KR102307632B1 - Unusual Insider Behavior Detection Framework on Enterprise Resource Planning Systems using Adversarial Recurrent Auto-encoder - Google Patents

Abstract

Disclosed are a system and method for detecting an unusual behavior of a user of an enterprise information system based on an adversarial recurrent auto-encoder. In accordance with an embodiment of the present invention, the method for detecting the unusual behavior of the user of the enterprise information system based on the adversarial recurrent auto-encoder conducted by a computer system comprises the following steps of: drawing a determination model on a normal behavior of the user in the enterprise information system; and conducting the unusual insider behavior detection (UIBD) by calculating an error through the determination model. The step of conducting the UIBD is able to identify an unusual behavior when there is a greater error of the unusual behavior than an error of the preset normal behavior as the determination model is modeled by using only the normal behavior.

Description

{Unusual Insider Behavior Detection Framework on Enterprise Resource Planning Systems using Adversarial Recurrent Auto-encoder}

The following embodiments relate to a system and method for detecting an abnormal user behavior for a corporate information system, and more particularly, to a system and method for detecting an abnormal user behavior for a hostile recursive autoencoder-based corporate information system.

The modernization and globalization of enterprises has changed the composition of enterprises into something much more complex than in the past. During this transformation process, many companies have computerized many parts of their business operations to improve operational efficiencies. Today, various corporate resources such as finance, human resources, manufacturing and supply chain are managed by a computerized system called Enterprise Resource Planning System (ERP system). In the midst of these changes, corporate threats to compromise or destroy corporate resources are becoming increasingly sophisticated and covert. In particular, the threat of corporate resources through corporate insiders is an important issue that must be addressed.

An insider is defined as a current or former employee, contractor or other business partner who has or has access to an organization's networks, systems, or data. Threats from insiders to corporate resources can be more risky than threats from outsiders because they can gain access to deeper parts of the system that outsiders cannot. According to Gurucul's 2020 Insider Threat Report, a survey found that over 82% of security practitioners said their organization's insider threat effectiveness was 'somewhat effective', 'very effective' or 'very effective'. The need to prevent or mitigate attacks by both malicious and careless insiders has been raised by security professionals, government agencies, and corporate organizations.

Initially, role-based or scenario-based approaches were proposed to identify insider criminal activity or threats. Such an approach pre-defined patterns or conditions for suspicious behavior or threatening activity. An insider's activity may be considered suspicious if it satisfies a condition or matches a pattern of behavior. This approach excelled at detecting predefined anomalies or threats, but could not identify other undefined behaviors. In addition, every detail of the ERP system flow must be understood in order to create additional conditions or criteria for detecting new threats or anomalies.

To solve this limitation, there have been studies to solve the UIBD problem as a data-driven machine learning task. Based on a single probabilistic model or a class classifier derived only from a normative sample, they use the model to calculate the likelihood or error to estimate anomalies in a given sample. They assume that the probability or error of an anomalous sample will be greater than that of a normal sample because the model consists only of normal samples. We derive the normal behavior model using the hidden Markov model, principal component analysis, and isolation forest algorithm. However, these machine learning models assume that the given data distribution is linear. Unfortunately, this assumption cannot be guaranteed in practice. In order to overcome this limitation, various methods using deep learning that can model nonlinear and complex data distribution have been recently proposed (Non-Patent Document 1). However, such machine learning-based or deep-learning-based 'feature engineering' work is required to mine useful features from raw system logs. This task can improve the model's discriminating ability by removing some meaningless information or noise, but it is time consuming and difficult.

B. Sharma, P. Pokharel, and B. Joshi, "User behavior analytics for anomaly detection using lstm autoencoder-insider threat detection," in Proceedings of the 11th International Conference on Advances in Information Technology, pp. 1-9, 2020. P. Wang, B. Xu, J. Xu, G. Tian, C.-L. Liu, and H. Hao, "Semantic expansion using word embedding clustering and convolutional neural network for improving short text classification," Neurocomputing, vol. 174, pp. 806-814, 2016. D. P. Kingma and M. Welling, “Auto-encoding variational bayes,” arXiv preprint arXiv:1312.6114, 2013.

The embodiments describe a hostile recursive autoencoder-based enterprise information system user anomalous behavior detection system and method, and more specifically, a user anomalous behavior using a discrimination model for normal behavior derived based on a hostile iterative automatic encoder (ARAE). An object of the present invention is to provide a hostile recursive autoencoder-based enterprise information system user anomaly detection system and method, which can recognize user abnormal behavior without user intervention by performing detection (UIBD).

In addition, the embodiments provide a hostile recursive autoencoder-based system that can quickly identify specific threat cases by configuring an important threat dictionary and storing potential characteristics for severe cases in advance when a system administrator finds a serious case among the detection results. An object of the present invention is to provide a system and method for detecting an abnormal behavior of a corporate information system user.

According to an embodiment, a method for detecting a hostile recursive autoencoder-based user abnormal behavior performed by a computer system includes: deriving a discrimination model for a normal behavior of a user in a corporate information system; and performing a user abnormal behavior detection (Unusual Insider Behavior Detection, UIBD) by calculating an error through the discrimination model, wherein the performing of the user abnormal behavior detection includes: the discrimination model uses only the normal behavior Thus, when the error of the abnormal behavior is larger than the error of the preset normal behavior as it is modeled, the abnormal behavior can be identified.

In the step of deriving the discrimination model for the normal behavior of the user, the discrimination model may be derived using an adversarial recurrent auto-encoder (ARAE).

The adversarial iterative automatic encoder (ARAE), given an encoded input, encodes the input into a latent feature and makes it possible to calculate the error as it produces a reconstructed result, the latent feature being applied to calculate the adversarial loss. and the reconstructed result is used to calculate a reconstruction loss, and the adversarial iterative automatic encoder (ARAE) may optimize the adversarial loss and the reconstruction loss.

The step of deriving the discrimination model for the normal behavior of the user may include: encoding the raw system log for the normal behavior using a dense embedding vector (DEV) or one-hot encoding; and applying the encoded dense embedding vector or the result of one-hot encoding to an adversarial iterative automatic encoder (ARAE) to derive a discriminative model for a normal behavior.

The method may further include performing important threat detection through a fast track using a pre-stored significant threatening dictionary.

The important threat dictionary may include potential features of actions classified as serious threat actions by the system administrator during the detection of the user anomaly.

In the step of performing important threat detection through the fast track, a latent characteristic derived during the detection of the user anomaly is compared with the characteristic stored in the important threat dictionary and, if similar, it is considered that the action corresponding to the stored characteristic occurs. can

Performing the user anomaly detection by calculating an error through the discrimination model and performing important threat detection through the fast track using the pre-stored important threat dictionary can work complementary to identify the user anomaly. have.

A hostile recursive autoencoder-based corporate information system user abnormal behavior detection system according to another embodiment includes: a discrimination model modeling unit for deriving a judgment model for a normal behavior of a user in the corporate information system; and a user abnormal behavior detection unit that performs user abnormal behavior detection (Unusual Insider Behavior Detection, UIBD) by calculating an error through the discrimination model, wherein the user abnormal behavior detection unit includes the identification model using only the normal behavior As it is modeled, when the error of the abnormal behavior is greater than the preset error of the normal behavior, the abnormal behavior can be identified.

The discriminant model modeling unit may derive the discriminant model using an adversarial recurrent auto-encoder (ARAE).

The adversarial iterative automatic encoder (ARAE), given an encoded input, encodes the input into a latent feature and makes it possible to calculate the error as it produces a reconstructed result, the latent feature being applied to calculate the adversarial loss. and the reconstructed result is used to calculate a reconstruction loss, and the adversarial iterative automatic encoder (ARAE) may optimize the adversarial loss and the reconstruction loss.

The discriminant model modeling unit may include: a system log embedding unit that encodes a raw system log for a normal behavior using a dense embedding vector (DEV) or one-hot encoding; and an adversarial iterative automatic encoder (ARAE) that derives a discriminative model for normal behavior by applying the encoded dense embedding vector or a result of one-hot encoding.

It may further include an important threat detection unit that performs important threat detection through a fast track using a pre-stored significant threatening dictionary.

The important threat detection unit may be configured with latent characteristics of an action classified as a serious threat by a system administrator during detection of the user's abnormal behavior.

The important threat detection unit may compare a potential characteristic derived during the detection of the user abnormal behavior with a characteristic stored in the important threat dictionary and, when similar, considers that an action corresponding to the stored characteristic occurs.

Performing the user anomaly detection by calculating an error through the discrimination model and performing important threat detection through the fast track using the pre-stored important threat dictionary can work complementary to identify the user anomaly. have.

According to embodiments, by performing user anomaly detection (UIBD) using a discrimination model for normal behavior derived based on hostile iterative automatic encoder (ARAE), hostile behavior that can recognize abnormal behavior without user intervention It is possible to provide a recursive autoencoder-based corporate information system user anomaly detection system and method.

In addition, according to embodiments, when the system administrator finds a serious case among the detection results, by configuring an important threat dictionary and storing potential characteristics of the serious case in advance, the hostile recursive auto It is possible to provide an encoder-based enterprise information system user anomaly detection system and method.

1 is a block diagram illustrating an example of an internal configuration of a computer system according to an embodiment.
2 is a block diagram illustrating a hostile recursive autoencoder-based enterprise information system user abnormal behavior detection system according to an embodiment.
3 is a flowchart illustrating a method for detecting abnormal behavior of a hostile recursive autoencoder-based enterprise information system user according to an embodiment.
4 is a diagram illustrating a UIBD process using ARAE according to an embodiment.
5 shows a schematic diagram of a system log embedding according to an embodiment.
6 is a diagram illustrating structural details of ARAE for a process for calculating an objective function according to an embodiment.

Hereinafter, embodiments will be described with reference to the accompanying drawings. However, the described embodiments may be modified in various other forms, and the scope of the present invention is not limited by the embodiments described below. In addition, various embodiments are provided in order to more completely explain the present invention to those of ordinary skill in the art. The shapes and sizes of elements in the drawings may be exaggerated for clearer description.

Detecting an insider's anomaly in an enterprise information system (ERP system) is one of the essential parts to reduce the risk that insiders threaten and abuse corporate resources. Many approaches to behavior detection based on rule-based systems and probabilistic processes are currently limited to empirical monitoring using manually set algorithms or probabilistic boundaries. This approach requires prior knowledge such as user permission guidelines and process data characteristics. However, obtaining prior knowledge is difficult in practice, and these are typically not suitable for detecting anomalies that cannot be clearly defined using empirical rules.

The following embodiments of the present invention propose a new framework for user abnormal behavior detection (Unusual Insider Behavior Detection, UIBD) for an ERP system. The proposed framework initially derives a differential model for the normal behavior sample, and UIBD is performed by calculating the error using the model. Since the model is compiled using only normal samples, the error of non-stationary samples is greater than that of normal samples. Here, we present an Adversarial Recurrent Auto-encoder (ARAE) to derive a robust normal behavior model. To prove the effectiveness of the proposed framework based on ARAE, an experiment can be performed using a dataset consisting of insider behavior defined by the security audit log sequence of an ERP system operating in a real enterprise. Experimental results show that the proposed framework together with ARAE can successfully detect user anomaly and outperform other methods of detecting user anomaly or threat.

1 is a block diagram illustrating an example of an internal configuration of a computer system according to an embodiment. For example, the hostile recursive autoencoder-based enterprise information system user abnormal behavior detection system according to embodiments of the present invention may be implemented through the computer system (device) 100 of FIG. 1 . As shown in FIG. 1 , the computer system 100 is a component for executing the hostile recursive autoencoder-based corporate information system user anomaly detection method, and includes a processor 110 , a memory 120 , and a permanent storage device 130 . , a bus 140 , an input/output interface 150 , and a network interface 160 .

Processor 110 may include or be part of any apparatus capable of processing any sequence of instructions. Processor 110 may include, for example, a computer processor, a processor in a mobile device, or other electronic device and/or a digital processor. The processor 110 may be included in, for example, a server computing device, a server computer, a set of server computers, a server farm, a cloud computer, a content platform, a mobile computing device, a smartphone, a tablet, a set-top box, a media player, and the like. The processor 110 may be connected to the memory 120 through the bus 140 .

Memory 120 may include volatile memory, permanent, virtual, or other memory for storing information used by or output by computer system 100 . The memory 120 may include, for example, random access memory (RAM) and/or dynamic RAM (DRAM). Memory 120 may be used to store any information, such as state information of computer system 100 . The memory 120 may also be used to store instructions of the computer system 100 including, for example, instructions for detecting a hostile recursive autoencoder-based corporate information system user anomaly. Computer system 100 may include one or more processors 110 as needed or appropriate.

Bus 140 may include a communications infrastructure that enables interaction between various components of computer system 100 . Bus 140 may carry data between, for example, components of computer system 100 , such as between processor 110 and memory 120 . Bus 140 may include wireless and/or wired communication media between components of computer system 100 and may include parallel, serial, or other topological arrangements.

Persistent storage 130 is a component, such as memory or other persistent storage, as used by computer system 100 to store data for an extended period of time (eg, compared to memory 120 ). may include Persistent storage 130 may include non-volatile main memory as used by processor 110 in computer system 100 . Persistent storage 130 may include, for example, flash memory, a hard disk, an optical disk, or other computer readable medium.

The input/output interface 150 may include interfaces to a keyboard, mouse, voice command input, display, or other input or output device. Configuration commands and/or information for detecting abnormal behavior of a hostile recursive autoencoder-based enterprise information system user may be received through the input/output interface 150 .

Network interface 160 may include one or more interfaces to networks such as a local area network or the Internet. Network interface 160 may include interfaces for wired or wireless connections. Information for configuration commands and/or hostile recursive autoencoder-based enterprise information system user anomaly detection may be received through the network interface 160 .

Also, in other embodiments, computer system 100 may include more components than those of FIG. 1 . However, there is no need to clearly show most of the prior art components.

2 is a block diagram illustrating a hostile recursive autoencoder-based enterprise information system user abnormal behavior detection system according to an embodiment.

FIG. 2 is a diagram illustrating an example of components that the processor 110 of the computer system 100 according to the embodiment of FIG. 1 may include. Here, the processor 110 of the computer system 100 may include the hostile recursive autoencoder-based enterprise information system user abnormal behavior detection system 200 according to an embodiment. The hostile recursive autoencoder-based enterprise information system user abnormal behavior detection system 200 according to an embodiment includes a discriminative model modeling unit 210 , a user abnormal behavior detection unit 220 and an important threat detection unit 230 . can Also, according to an embodiment, the discriminant model modeling unit 210 may include a system log embedding unit 211 and an adversarial iterative automatic encoder (ARAE) 212 .

The processor 110 and the components of the processor 110 may perform the steps S310 to S330 included in the hostile recursive autoencoder-based enterprise information system user anomaly detection method of FIG. 3 . For example, the processor 110 and components of the processor 110 may be implemented to execute an operating system code included in the memory 120 and an instruction according to at least one program code described above. Here, the at least one program code may correspond to a code of a program implemented to process the hostile recursive autoencoder-based enterprise information system user abnormal behavior detection.

The hostile recursive autoencoder-based corporate information system user anomaly detection method may not occur in the order shown, and some of the steps may be omitted or additional processes may be further included.

3 is a flowchart illustrating a method for detecting abnormal behavior of a hostile recursive autoencoder-based enterprise information system user according to an embodiment.

Referring to Figure 3, the hostile recursive autoencoder-based corporate information system user abnormal behavior detection method performed by the computer system according to an embodiment, the step of deriving a judgment model for the user's normal behavior in the corporate information system (S310) ), and calculating an error through the discrimination model to perform Unusual Insider Behavior Detection (UIBD) (S320). In the step S320 of detecting the user's abnormal behavior, the abnormal behavior may be identified when the abnormal behavior error is greater than the preset normal behavior error as the determination model is modeled using only the normal behavior.

In addition, the method may further include performing important threat detection through a fast track using a pre-stored significant threatening dictionary ( S330 ).

According to embodiments, by performing user anomaly detection (UIBD) using a normal behavior discrimination model derived based on an adversarial repeating automatic encoder (ARAE), a user abnormal behavior can be recognized without user intervention.

In addition, according to embodiments, when a system administrator finds a serious case among detection results, a specific threat case can be quickly identified by configuring an important threat dictionary and storing potential characteristics of the serious case in advance.

The hostile recursive autoencoder-based corporate information system user anomalous behavior detection method according to an embodiment may be described in more detail with an example of the hostile recursive autoencoder-based corporate information system user abnormal behavior detection system according to the embodiment described in FIG. 2 . have. The hostile recursive autoencoder-based enterprise information system user abnormal behavior detection system 200 according to an embodiment includes a discriminative model modeling unit 210 , a user abnormal behavior detection unit 220 and an important threat detection unit 230 . can Also, according to an embodiment, the discriminant model modeling unit 210 may include a system log embedding unit 211 and an adversarial iterative automatic encoder (ARAE) 212 .

In step S310, the discrimination model modeling unit 210 may derive a discrimination model for the user's normal behavior in the corporate information system. The discriminant model modeling unit 210 may derive a discriminant model using an adversarial iterative automatic encoder (ARAE). Here, an adversarial iterative autoencoder (ARAE), given an encoded input, encodes the input into latent features and makes it possible to compute the error as it produces a reconstructed result. The latent features are applied to calculate the adversarial loss, the reconstructed result is used to calculate the reconstruction loss, and the adversarial iterative autoencoder (ARAE) can optimize the adversarial loss and the reconstruction loss.

The discriminant model modeling unit 210 may further include a system log embedding unit 211 and an adversarial iterative automatic encoder (ARAE) 212 . The system log embedding unit 211 may encode a raw system log for a normal behavior into a dense embedding vector (DEV). And the adversarial iterative automatic encoder (ARAE, 212) can derive a discriminant model for the normal behavior by applying the encoded dense embedding vector. On the other hand, although it is described here that the raw system log is encoded using dense vector embedding, it is not limited thereto, and there is another method of encoding time series data to be applicable to deep learning (eg, one-hot encoding). )) can be used. For example, the system log embedding unit 211 may encode the original system log for normal behavior or one-hot encoding. In addition, the adversarial iterative automatic encoder (ARAE) 212 may derive a discriminant model for normal behavior by applying the encoded one-hot encoding result.

In step S320 , the user abnormal behavior detection unit 220 may calculate an error through the discrimination model to perform user abnormal behavior detection (UIBD). The user abnormal behavior detection unit 220 may identify the abnormal behavior when the abnormal behavior error is greater than the preset normal behavior error as the determination model is modeled using only the normal behavior.

In step S330 , the important threat detection unit 230 may perform important threat detection through a fast track using a pre-stored important threat dictionary. Here, the important threat dictionary may consist of latent features of actions classified as serious threat actions by the system administrator during detection of user anomalies. The important threat detection unit 230 compares a potential characteristic derived during detection of an abnormal user behavior with a characteristic stored in an important threat dictionary and, if similar, may consider that an action corresponding to the stored characteristic occurs.

Performing user anomaly detection by calculating an error through the discrimination model and performing important threat detection through fast track using a pre-stored important threat dictionary can complement each other to identify user anomaly.

Embodiments of the present invention may provide a framework for user anomaly detection (UIBD) in the ERP system. This framework can provide powerful insider behavior detection without pre-defining anomalies or 'manipulating variables'. To achieve this, the proposed framework encodes the raw system log of the normal behavior into a dense embedding vector (DEV) and applies it to the adversarial iterative automatic encoder (ARAE) to derive a discriminant model for the normal behavior. The proposed framework provides both an unsupervised process for detecting comprehensive anomalies and a supervised detection process for specific insider behavior post-defined by the system administrator. In order to prove the effectiveness of the proposed framework, embodiments may test the proposed framework using a dataset consisting of ERP system logs recorded by various companies in practice. Experimental results show the effectiveness of the proposed framework in detecting user anomalies.

The main contribution of the present invention can be summarized as follows.

The proposed framework is a new framework for UIBD, and provides strong detection performance to identify various abnormal or threatening behaviors (abnormal behaviors) in the ERP system without prepared cases of abnormal or threatening behaviors and variable processing by system experts. do.

In addition, we use a novel method to derive a differential reconstruction model for a given normal behavior, namely, adversarial iterative automatic encoder (ARAE).

It is also a large public dataset for UIBD, which includes various insider behavior captured by ERP systems in real industrial settings.

Below, UIBD is described and the proposed framework and learning procedure are described in detail.

4 is a diagram illustrating a UIBD process using ARAE according to an embodiment.

Referring to FIG. 4 , the main components of the proposed framework can be divided into two core pipelines according to the purpose and type of user anomalous behavior aimed at detecting user anomalous behavior for the enterprise information system 401 . First, ARAE 405-based UIBD provides a comprehensive and automated identification process for user anomalies. This may be included in steps S310 and S320 described in FIG. 3 . Given a sequence 402 of the raw system log, the framework maps 403 the sequence to a DEV 404 and applies the DEV 404 to the ARAE 405 to reconstruct it. Then, an abnormal behavior is identified (409) by comparing (407, 408) the input vector and the reconstructed result (406). This is the main pipeline that can recognize user anomalies without user intervention.

The second part is the fast track 412, which uses the critical threat dictionary 411 to detect specific threats. This may be included in step S330 described with reference to FIG. 3 . The important threat dictionary 411 is composed of potential features of actions classified as serious threat actions by the system administrator among all detection results. In reality, it is inevitable for managers to analyze UIBD results. When the administrator finds a serious case among the detection results of the first pipeline (410), the administrator configures the critical threat dictionary 411 and stores potential characteristics of the severe case in the critical threat dictionary 411 (413, 414, 415, 416) can be done.

These two pipelines work complementary to identify user anomalies. The first UIBD process using ARAE 405 can automatically provide comprehensive UIBD results, but since it is computationally intensive it may not be appropriate to classify some serious behaviors that need to be identified quickly. A second UIBD process, which uses a dictionary to reduce response times and identify specific threatening behaviors, can provide shortcuts to identify specific behaviors defined by the administrator.

In other words, the embodiments are capable of fully automated anomaly detection and analysis through the first pipeline. This can provide an anomaly detection result based on the reconstruction error of the model, and if the system user sets the desired anomaly score, the result can be output accordingly. However, since it provides comprehensive analysis results, detailed analysis of the results must be performed by the user of the system, and it is computationally intensive because it uses all of the model's entire calculation routine.

Accordingly, the embodiments may detect an abnormal behavior based on user registration information using the second pipeline. At the request of the user of the system that was analyzing the detection result of the first pipeline, the latent feature of the selected behavior is stored, and only the feature can be detected. Also, in this case, a specific action can be recognized by being output in the form of classification rather than detection. However, it can be used only if there is a system user's pre-registration.

Accordingly, embodiments may support both unsupervised learning-based detection and supervised learning-based detection through abnormal behavior detection using two pipelines. In particular, embodiments may improve the classification performance of a model through the introduction of an adversarial learning method.

To process the system log to train a deep learning model, it is essential to encode the raw log into a vector space. As one of the approaches, one-hot encoding can be considered as a method of vectorizing a classified signal. Creating and updating the encoding result is simple and fast because we only need to add a new vector for the new category. Du applies the logarithm to the model by expressing the system log as a one-hot vector. However, because of the simplicity of the method, creating a new dimension for each category has the potential to lead to a curse of dimensionality.

Accordingly, embodiments may use dense vector embedding (Non-Patent Document 2) based on a neural network in front of ARAE, as shown in FIG. 4 , to encode the raw system log into a vector space.

5 shows a schematic diagram of a system log embedding according to an embodiment.

As shown in Figure 5, the raw ERP system log (represented by complex code) 510 _{is replaced by the integer s = {s t} }t=1:n(520), where s _t and n are time t, respectively. represents a single logarithm and the length of the action, and _{is converted back into a dense vector x = {x t} } t = 1: n (540) using an embedding network 530 based on a neural network.

There are several advantages to using an embedding layer instead of one-hot encoding. First, a trainable embedding layer capable of representing a semantic relationship between arbitrary input signals is utilized, and the input signal (Non-Patent Document 2) is mapped to an orthogonal vector space (not possible with one-hot encoding). Second, dense embeddings have dimensional flexibility to embed the raw signal into a specific vector space. Given an N-classification signal, the dimension of the one-hot vector space is at least greater than N. On the other hand, since dense embeddings do not enforce orthogonality between mapped vectors, signals can be mapped into a vector space with dimensions smaller than N.

The core hypothesis of the proposed framework is that when the reconstruction model is compiled using only regular behavior, the reconstruction error of anomalies will be greater than that of normal behavior. As a hypothesis, it is essential to derive a robust model that can explain all the details of a given normal behavior sample and can handle normal samples not seen in the training phase. In particular, as an input for deriving a discriminant model, behavior is defined by a set of system logs. Therefore, it is necessary to learn a global representation of the entire system log included in the sequence. Learning information features that can encompass behaviors of varying lengths and patterns may not be a straightforward task.

To solve this problem, we propose an autoencoder-based generative model called adversarial iterative autoencoder (ARAE).

6 is a diagram illustrating structural details of ARAE for a process for calculating an objective function according to an embodiment.

Referring to FIG. 6 , the main components of ARAE may include an encoder f, a decoder g, and a discriminator D. Discriminator D applies only to the training phase to utilize adversarial learning. RNN-based automatic encoders are generally used to extract features from time series data (Non-Patent Document 1). Here we can use this architecture to extract latent features from behaviors of varying lengths.

The encoder extracts the latent feature (vector) from the input, and by inputting the latent feature to the decoder, the reconstructed result can be obtained through the auto-encoder. In this case, the reconstruction loss 620 that is an error between the input of the original state and the reconstructed result may be obtained. In addition, a generalized model can be derived by reducing the dimension by obtaining the potential loss 610 from the latent feature. In this case, as an example, the range of the latent feature vector may be limited by using a Gaussian distribution.

를 생성한다. 순차 데이터를 처리하고 다양한 길이의 행위에서 전역 정보를 추출하기 위해, f와 g는 RNN 구조를 기반으로 컴파일되며, RNN 구조는 LSTM, GRU 또는 Naive RNN와 같은 다양한 유형의 메모리 셀에 의해 구축될 수 있다. 훈련 단계에서 x와

는 재구성 손실 L_Re(620)를 계산하는 데 사용되며, z는 학습의 적대적 손실 L_Adv(610)에 적용된다. UIBD를 위한 ARAE 학습에 대한 자세한 설명은 아래에 설명되어 있다. 제안된 RNN 기반 구조를 기반으로, ARAE는 일련의 로그에 걸쳐 유용한 기능을 모델링할 수 있으며, ERP 시스템 로그의 시퀀스에 대한 다양한 패턴을 자동으로 학습하여 이상행위를 식별할 수 있다.Using DEV x initially encoded by syslog embedding, encoder f maps DEV x to a latent feature z: f(x) = z, where z = {z _t }t=1:n and z _t is It is a latent feature extracted from _{x t .} g(z) = the result of reconstruction by applying z to the decoder g

create To process sequential data and extract global information from behaviors of varying lengths, f and g are compiled based on RNN structures, which can be built by different types of memory cells such as LSTMs, GRUs or naive RNNs. have. In the training phase, x and

is used to compute the reconstruction loss L _Re (620), and z is _{applied to the adversarial loss L Adv} (610) of learning. A detailed description of ARAE learning for UIBD is described below. Based on the proposed RNN-based structure, ARAE can model useful functions across a set of logs, and automatically learn various patterns for the sequence of ERP system logs to identify anomalies.

ARAE is optimized in terms of an objective function consisting of reconstruction loss and adversarial loss. In order to apply the batch training plan while implementing the proposed framework, we normalize all the action lengths to the maximum length nmax among the given training samples, since they must be normalized action lengths. Dummy data generated by length normalization is filled with zeros. However, to eliminate the effect of dummy data, it also creates a mask that distinguishes whether the data is real or dummy. The reconstruction loss term is formulated based on the Euclidean distance. The masked reconstruction loss is calculated as follows.

[Equation 1]

Here, m is a mask for temporal length normalization composed of 0 and 1 to indicate whether an element is valid for loss calculation. |m| ² represents the scale of m, and can be interpreted as the number of non-zero elements in m. The reconstruction loss term serves to extract a more global abstracted feature z compared to x.

The above reconstruction loss was inspired by an automatic encoder (Non-Patent Document 3), which is one of the generally used generative models. The autoencoder randomly encodes high-dimensional raw data into a low-dimensional latent feature space and decodes it into a high-dimensional result. According to this encode-decode process (i.e., reconstruction process), abstract features, which are more globalized information compared to the input sample, are mapped into the latent space. However, the latent feature space of the autoencoder is randomly constructed and can increase the uncertainty of the reconstruction process. According to a previous study (Non-Patent Document 1), uncertainty in the reconstruction process may reduce discriminant power by taking smaller reconstruction errors for abnormal samples. Therefore, UIBD performance may be degraded.

To reduce the uncertainty of the latent feature space, we can force the distribution of the latent features represented by z to be close to the known distribution using adversarial learning. The encoder f acts as a generator in the adversarial learning process. The hostile loss term can be defined as the following equation.

[Equation 2]

는 정규 분포 N(0, 1)에서 생성된 랜덤 변수를 나타낸다. D는 f에서 생성된 인코딩과 이전 정규 분포를 구별하는 것을 목표로 한다. 따라서, 최대화를 시도하는 상대방 D에 대해 L_Adv를 최소화하려고 노력한다. 적대적 손실을 사용하면 잠재 특징 분포의 확률적 분포 형태에 대한 지침을 제공하는 것으로 생각할 수 있으며 잠재 공간에 대한 불확실성을 줄일 수 있다.Here, D is a discriminator that applies adversarial learning to ARAE training. p _x represents the distribution of the training behavior sample x, which is actually defined as the training dataset.

denotes a random variable generated from a normal distribution N(0, 1). D aims to distinguish the encoding generated from f and the previous normal distribution. Therefore, we try to minimize _{L Adv} for the counterpart D that is trying to maximize. The use of adversarial loss can be thought of as providing guidance on the shape of the stochastic distribution of the latent feature distribution, and can reduce the uncertainty about the latent space.

Variation inference (Non-Patent Document 3) may be more familiar to ARAE as ARAE is based on autoencoders, but requires structural reorganization to derive expectations and changes. The adversarial method can be easily applied by adding a discriminator, which is a kind of independent function. This would actually be a huge advantage.

The overall goal can be defined as the following equation by the combination of all losses above.

[Equation 3]

Here, λ is a parameter balancing reconstruction and adversarial loss. The parameters of ARAE can be optimized by the following equation given.

[Equation 4]

ARAE is trained using stochastic gradient descent, and the discriminator is used only in the training phase.

를 비교하여 이상행위를 식별할 수 있다. 이 때, 비교는 다음 식에 의해 정의된 오류를 계산하여 수행될 수 있다.As shown in FIG. 4 , there are two parts for identifying user abnormal behavior. First, the proposed framework assumes that the input x and the reconstruction result generated from ARAE g f(x) =

can be compared to identify abnormal behavior. In this case, the comparison can be performed by calculating the error defined by the following equation.

[Equation 5]

Here, n _x represents the length of time x.

The UIBD process using the above error can be expressed as the following equation.

[Equation 6]

사이의 오차를 계산하는 함수를 나타낸다. 따라서 오차가 임계값 τ보다 크면, 주어진 입력은 이례적인 것으로 간주된다.where τ is a manually determined threshold, E is x and

Represents a function that calculates the error between Therefore, if the error is greater than the threshold τ, the given input is considered anomalous.

사이의 주어진 계산 오류 식인 [수학식 5]에 의해 수행될 수 있다.Second, it is possible to detect important threats through a fast track together with an important threat dictionary. Critical threat detection is performed by comparing latent features with pre-stored features. When a given latent feature is similar to a specific feature in the dictionary, it can be considered that an action corresponding to the stored feature occurs. Detection is a latent feature z and a pre-stored feature

It can be performed by [Equation 5], which is a given calculation error expression between

[Equation 7]

는 사전에 저장된 잠재적인 특징을 나타낸다. N_DICT는 사전에 등록된 특징의 수이다. 잠재된 특징은 원시 로그나 dense 벡터보다 더 일반화된 정보를 제공하여 패스트 트랙을 사용하는 UIBD에 대한 일반화 성능을 향상시킬 수 있다.here,

represents a potential feature stored in advance. N _DICT is the number of pre-registered features. The latent features can provide more generalized information than raw logarithms or dense vectors, which can improve generalization performance for UIBDs using fast track.

Since adversarial learning is applied only in the training phase, the model complexity can change in the training and testing phases. Given an encoded input in the training phase, ARAE encodes the input into latent features and produces a reconstructed result. The latent feature is _{applied to calculate the adversarial loss L Adv} [Equation 2], and the reconstructed result is _{used to calculate the reconstruction loss L Re} [Equation 1]. In the above process, the discriminator is used for adversarial learning. Therefore, the model complexity of the proposed framework in the training phase is calculated by the sum of the ARAE and the model complexity of the discriminator.

On the other hand, given the input data in the test phase, ARAE measures the anomaly of the given input by generating a reconstructed result and calculating the error. Since the discriminator for adversarial learning is not applied in the testing phase, the model complexity of the framework proposed in the testing phase is defined only by the model complexity of ARAE.

인 O(2W)이다. 여기서, n_c는 GRU 셀 수, n_i는 입력 단위 수, n_o는 출력 단위 수이다. 둘째, 완전히 연결된 네트워크로 구성된 판별기의 모델 복잡도는 각각 N = n_i ^fc Х n_o ^fc인 O(N)이다. 여기서, n_i ^fc와 n_o ^fc는 입력 및 출력 단위의 수를 나타낸다. 판별기는 훈련 단계에서만 사용된다.The model complexity of ARAE and discriminator is calculated as follows. First, the model complexity of ARAE using GRU is

is O(2W). Here, n _c is the number of GRU cells, n _i is the number of input units, and n _o is the number of output units. Second, the model complexity of the discriminator composed of fully connected networks is O(N) with _{N = n i} ^fc Х n _o ^{fc , respectively.} Here, n _i ^fc and n _o ^fc represent the number of input and output units. The discriminator is only used in the training phase.

Therefore, the model complexity of the proposed framework for each training step and testing step is O(2W + N) and O(2W), respectively. Also, the model complexity of UIBD using fast track is O(W), which is half of the main pipeline using ARAE. For reference, UIBD via fast track uses only the encoder part f of ARAE, so you can think of it as less computationally intensive than the main pipeline. However, in practice, the computational complexity may vary depending on the amount of training dataset or the length of time of each input data. Therefore, it is important to monitor the actual execution speed during the test phase.

The device described above may be implemented as a hardware component, a software component, and/or a combination of the hardware component and the software component. For example, devices and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable array (FPA), It may be implemented using one or more general purpose or special purpose computers, such as a programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For convenience of understanding, although one processing device is sometimes described as being used, one of ordinary skill in the art will recognize that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that can include For example, the processing device may include a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as parallel processors.

The software may comprise a computer program, code, instructions, or a combination of one or more thereof, which configures a processing device to operate as desired or is independently or collectively processed You can command the device. The software and/or data may be any kind of machine, component, physical device, virtual equipment, computer storage medium or device, to be interpreted by or to provide instructions or data to the processing device. may be embodied in The software may be distributed over networked computer systems, and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiment, or may be known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

As described above, although the embodiments have been described with reference to the limited embodiments and drawings, various modifications and variations are possible from the above description by those skilled in the art. For example, the described techniques are performed in a different order than the described method, and/or the described components of the system, structure, apparatus, circuit, etc. are combined or combined in a different form than the described method, or other components Or substituted or substituted by equivalents may achieve an appropriate result.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (16)

A method for detecting abnormal behavior of a hostile recursive autoencoder-based corporate information system user performed by a computer system, the method comprising:
deriving a model for determining the user's normal behavior in the corporate information system; and
Performing Unusual Insider Behavior Detection (UIBD) by calculating an error through the discrimination model
including,
The step of detecting the user anomaly includes:
Identifying an abnormal behavior when the error of the abnormal behavior is greater than the preset error of the normal behavior as the discrimination model is modeled using only the normal behavior
Characterized in, the user abnormal behavior detection method. According to claim 1,
The step of deriving a discrimination model for the user's normal behavior comprises:
Deriving the discriminant model using an Adversarial Recurrent Auto-encoder (ARAE)
Characterized in, the user abnormal behavior detection method. 3. The method of claim 2,
The adversarial iterative automatic encoder (ARAE) comprises:
Given an encoded input, encode the input into a latent feature and make it possible to calculate the error as it produces a reconstructed result, the latent feature is applied to calculate an adversarial loss, and the reconstructed result is the reconstruction loss. wherein the adversarial iterative automatic encoder (ARAE) optimizes the adversarial loss and the reconstruction loss.
Characterized in, the user abnormal behavior detection method. According to claim 1,
The step of deriving a discrimination model for the user's normal behavior comprises:
encoding the raw system log for the normal behavior with a dense embedding vector (DEV) or one-hot encoding; and
applying the encoded dense embedding vector or the result of one-hot encoding to an adversarial iterative automatic encoder (ARAE) to derive a discriminant model for normal behavior
Including, a user anomaly detection method. According to claim 1,
Performing important threat detection through a fast track using a pre-stored significant threatening dictionary
Further comprising, a user anomaly detection method. 6. The method of claim 5,
The important threat dictionary is:
Consisting of potential characteristics of actions classified as serious threat actions by the system administrator among the detection of user anomalies
Characterized in, the user abnormal behavior detection method. 7. The method of claim 6,
The step of performing important threat detection through the fast track comprises:
Comparing the latent feature derived during the detection of the user anomaly with the feature stored in the important threat dictionary and, if similar, it is considered that the behavior corresponding to the stored feature occurs
Characterized in, the user abnormal behavior detection method. 6. The method of claim 5,
The execution of the user anomaly detection by calculating an error through the discrimination model and the execution of the important threat detection through the fast track using the pre-stored important threat dictionary are complementary to identify the user anomaly. thing
Characterized in, the user abnormal behavior detection method. In the hostile recursive autoencoder-based corporate information system user abnormal behavior detection system,
a discrimination model modeling unit for deriving a discrimination model for a user's normal behavior in the corporate information system; and
A user abnormal behavior detection unit that performs user abnormal behavior detection (UIBD) by calculating an error through the discrimination model
including,
The user abnormal behavior detection unit,
Identifying an abnormal behavior when the error of the abnormal behavior is greater than the preset error of the normal behavior as the discrimination model is modeled using only the normal behavior
Characterized in, the user anomaly detection system. 10. The method of claim 9,
The discriminant model modeling unit,
Deriving the discriminant model using an Adversarial Recurrent Auto-encoder (ARAE)
Characterized in, the user anomaly detection system. 11. The method of claim 10,
The adversarial iterative automatic encoder (ARAE) comprises:
Given an encoded input, encode the input into a latent feature and make it possible to calculate the error as it produces a reconstructed result, the latent feature is applied to calculate an adversarial loss, and the reconstructed result is the reconstruction loss. wherein the adversarial iterative automatic encoder (ARAE) optimizes the adversarial loss and the reconstruction loss.
Characterized in, the user anomaly detection system. 10. The method of claim 9,
The discriminant model modeling unit,
a system log embedding unit that encodes a raw system log for a normal behavior by a dense embedding vector (DEV) or one-hot encoding; and
An adversarial iterative automatic encoder (ARAE) that derives a discriminative model for normal behavior by applying the encoded dense embedding vector or the result of one-hot encoding
Including, user anomaly detection system. 10. The method of claim 9,
An important threat detection unit that performs important threat detection through a fast track using a pre-stored significant threatening dictionary
Further comprising, a user anomaly detection system. 14. The method of claim 13,
The important threat detection unit,
Consisting of potential characteristics of actions classified as serious threat actions by the system administrator among the detection of user anomalies
Characterized in, the user anomaly detection system. 15. The method of claim 14,
The important threat detection unit,
Comparing the latent feature derived during detection of the user anomaly with the feature stored in the important threat dictionary and, if similar, considers that the action corresponding to the stored feature occurs
Characterized in, the user anomaly detection system. 14. The method of claim 13,
The execution of the user anomaly detection by calculating an error through the discrimination model and the execution of the important threat detection through the fast track using the pre-stored important threat dictionary are complementary to identify the user anomaly. thing
Characterized in, the user anomaly detection system.

Images