for transfer learning to derive.

An object of the present invention is that the noise generating network generates a fake imitation environment by transforming information of the first imitation environment through noise, and the noise determination network determines the fake imitation environment and the second imitation environment, and the noise It is to provide an environment analysis and correction system for transfer learning in which the noise of the generation network is defined as the difference between each of the imitation environments.

An object of the present invention, the environmental difference analysis unit further comprises a correction value extraction module for extracting a correction value from the difference derived from the environmental difference learning unit, the correction value extraction module by inverting the noise defined as the difference It is to provide an environment analysis and correction system for transfer learning that corrects the difference in each security environment by extracting the correction value.

An object of the present invention is that the environment analysis and correction system for transfer learning further includes a data collection unit for collecting and pre-processing the log of the second security environment and learning data generated from the first security environment, and the machine learning unit An environment analysis and correction system for transfer learning that enables transfer learning in two different security environments by performing transfer learning on the log of the second security environment based on the learning data generated from the first security environment transmitted from the collection unit. To provide.

An object of the present invention is that the machine learning unit includes a variable extraction module for extracting a threat factor determination field from a preprocessed log, an algorithm selection module for selecting at least one of a plurality of algorithms for the preprocessed log, and the selected algorithm or algorithm. A learning module for performing machine learning using a combination, and a prediction value correction module for correcting the predicted value extracted from the learning module, wherein the predicted value correction module performs transfer learning to correct the predicted value through the correction value extracted from noise. It is to provide an environmental analysis and correction system for

The present invention is implemented by an embodiment having the following configuration in order to achieve the above object.

According to an embodiment of the present invention, the present invention analyzes differences between an environment learning unit that learns different security environments to create an imitation environment that mimics the security environment, and an imitation environment created from the environment learning unit. And a machine learning unit that derives a predicted value, which is a determination result of a security event through machine learning, and an environment difference analysis unit that extracts a correction value between the security environments.

According to an embodiment of the present invention, the environment learning unit learns and imitates a first security environment in which learning data for machine learning is generated and a second security environment in which a security event occurs. And the environment difference analysis unit is characterized in that it learns a difference between the first imitation environment and the second imitation environment according to machine learning.

According to an embodiment of the present invention, the environment learning unit provides an environment information input unit receiving information of each security environment, an environment creation network generating a fake security environment, and a security environment input through the environment information input unit. Including an environment determination network that determines the fake security environment and the actual security environment through the information of, the environment generation network and the environment determination network constitute a generative hostile neural network to create an imitation environment.

According to an embodiment of the present invention, the environment learning unit generates an imitation environment by receiving information of each security environment from the first security environment and the second security environment and inputting the information to the environment information input unit. To do.

According to an embodiment of the present invention, the environment learning unit is transmitted and/or installed in a first security environment in which learning data for transfer learning is generated and a second security environment in which a security event occurs. It is characterized in that the security environment is learned and retrieved from within the environment to create an imitation environment.

According to an embodiment of the present invention, in the present invention, the environment difference analysis unit is an imitation environment input unit receiving information of the first imitation environment and the second imitation environment generated by the environment learning unit, and the first imitation environment and the second It characterized in that it includes an environment difference learning unit that learns the difference in the imitation environment through machine learning.

According to an embodiment of the present invention, in the present invention, the environment difference learning unit includes a noise generating network and a noise discriminating network, and the noise generating network and the noise discriminating network constitute a generative adversarial neural network to form the first imitation environment. It is characterized by deriving the difference between the second and the second imitation environment.

According to an embodiment of the present invention, in the present invention, the noise generating network generates a fake copying environment by transforming information of the first copying environment through noise, and the noise discriminating network is the fake copying environment and the second copying. An environment is determined, and noise of the noise generating network is defined as a difference between each of the imitation environments.

According to an embodiment of the present invention, the present invention further comprises a correction value extraction module for extracting a correction value from the difference derived from the environmental difference learning unit, the environmental difference analysis unit, the correction value extraction module It characterized in that the correction value is extracted by inverting the noise defined as.

According to an embodiment of the present invention, the environment analysis and correction system for transfer learning further includes a data collection unit for collecting and pre-processing the log of the second security environment and the learning data generated from the first security environment. And, the machine learning unit is characterized in that it performs transfer learning on the log of the second security environment based on the learning data generated from the first security environment transmitted from the data collection unit.

According to an embodiment of the present invention, the machine learning unit includes a variable extraction module for extracting a threat factor determination field from a preprocessed log, and an algorithm selection for selecting at least one of a plurality of algorithms for a preprocessed log. And a learning module that performs machine learning using a module and a selected algorithm or a combination of algorithms.

According to an embodiment of the present invention, the machine learning unit further comprises a prediction value correction module for correcting the predicted value extracted from the learning module, wherein the predicted value correction module is the predicted value through the correction value extracted from noise. It is characterized in that to correct.

The present invention can obtain the following effects by the configuration, combination, and use relationship that will be described below with the present embodiment.

The present invention extracts a correction value between the security environments by analyzing differences between the environment learning unit that creates an imitation environment that mimics the security environment by learning different security environments, and the imitation environment generated from the environment learning unit. And a machine learning unit that derives a predicted value that is a result of determining a security event through machine learning, and the environment learning unit generates a first security environment in which learning data for machine learning is generated and a security event. It learns and imitates the second security environment to create a first imitation environment and a second imitation environment, and the environment difference analysis unit learns the difference between the first imitation environment and the second imitation environment according to machine learning. For security event machine learning through transfer learning that learns data and judges whether security events occur through security logs generated in different security environments, labels created in different security environments are reconsidered. Even if it learns, it has the effect of providing an environment analysis and correction system for transfer learning to derive a corrected prediction result suitable for the security environment in which a security event occurs.

In the present invention, the environment learning unit includes an environment information input unit for receiving information on each security environment, an environment creation network for creating a fake security environment, and the fake security environment through information on the security environment input through the environment information input unit. Including the environment determination network that determines the actual security environment, the environment creation network and the environment determination network form a generative hostile neural network to create an imitation environment to reduce the error of transfer learning through a virtual environment like the real security environment. It works.

In the present invention, the environment learning unit receives the information of each security environment from the first security environment and the second security environment and inputs the information to the environment information input unit, thereby creating an imitation environment and receiving the information of each security environment. It entails the effect of providing an environment analysis and correction system for transfer learning that creates an imitation environment.

In the present invention, the environment learning unit is transmitted and/or installed in a first security environment in which learning data for transfer learning is generated and a second security environment in which a security event occurs, and learns and recovers the security environment in each of the security environments. As a result, an imitation environment is created, providing an effect of increasing security in creating an imitation environment.

In the present invention, the environment difference analysis unit is an imitation environment input unit receiving information on the first and second imitation environments generated by the environment learning unit, and the difference between the first and second imitation environments is determined through machine learning. It has the effect of providing an environment analysis and correction system for transfer learning that minimizes the error in predicting results during transfer learning by analyzing differences between the two security environments in which transfer learning is performed including the learning environment difference learning unit.

In the present invention, the environment difference learning unit includes a noise generating network and a noise discrimination network, and the noise generating network and the noise discriminating network constitute a generative adversarial neural network to derive the difference between the first and second mimic environments. It derives the effect of providing an environmental analysis and correction system for transfer learning.

In the present invention, the noise generating network generates a fake copying environment by transforming information of the first copying environment through noise, the noise discrimination network discriminates the fake copying environment and the second copying environment, and the noise generating network The noise of is defined as the difference between each of the imitation environments.

In the present invention, the environmental difference analysis unit further includes a correction value extraction module for extracting a correction value from the difference derived from the environmental difference learning unit, the correction value extraction module inversely calculating the noise defined as the difference It has the effect of providing an environment analysis and correction system for transfer learning that corrects the difference in each security environment by extracting.

In the present invention, the environment analysis and correction system for transfer learning further includes a data collection unit for collecting and pre-processing a log of a second security environment and learning data generated from the first security environment, and the machine learning unit includes the data collection unit. Transfer learning is possible in two different security environments by performing transfer learning on the log of the second security environment based on the learning data generated from the first security environment transmitted from the system.

In the present invention, the machine learning unit comprises a variable extraction module for extracting a threat factor determination field from a preprocessed log, an algorithm selection module for selecting at least one of a plurality of algorithms for the preprocessed log, and a selected algorithm or a combination of algorithms. A learning module that performs machine learning by using and a prediction value correction module that corrects the predicted value extracted from the learning module, wherein the predicted value correction module is an environment for transfer learning that corrects the predicted value through the correction value extracted from noise. It entails the effect of providing an analysis and correction system.

1 is an exemplary diagram showing that such conventional transfer learning is applied to a security control environment
2 is a block diagram of an environment analysis and correction system 1 for transfer learning according to a preferred embodiment of the present invention
3 is a diagram showing the generation of a fake image or a fake mimic environment in a generative hostile neural network (GAN)
4 is a block diagram of an environment information input unit 31 according to an embodiment of the present invention
5 is a diagram showing the creation of an imitation environment in the environment learning unit 30 according to an embodiment of the present invention
6 is a diagram illustrating creating an imitation environment according to another embodiment of the present invention
7 is a block diagram of an environment difference learning unit 53 according to an embodiment of the present invention
FIG. 8 is a diagram showing the learning of the difference between the first imitation environment and the second imitation environment in the environment difference learning unit 53 of the present invention
9 is a diagram showing the structure of a regression neural network
10 is a block diagram of an image generator 2315 according to an embodiment of the present invention
11 is a flowchart of the step (S) of generating a fake image in the creator network 231 according to an embodiment of the present invention
12 is a diagram showing the flow of information on data or images in each step
13 is a process of calculating a geometrical transformation of a clothing image through a parameter _θ for a geometrical transformation (T _θ ) calculation according to machine learning in the matching step (S20)
14 is a diagram showing a process in which a result image (~I _i ) is generated in an image generation step (S30) according to the present invention
15 is a diagram illustrating that the discriminator network 233 learns data according to an embodiment of the present invention

Hereinafter, preferred embodiments of the environment analysis and correction system and method for transfer learning according to the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, if it is determined that a detailed description of a known function or configuration may unnecessarily obscure the subject matter of the present invention, a detailed description thereof will be omitted. Unless otherwise defined, all terms in this specification are the same as the general meanings of the terms understood by those of ordinary skill in the art to which the present invention belongs, and in case of conflict with the meanings of terms used in the present specification, the present disclosure According to the definitions used in the specification.

Throughout the specification, when a part "includes" a certain component, this does not exclude other components unless otherwise stated, it means that other components may also be included. Terms such as "~ unit" and "~ module" described herein mean units that process at least one or more functions or operations, which may be implemented by hardware or software or a combination of hardware and software. Hereinafter, the present invention will be described in detail by describing a preferred embodiment of the present invention with reference to the accompanying drawings.

2 is a block diagram of an environment analysis and correction system 1 for transfer learning according to a preferred embodiment of the present invention. 2, the environment analysis and correction system 1 for transfer learning is a security event machine through transfer learning that learns data generated in a security environment and determines whether a security event occurs through a security log generated in another security environment. It is characterized in that by reconsidering the difference between two different security environments for learning, even if a label created in a different security environment is learned, a corrected prediction result suitable for a security environment in which a security event occurs is derived. The environment analysis and correction system 1 for transfer learning includes a data collection unit 10, an environment learning unit 30, an environment difference analysis unit 50, and a machine learning unit 70. Since the present invention derives a corrected prediction result by learning the difference between different security environments, the security environment in which the label, which is the learning data for transfer learning, is generated is defined as the first security environment, and a security event occurs. The environment analysis and correction system 1 for transfer learning according to this is installed to define a security environment that derives predicted values of security events through transfer learning as a second security environment.

The data collection unit 10 is provided to collect a log transmitted from a security device and/or a security system constituting a security environment, convert it into a regular format, and process it, and collect a label that becomes learning data for transfer learning. Security equipment and security systems refer to machines, systems, software, etc. that operate to protect network and/or information assets from internal and external threats. Risk Management System (RMS), Threat Management System (TMS), Intrusion Detection System (IDS) A security system such as) is also possible, and it may be a device such as a firewall. The data collection unit 10 includes a log collection module 11, a preprocessing module 13, and a learning data input module 15.

The log collection module 11 functions to collect logs transmitted from security equipment. Log is data containing system records, and through log data analysis, intrusion detection and tracking from outside, system performance management, etc. are possible. There are web logs and webtop logs, and the security log records each event as defined in the security policy set for each object.

The pre-processing module 13 converts or processes the logs collected by the log collection module 11 into a regular format. For example, the log includes source IP information, destination IP information, source port information, destination port information, host information, payload information. , HTTP referrer (hypertext transfer protocol referer) information and information on the number of security events may be included.

The preprocessing module 13 converts the collected log into a regular format. As an example, the normalized log may be composed of data including fields including Time, Type, SentIP, DestIP, and Payload. At this time, Time may be the detection time of the event, Type may be the type of the event, SentIP may be the source IP, DestIP may be the destination IP of the event, and Payload may be the attack information contained in the log. It can be seen that the information and/or fields included in the log and the normalized log are exemplary and may include other information and/or fields required for security control. The collected data may lack some of the above information, may include overlapping information, and may have different types of field values. Accordingly, the preprocessing module 13 may perform data purification such as filling in missing values or erasing duplicate values while converting to a regular format. Thereafter, the preprocessing module 13 may transmit the preprocessed log to the machine learning unit.

The learning data input module 15 may be provided to receive a label generated in a first security environment in which learning data for machine learning is generated. In order to perform supervised learning including transfer learning, the correct answer (label) of the corresponding data is given to the initially input data, and the predicted value for security events through a model that determines security events by learning the learning data through machine learning. Is derived.

Hereinafter, the environment learning unit 30 will be described with reference to FIGS. 2 to 6. 2, the environment learning unit learns different security environments to create an imitation environment that mimics the security environment, and preferably, a first security environment and a security event in which learning data for machine learning is generated are generated. It learns and imitates the second security environment to create a first imitation environment and a second imitation environment. The environment learning unit 30 includes an environment information input unit 31, an environment generation network 33, and an environment determination network 35. In a preferred embodiment of the present invention, the environment generation network 33 and the environment The discrimination network 35 may be provided to construct a generative hostile neural network (GAN) to create an imitation environment.

3 is a diagram illustrating the generation of a fake image or a fake mimic environment in a generative hostile neural network (GAN). Referring to FIG. 3, a generative hostile neural network (GAN) is composed of a generator network and a discriminator network, and a fake image is generated to perform learning in the discriminator network. The generator network generates a fake image similar to the training data through random noise, and the discriminator network calculates the probability that the presented image is data present in the training data. When this process is repeated, an imitation image that is indistinguishable from the real is derived through a generative hostile neural network. In order to learn the difference between the first security environment in which learning data for machine learning is generated and the second security environment in which the security event occurs, the environment learning unit 30 according to a preferred embodiment of the present invention is Through the hostile neural network, the first and second security environments are imitated to create the first and second imitation environments.

4 is a block diagram of an environment information input unit 31 according to an embodiment of the present invention. 2 and 4, the environment information input unit 31 stores information on the security environment so that the environment creation network 33 and the environment determination network 35 to be described later can create an imitation environment through interaction. It may be provided to input. The process of creating an imitation image in a generative adversarial neural network includes the process of developing the creation and identification of a fake image by comparing and discriminating against the fake image by taking the characteristic part of the image as a factor. It is possible to create an imitation environment by taking the characteristic element as a factor. Characteristic parts inputted by the environment information input unit 31 and taken as a factor may be network bandwidth, nodes connected to the network, attacker IP, daily site visitor, daily access, average download and upload size, etc. In addition to the above-listed elements, if the security environment of the network can be characterized, it may be an element that creates an imitation environment by the environment information input unit 31. The environment information input unit 31 may include a first environment information input module 311 and a second environment information input module 313.

The first environment information input module 311 receives and receives environment information of a first security environment in which a label is assigned to generate learning data for machine learning, and the second environment information input module 313 receives a security event. The environment information of the second security environment in which is generated is transmitted and input.

The environment generation network 33 is provided to create a fake security environment from random numbers. The environment generation network 33 forms a generative hostile neural network (GAN) together with the environment determination network 35 to be described later, and a fake security environment Is generated to perform learning in an environment determination network 35 to be described later. In this case, creating a fake security environment in the environment creation network 33 refers to creating a security environment structure corresponding to a fake image, and is derived from environment information input through the environment information input module 31. It consists of information. That is, the security environment structure corresponding to the data set such as the network bandwidth, which is the environmental information of the environmental information input module 31, the node connected to the network, the attacker IP, the number of daily visitors to the site, the number of daily accesses, and the average download and upload size. Is to create.

The environment determination network 35 determines the fake security environment and the actual security environment through information on the security environment input through the environment information input unit 31. The environment determination network 35 determines whether the proposed imitation environment corresponds to the security environment input through the environment information input unit 31 based on the information of the security environment, and performs learning. When the learning is repeated, the environment creation network 33 and the environment determination network 35 generate a first imitation environment and a second imitation environment indistinguishable from the first security environment and the second security environment. The generated imitation environment becomes input data for machine learning for difference analysis, so that differences between different security environments that may change over time are learned.

5 is a diagram illustrating the creation of an imitation environment in the environment learning unit 30 according to an embodiment of the present invention, and FIG. 6 is a diagram illustrating the generation of an imitation environment according to another embodiment of the present invention to be. First, referring to FIG. 5, information of each security environment is transmitted from the first security environment (environment A) and the second security environment (environment B) to the environment learning unit 30, and the security environment transmitted from the environment learning unit. A first imitation environment (imitation environment A') and a second imitation environment (imitation environment B') can be created through the information of. Information such as a network bandwidth and a node connected to the network as described above should be transmitted, and the transmission of the environmental information may be performed through programs, commands, scripts, and the like.

Referring to FIG. 6, in another embodiment of the present invention, the environment creation network 33 and the environment determination network 35 are transmitted from the environment learning unit 30 to the first security environment and the second security environment. It can be performed within a security environment to create an imitation environment within each security environment. When the imitation learning is finished, the environment creation network 33 and the environment determination network 35 may be retrieved from each security environment, and an imitation environment may be generated by a central server or the like.

Referring back to FIG. 2, the environment difference analysis unit 50 analyzes differences between the imitation environments generated by the environment learning unit 30 and extracts a correction value between the security environments. In a preferred embodiment of the present invention, differences between the generated first and second imitation environments are learned according to machine learning, and the differences may be derived through a new generative hostile neural network (GAN). The environment difference analysis unit 50 includes an imitation environment input unit 51, an environment difference learning unit 53, and a correction value extraction module 55.

The imitation environment input unit 51 may receive information on the first imitation environment and the second imitation environment generated after the environment learning unit 30 learns the first security environment and the second security environment. The first and second imitation environments generated from the environment creation network 33 and the environment determination network 35 of the environment learning unit 30 are the network bandwidth as described above, a node connected to the network, an attacker IP, etc. Since it has a structure of a security environment of, the imitation environment input unit 51 receives the information of the imitation environment and enables the environment difference learning unit 53 to learn the difference between each imitation environment.

7 is a block diagram of an environment difference learning unit 53 according to an embodiment of the present invention. 2 and 7, the environment difference learning unit 53 learns the difference between the first mimic environment and the second mimic environment through machine learning, and preferably learns the difference by learning through a generative adversarial neural network. Can be defined. The environment difference learning unit 53 includes a noise generating network 531 and a noise discrimination network 533, and the noise generating network 531 and the noise discrimination network 533 constitute a generative hostile neural network (GAN). Thus, it can be provided to define differences between the imitation environments.

FIG. 8 is a diagram illustrating that the environment difference learning unit 53 of the present invention learns the difference between the first imitation environment and the second imitation environment. Referring to FIG. 8, the noise generation network 531 constitutes a generative hostile neural network (GAN) together with a noise determination network 533 to be described later, and generates a fake mimic environment in the environment determination network 35 to be described later. Learning proceeds, and a fake copying environment is created by transforming the information of the first copying environment through noise. In this case, the generation of the fake imitation environment in the noise generating network 531 refers to creating a security environment structure of the imitation environment corresponding to the fake image, and the imitation environment input through the imitation environment input module 51 It consists of information derived from In other words, it creates the security environment structure of the imitation environment corresponding to the data set such as the network bandwidth, which is the environmental information of the imitation environment, the node connected to the network, the attacker IP, the number of daily visitors to the site, the number of daily accesses, and the average download and upload size. Is to do.

Unlike in the environment generation network 33 described above, the noise generation network 531 does not simply create a fake copying environment from random numbers, but transforms the information about the security environment of the first copying environment through noise. Create a fake imitation environment similar to Here, noise refers to an operation value or a random number provided to change the information of the security environment.In the case of network bandwidth, when X10 noise is applied, the first imitation environment with a bandwidth of 1 GBps and a fake imitation environment with a bandwidth of 10 GBps In the case of an attacker's IP or access environment, the first imitation environment can be changed as described above. In one embodiment of the present invention, each security environment may have a different IP to be monitored. In the case of an attacker's IP, noise may be reflected to create a fake environment having the changed IP as an element as follows.

1.1.1.1 (Numericalization) -> 16843009 (+ Noise) -> 16843010 (+1) (Reconversion) -> 1.1.1.2

In addition, when the connection environment is different for each security environment, noise is applied to the number of daily connections, average number of logins, download and upload capacity, etc. to create a fake environment.

The noise determination network 533 determines the fake imitation environment and the second imitation environment based on security environment information of the imitation environment input through the imitation environment input unit 51. The noise determination network 533 performs learning by determining whether the proposed fake imitation environment corresponds to the second imitation environment based on the inputted second imitation environment information. When the learning is repeated, the noise generating network 531 and the noise discriminating network 533 generate a fake copying environment that cannot be distinguished from the second copying environment. At this time, since noise in the noise generating network 531 can be considered to apply a transformation to the first imitation environment by imitating the difference between the first imitation environment and the second imitation environment, the noise is the first imitation environment and the second imitation environment. Is defined as the difference.

Referring back to FIGS. 7 and 8, the correction value extraction module 55 extracts a correction value from the difference derived from the environmental difference learning unit. The correction value extraction module 55 extracts a correction value from noise defined as a difference, and extracts the correction value by inverting the noise. Inverting the noise means extracting a correction value by inverting the corresponding value from the value in which the noise transforms the first imitation environment. However, the application of the correction value does not simply apply the change in the numerical value again, but acts as a parameter for the predicted value. The predicted value by the prediction model derived from the machine learning unit 70 to be described later can be expressed as a probability that the security log belongs to an attack or other event, and the correction value extraction module 55 acts as a parameter to correct the predicted value. do.

Referring back to FIG. 2, the machine learning unit 70 derives a predicted value, which is a result of determining a security event through machine learning. The machine learning unit 70 derives a predictive model for a security event periodically or in real time by using a machine learning algorithm from the data provided from the data collection unit 10 described above. The machine learning unit 70 includes a variable extraction module 71, an algorithm selection module 73, a learning module 75, and a predicted value correction module 77.

The variable extraction module 71 may receive a parameter and extract a threat factor determination field from the received preprocessed log. The parameter may be input through a user, and the system may determine and input a suitable parameter by itself. In addition, the interface as a path through which the parameter is input may be a command line interface (CLI), and other known or known interfaces used for parameter input are also possible.

The input parameter may include a field name and a field data format of the preprocessed log. The log field name is an index indicating what data is stored in the normalized log, such as Time, Type, and SentIP. The field data format refers to the format of the data stored in the field, and includes the number format and the string format. The number format is a data format that is recognized as a number on the system, and an example is traffic indicating which DNS address, which IP, and how many times the connection request was made. The string format is a data format that is recognized as a character on the system, and the name of a file executed by a malicious code accompanying a payload can be an example. When the parameter is input, the variable extraction module 71 extracts a field serving as a reference for the machine learning process from the preprocessed log provided according to the input parameter.

The algorithm selection module 73 selects at least one of a plurality of algorithms to be used when machine learning is performed on the preprocessed log. In the present invention, since transfer learning is performed and transfer learning corresponds to supervised learning, an algorithm used for supervised learning, that is, an algorithm such as a nearest neighbor, a linear model, or a random forest can be selected. Algorithms other than algorithms or combinations of algorithms may be used.

The learning module 75 performs machine learning using a selected algorithm or a combination of algorithms and derives a prediction model. The learning module 75 of the present invention performs transfer learning, and performs learning with the security log of the second security environment, which is an environment different from the first security environment, using the learning data generated in the first security environment. The prediction model derived by the learning module 75 derives the predicted value that the security log will correspond to the security event, and there is a point that does not match the reality of the second security environment because the learning was conducted based on the other security environment. Therefore, correction of the predicted value is required.

The predicted value correction module 77 corrects the predicted value extracted from the learning module 75. The predicted value correction module 77 corrects the predicted value through the correction value extracted from the noise corresponding to the difference between the first and second copying environments. The application of the correction value is simply reapplying the change in the numerical value. Rather, the correction value acts as a parameter for the predicted value to correct the predicted value.

The difference between two different security environments for security event machine learning through transfer learning, which learns data generated in a security environment according to the combination of the above-described components and determines whether a security event occurs through a security log generated in another security environment. The environment analysis and correction system (1) for transfer learning is implemented so that even if a label created in another security environment is learned by reconsidering, a corrected prediction result corresponding to the security environment in which a security event occurs is derived. Hereinafter, an environmental analysis and correction method (S) for transfer learning according to an embodiment of the present invention will be described.

9 is a flowchart of an environment analysis and correction method (S) for transfer learning according to an embodiment of the present invention. 9, the environment analysis and correction method (S) for transfer learning is a security event machine through transfer learning that learns data generated in a security environment and determines whether a security event occurs through a security log generated in another security environment. It is characterized in that by reconsidering the difference between two different security environments for learning, even if a label created in a different security environment is learned, a corrected prediction result suitable for a security environment in which a security event occurs is derived. The environment analysis and correction method (S1) for transfer learning includes a data collection step (S10), an environment learning step (S30), an environment difference analysis step (S50), and a machine learning step (S70).

In the data collection step (S10), logs transmitted from the security equipment and/or the security system constituting the security environment are collected, converted into a regular format, processed, and a label used as learning data for transfer learning is collected. The data collection step (S10) includes a log collection step (S11), a preprocessing step (S13), and a learning data input step (S15).

In the log collection step (S11), logs transmitted from the security equipment are collected, and there are web logs, webtop logs, etc., and the security logs record each event as defined in the security policy set for each entity.

The pre-processing step (S13) converts or processes the log collected in the log collection step (S11) into a regular format. The collected data may lack some of the above information, may include overlapping information, and may have different types of field values. Accordingly, in the pre-processing step (S13), data may be refined, such as filling in missing values or erasing duplicate values while converting to a regular format. Thereafter, in the preprocessing step S13, the preprocessed log may be transmitted to the machine learning unit.

In the learning data input step (S15), a label generated in a first security environment in which learning data for machine learning is generated is input. In order to perform supervised learning including transfer learning, the correct answer (label) of the corresponding data is given to the initially input data, and the predicted value for security events through a model that determines security events by learning the learning data through machine learning. Is derived. The learning data input step S15 may be performed independently of the log collection step S11 and the preprocessing step S13, and therefore, the learning data input step S15 may be performed first.

In the environment learning step (S30), a first security environment in which learning data for machine learning is generated and a first security event in which learning data for machine learning are generated and a first security event are generated by learning different security environments. 2 Learn and imitate the security environment to create the first and second imitation environments. The environmental learning step (S30) includes an environment information input step (S31), an imitation environment generation step (S33), and an imitation environment determination step (S35), and in a preferred embodiment of the present invention, a generative hostile neural network (GAN) ) The imitation environment creation step (S33) and the imitation environment determination step (S35) are performed in the inner.

The environmental information input step (S31) is a step of inputting information on the security environment so that the imitation environment can be created through interaction in the imitation environment creation step (S33) and the imitation environment determination step (S35) to be described later. The process of creating an imitation image in a generative adversarial neural network includes the process of developing the creation and identification of a fake image by comparing and discriminating against the fake image by taking the characteristic part of the image as a factor. It is possible to create an imitation environment by taking the characteristic element as a factor. Therefore, in the environmental information input step (S31), the network bandwidth, the node connected to the network, the attacker IP, the number of daily visitors to the site, the number of daily accesses, the average download and upload size, etc. are input. In addition to the above-listed factors, the network security environment If it can be characterized, it can be an element that creates an imitation environment.

The imitation environment generating step (S33) creates a fake security environment from a random number. The imitation environment generation step (S33) is performed in a generative hostile neural network (GAN) together with the imitation environment determination step (S35) to be described later, and learning for discrimination in the imitation environment determination step (S35) by creating a fake security environment Let's proceed. In this case, creating a fake security environment in the imitation environment creation step S33 refers to creating a security environment structure corresponding to a fake image, and the created fake security environment is composed of information derived from environment information.

In the imitation environment determination step (S35), the fake security environment and the actual security environment are determined based on the security environment information input in the environment information input step (S31). The imitation environment determination step (S35) performs learning by determining whether the proposed imitation environment corresponds to the input security environment based on the information on the security environment. When the learning is repeated, the environment creation network 33 and the environment determination network 35 generate a first and second imitation environments that are indistinguishable from the first security environment and the second security environment. The imitation environment becomes input data for machine learning for difference analysis, so that differences between different security environments that can change over time are learned.

In the environment difference analysis step S50, a correction value between the security environments is extracted by analyzing differences between the imitation environments generated from the environment learning step S30. In a preferred embodiment of the present invention, differences between the generated first and second imitation environments are learned according to machine learning, and the differences may be derived through a new generative hostile neural network (GAN). The environmental difference analysis step (S50) includes an imitation environment input step (S51), an environment difference learning step (S53), and a correction value extraction step (S55).

In the imitation environment input step (S51), information on the first imitation environment and the second imitation environment generated after learning the first security environment and the second security environment in the environment learning step (S30) is received. The first and second imitation environments generated from the environment creation network 33 and the environment determination network 35 of the environment learning unit 30 are the network bandwidth as described above, a node connected to the network, an attacker IP, etc. Since it has the structure of the security environment of, in the imitation environment input step (S51), the information of the imitation environment is input so that the difference between each imitation environment can be learned in the environment difference learning step (S53).

10 is a block diagram of an environment difference learning unit 53 according to an embodiment of the present invention. 9 and 10, in the environment difference learning step (S53), the difference between the first mimic environment and the second mimic environment is learned through machine learning, preferably by learning through a generative adversarial neural network. Can be defined. The environmental difference learning step (S53) includes a noise generation step (S531) and a noise determination step (S533), and the noise generation step (S531) and noise determination step (S533) are performed by a generative hostile neural network (GAN). Can be provided to define differences between the imitating environments.

The noise generation step (S531) is performed in a generative hostile neural network (GAN) together with a noise determination system (S533) to be described later, creates a fake mimic environment, and transforms the information of the first mimic environment through noise to mimic fake Create the environment. In this case, generating a fake imitation environment in the noise generation step (S531) refers to creating a security environment structure of the imitation environment corresponding to the fake image, and the imitation environment input through the imitation environment input step (S51). It consists of information derived from

In the noise determination step S533, the fake imitation environment and the second imitation environment are determined based on the security environment information of the imitation environment input through the imitation environment input step S51. In the noise determination step (S533), learning is performed by determining whether the proposed fake imitation environment corresponds to the second imitation environment based on the inputted second imitation environment information. When the learning is repeated, the noise generating network 531 and the noise discriminating network 533 generate a fake copying environment that is indistinguishable from the second copying environment, and the noise in the noise generating step S531 is the first copying environment. Since it can be seen that a deformation is applied to the first imitation environment by imitating the difference between the first and second imitation environments, the noise is defined as the difference between the first and second imitation environments.

In the correction value extraction step S55, a correction value is extracted from the difference derived from the environmental difference learning unit. In the correction value extraction step S55, a correction value is extracted from noise defined as a difference, and the correction value is extracted by inverting the noise.

The data collection step (S10) is to collect and pre-process the learning data in the first security environment and the security log in the second security environment, and learn environmental information to analyze the differences by learning the first security environment and the second security environment. It may be performed independently of the learning step (S30) and the environmental difference analysis step (S50). Accordingly, the data collection step (S10) may be performed earlier or later than the environmental information learning step (S30) and the environment difference analysis step (S50), and may be performed simultaneously within the same system.

Referring back to FIG. 9, in the machine learning step (S70), a predicted value, which is a determination result of a security event, is derived through machine learning. The machine learning step (S70) derives a predictive model for a security event periodically or in real time using a machine learning algorithm from the data provided from the above-described data collection step (S10). The machine learning step (S70) includes a variable extraction step (S71), an algorithm selection step (S73), a learning step (S75), and a predicted value correction step (S77).

The variable extraction step (S71) is a step of receiving a parameter and extracting a threat factor determination field from the received preprocessed log. The parameter may be input through a user, and the system may determine and input a suitable parameter by itself. In addition, the interface as a path through which the parameter is input may be a command line interface (CLI), and other known or known interfaces used for parameter input are also possible. In the variable extraction step S71, when the parameter is input, a field serving as a reference for the machine learning process is extracted from the preprocessed log provided according to the input parameter.

The algorithm selection step (S73) selects at least one algorithm from among a plurality of algorithms to be used when machine learning is performed on the preprocessed log. In the present invention, since transfer learning is performed and transfer learning corresponds to supervised learning, an algorithm used for supervised learning, that is, an algorithm such as a nearest neighbor, a linear model, or a random forest can be selected. Algorithms other than algorithms or combinations of algorithms may be used.

In the learning step (S75), machine learning is performed using a selected algorithm or a combination of algorithms and a prediction model is derived. In the learning step S75 of the present invention, transfer learning is performed, and learning is performed with the security log of the second security environment, which is an environment different from the first security environment, using the learning data generated in the first security environment. The predictive model derived in the learning step (S75) derives the predicted value that the security log will correspond to the security event, but there is a point inconsistent with the reality of the second security environment because the learning was conducted based on another security environment. Therefore, it is necessary to correct the predicted value.

In the predicted value correction step (S77), the predicted value extracted in the learning step (S75) is corrected. In the predicted value correction step (S77), the predicted value is corrected through the correction value extracted from the noise corresponding to the difference between the first imitation environment and the second imitation environment. The application of the correction value is simply reapplying the change in the numerical value. Rather, the correction value acts as a parameter for the predicted value to correct the predicted value.

The detailed description above is illustrative of the present invention. In addition, the above description shows and describes preferred embodiments of the present invention, and the present invention can be used in various other combinations, modifications and environments. That is, changes or modifications may be made within the scope of the concept of the invention disclosed in the present specification, the scope equivalent to the disclosed contents, and/or the skill or knowledge of the art. The above-described embodiments describe the best state for implementing the technical idea of the present invention, and various changes required in the specific application fields and uses of the present invention are possible. Therefore, the detailed description of the invention is not intended to limit the invention to the disclosed embodiment. In addition, the appended claims should be construed as including other embodiments.

1: Environment analysis and correction system for transfer learning
10: data collection unit 11: log collection module
13: Pre-processing module 15: Learning data input module
30: environment learning unit 31: environment information input unit
33: environment creation network 35: environment determination network
50: environmental difference analysis unit 51: imitation environment input unit
53: environmental difference learning unit 531: noise generating network
535: noise determination network 55: correction value extraction module
70: Machine Learning Department
71: variable extraction module 73: algorithm selection module
75: learning module 77: predicted value correction module

Claims (20)

Environment difference analysis that extracts a correction value between the security environments by analyzing differences between the environment learning unit that learns different security environments to create an imitation environment that mimics the security environment and the imitation environments that are generated from the environment learning unit It includes a machine learning unit that derives a predicted value, which is a result of judgment on a security event, through sub and machine learning
The environment learning unit determines the fake security environment and the actual security environment through the environment information input unit receiving information of each security environment, an environment creation network that creates a fake security environment, and the security environment information input through the environment information input unit. Including the network to determine the environment,
The environment creation network and the environment determination network form a generative hostile neural network to learn and imitate the plurality of security environments to create an imitation environment,
The environment difference analysis unit learns differences between the imitation environments according to machine learning. The method of claim 1, wherein the environment learning unit learns and imitates a first security environment in which learning data for machine learning is generated and a second security environment in which a security event occurs to generate a first imitation environment and a second imitation environment. Environment analysis and correction system for transfer learning, characterized in that. delete The environment for transfer learning according to claim 2, wherein the environment learning unit receives information of each security environment from the first security environment and the second security environment and inputs the information to the environment information input unit to create an imitation environment. Analysis and calibration system. The method of claim 2, wherein the environment learning unit is transmitted and/or installed in a first security environment in which learning data for transfer learning is generated and a second security environment in which a security event occurs to learn the security environment in each of the security environments. Environment analysis and correction system for transfer learning, characterized in that to generate an imitation environment after being recovered. The machine learning of claim 2, wherein the environment difference analysis unit is an imitation environment input unit receiving information on the first and second imitation environments generated by the environment learning unit, and the difference between the first and second imitation environments. Environment analysis and correction system for transfer learning, characterized in that it comprises an environment difference learning unit to learn through. The method of claim 6, wherein the environment difference learning unit comprises a noise generating network and a noise discriminating network, and the noise generating network and the noise discriminating network constitute a generative adversarial neural network to form a difference between the first and second mimic environments. Environment analysis and correction system for transfer learning, characterized in that to derive. The method of claim 7, wherein the noise generating network generates a fake copying environment by transforming information of the first copying environment through noise, and the noise discrimination network discriminates the fake copying environment and the second copying environment,
Environment analysis and correction system for transfer learning, characterized in that the noise of the noise generating network is defined as a difference between each of the imitation environments. The method of claim 8, wherein the environmental difference analysis unit further comprises a correction value extraction module for extracting a correction value from the difference derived from the environmental difference learning unit, and the correction value extraction module inverts noise defined as the difference Environment analysis and correction system for transfer learning, characterized in that extracting the correction value. The method of any one of claims 1 to 2 and 4 to 9, wherein the environment analysis and correction system for transfer learning includes a log of the second security environment and learning data generated from the first security environment. Further comprising a data collection unit to collect and pre-process,
An environment analysis and correction system for transfer learning, characterized in that the machine learning unit performs transfer learning on the log of the second security environment based on the learning data generated from the first security environment transmitted from the data collection unit. The method of claim 10, wherein the machine learning unit comprises a variable extraction module for extracting a threat factor determination field from a preprocessed log, an algorithm selection module for selecting at least one of a plurality of algorithms for the preprocessed log, and the selected algorithm or algorithm. Environment analysis and correction system for transfer learning, characterized in that it comprises a learning module that performs machine learning using a combination. The method of claim 11, wherein the machine learning unit further comprises a prediction value correction module for correcting a prediction value extracted from the learning module,
The predicted value correction module is an environment analysis and correction system for transfer learning, characterized in that correcting the predicted value through a correction value extracted from noise. An environment learning step of learning different security environments to create an imitation environment that mimics the security environment, and an environment difference analysis step of extracting a correction value between the security environments by analyzing differences between the imitation environments created from the environment learning step , Including a data collection step of collecting and preprocessing security logs and learning data, and a machine learning step of deriving a predicted value, which is a judgment result of a security event through machine learning,
In the environmental learning step, the fake security environment and the actual security environment information received in the environment information input step of receiving the information of each security environment, the imitation environment creation step of creating a fake security environment, and the environment information input step Including an imitation environment determination step of determining a security environment,
The imitation environment creation step and the imitation environment determination step are performed in a generative hostile neural network to learn and imitate a plurality of security environments to create an imitation environment,
The environment difference analysis step is an environment analysis and correction method for transfer learning, characterized in that learning the difference between the imitation environments according to machine learning. The method of claim 13, wherein the environment learning step creates a first imitation environment and a second imitation environment by learning and imitating a first security environment in which learning data for machine learning is generated and a second security environment in which a security event occurs. Environment analysis and correction method for transfer learning, characterized in that to. delete The method of claim 14, wherein the environment difference analysis step comprises: an imitation environment input step in which information on the first imitation environment and the second imitation environment generated in the environment learning step is input, and a difference between the first and second imitation environments. An environment difference learning step of learning through machine learning and a correction value extraction step of extracting a correction value from the difference learned in the environment difference learning step,
In the step of extracting the correction value, the correction value is extracted by inverting the noise defined as the difference. The method of claim 16, wherein the learning of environmental differences comprises a noise generating step and a noise discriminating step, and the noise generating step and the noise discriminating step are performed in a generative adversarial neural network, Draw the difference,
In the noise generation step, information of the first imitation environment is transformed through noise to create a fake imitation environment, and in the noise determination step, the fake imitation environment and the second imitation environment are determined,
Environment analysis and correction method for transfer learning, characterized in that the noise in the noise generation step is defined as a difference between each of the imitation environments. The method of claim 17, wherein the environmental difference learning step further comprises a correction value extraction step of extracting a correction value from the noise defined as the difference, and the correction value extraction step is a correction value by inverting the noise defined as the difference. Environment analysis and correction method for transfer learning, characterized in that to extract. The method according to any one of claims 13 to 14 and 16 to 18, wherein the machine learning step is performed based on the learning data generated from the first security environment collected in the data collection step. Transfer learning is performed on the log,
Learning to perform machine learning using the variable extraction step of extracting the threat factor determination field from the preprocessed log, the algorithm selection step of selecting at least one of a plurality of algorithms for the preprocessed log, and the selected algorithm or a combination of algorithms Environment analysis and correction method for transfer learning, characterized in that it comprises a step. The method of claim 19, wherein the machine learning step further comprises a prediction value correction step of correcting the prediction value extracted from the learning step,
The predicted value correction step is an environmental analysis and correction method for transfer learning, characterized in that correcting the predicted value using a correction value extracted from noise.

Images