KR102497737B1 - A system and method for detecting undetected network intrusions types using generative adversarial network - Google Patents

Abstract

A system for detecting an undiscovered network intrusion type using a generative adversarial network according to the present invention, comprising: a service system that wants to receive an intrusion detection service; a service network to receive the intrusion detection service; a network traffic receiver for receiving network traffic information generated in the service system or service network in real time; an image converter converting the network traffic information received by the network traffic receiver into actual image data; a virtual image data generating unit that generates virtual image data using virtual intrusion detection data similar to actual data rather than real data; a data discriminating unit that discriminates whether the real image data and the virtual image data are authentic; and a visualization unit that charts the result of the discrimination by the data discrimination unit and provides the result to the service system and service network, which are service targets, by creating a network attack type that has not been discovered so far and automating an environment for detecting it. It has the effect of improving the detection ability by itself.

Description

A SYSTEM AND METHOD FOR DETECTING UNDETECTED NETWORK INTRUSIONS TYPES USING GENERATIVE ADVERSARIAL NETWORK}

The present invention relates to a system and method for detecting an undiscovered network intrusion type using a generative adversarial network, and more particularly, to a new, similar to normal network traffic using a generative adversarial network (GAN). Utilize generative adversarial networks that can automatically and continuously strengthen the ability to detect new types of network intrusions by automatically generating intrusion-type traffic, adding it to normal/abnormal network traffic, and then repeatedly classifying it. It relates to a system and method for detecting undiscovered network intrusion types.

In the past, network intrusion types were not as complex as they are today, and attack techniques were not so sophisticated that security threats could be responded to with simple defense systems such as firewalls or IDS. Artificial intelligence was not necessary in the field of information security, which requires clear judgment.

Despite this reason, artificial intelligence technology in the field of network security has recently become a new alternative to respond to network attack techniques that are evolving to the extent that traditional defense methods are no longer able to respond.

In order to resolve the uncertainty of artificial intelligence as much as possible in the security field that requires clear judgment, 'supervised learning' is mainly applied based on data from which administrators or operators have confirmed normal or abnormal (attack) network traffic.

However, artificial intelligence technology in the form of supervised learning is a method of classifying whether new network traffic is normal or abnormal based on a model learned from past data of which normal or abnormality has been confirmed, so that known abnormalities (or attacks) It has an excellent ability to detect types of network traffic, but has limitations in classifying traffic for new types of attacks.

Network attacks continue to evolve with various variant techniques and new types of attack methods, and effectively responding to these attacks is the biggest task for information security experts. There is a need for a system that can automatically generate and classify network traffic of various types of new attacks.

Republic of Korea Patent Publication No. 10-2016-0095856 (2016. 08. 12)

In order to overcome the above limitations and meet the needs, the present invention uses GAN, an artificial intelligence technology, to automatically generate new intrusion-type traffic similar to normal network traffic, add it to normal/abnormal network traffic, and then classify it repeatedly. The purpose of this study is to provide a system and method for detecting undiscovered types of network intrusions using generative adversarial networks that can automatically enhance the ability to detect harmful types of network intrusions while performing.

In order to achieve the above object, a system for detecting an undiscovered network intrusion type using a generative adversarial network according to the present invention includes: a service system that wants to receive an intrusion detection service; a service network to receive the intrusion detection service; a network traffic receiver for receiving network traffic information generated in the service system or service network in real time; an image converter converting the network traffic information received by the network traffic receiver into actual image data; a virtual image data generating unit that generates virtual image data using virtual intrusion detection data similar to actual data rather than real data; a data discriminating unit that discriminates whether the real image data and the virtual image data are authentic; and a visualization unit for plotting the result discriminated by the data discrimination unit and providing the result to the service system and service network, which are service targets.

Preferably, the image conversion unit of the system for detecting an undiscovered network intrusion type by using the generative adversarial network according to the present invention to achieve the above object It is characterized by converting the load data into actual image data by digitizing it so that the generative adversarial neural network can understand it using the "Word To Vector" method.

Preferably, in order to achieve the above object, the virtual image data generation unit of the system for detecting an undiscovered network intrusion type using the generative adversarial network according to the present invention to generate virtual image data. ), it is characterized in that it learns to create virtual intrusion detection data in consideration of the results discriminated in.

More preferably, in order to achieve the above object, the data discrimination unit of the system for detecting an undiscovered network intrusion type using the generative adversarial network according to the present invention uses the real image data converted by the image conversion unit and the virtual image data After collecting the virtual image data generated by the generator, analyzing the actual image data pattern used for learning the learned artificial intelligence model, and discriminating the collected real image data and virtual image data according to the pattern to be

As another embodiment, in the method of detecting an undiscovered network intrusion type using the generative adversarial network according to the present invention to achieve the above object, (a) a service system in which a network traffic receiver wants to receive an intrusion detection service ( 110) or receiving network traffic information generated in the service network in real time; (b) converting, by an image conversion unit, into actual image data that can be learned by an artificial intelligence algorithm using network traffic information transmitted from the network traffic reception unit; (c) generating virtual image data for virtual intrusion detection similar to real by a virtual image data generating unit; (d) determining whether the real image data and the virtual image data are authentic or false by the data discrimination unit; (e) determining whether the real image data and the virtual image data are authentic by the data discrimination unit; (f) the visualization unit visualizes the results discriminated by the data discrimination unit, and provides the results to the service system and the service network;

Preferably, in step (e) of the method of detecting an undiscovered network intrusion type using the generative hostile neural network according to the present invention to achieve the above object, the actual image used for learning the artificial intelligence model learned by the data discrimination unit It is characterized in that the data pattern is analyzed and the real image data and the virtual image data collected according to the pattern are discriminated.

The system and method for detecting an undiscovered network intrusion type using a generative adversarial network according to the present invention can self-improve network attack detection capabilities by creating a hitherto undiscovered network attack type and automating the detection environment. There is an effect.

In addition, the system and method for detecting an undiscovered network intrusion type using a generative adversarial network according to the present invention can independently detect network intrusion, and can also be added to an existing network intrusion detection system to enhance the function of the system. There is an effect that can be operated in the form of

In addition, in the system and method for detecting an undiscovered network intrusion type using a generative adversarial network according to the present invention, network data used for learning an artificial intelligence model is not processed data for which an administrator or operator has set an answer, but However, since artificial intelligence learns on its own by immediately using all traffic existing on the network, it has the effect of implementing the system more effectively.

1 is a block diagram of a system for detecting an undiscovered network intrusion type using a generative adversarial network according to the present invention.
2 is a diagram for explaining how an artificial intelligence model is created by quantifying and clustering actual image data in a system for detecting undiscovered network intrusion types using a generative adversarial neural network according to the present invention.
3 is a flowchart of a method for detecting an undiscovered network intrusion type using a generative adversarial network according to the present invention.
4 is a flowchart of a method of creating a database of a method of detecting an undiscovered network intrusion type using a generative hostile neural network according to the present invention.
5 is a detailed flowchart of a data preprocessing method in a method of detecting an undiscovered network intrusion type using a generative adversarial network according to the present invention.

The terms or words used in this specification and claims should not be construed as being limited to ordinary or dictionary meanings, and the inventors may appropriately define the concept of terms in order to explain their invention in the best way. Based on the principle that there is, it should be interpreted as meaning and concept consistent with the technical spirit of the present invention.

Therefore, since the embodiments described in this specification and the configurations shown in the drawings are only one of the most preferred embodiments of the present invention and do not represent all of the technical ideas of the present invention, they can be substituted at the time of this application It should be understood that there may be many equivalents and variations.

Hereinafter, a system for detecting an undiscovered network intrusion type using a generative adversarial network according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of a system for detecting an undiscovered network intrusion type using a generative adversarial network according to the present invention.

As shown in FIG. 1, the system for detecting an undiscovered network intrusion type using the generative adversarial network according to the present invention includes a service system 110, a service network 120, a network traffic receiving unit 130, and an image conversion unit. 140, a virtual image data generating unit 150, a data discrimination unit 160, and a visualization unit 170.

The service system 110 is a system that wants to receive a service for detecting an undiscovered network intrusion type using the generative adversarial network according to the present invention.

Similarly, the service network 120 is a network for receiving a service for detecting an undiscovered network intrusion type using the generative adversarial network according to the present invention.

The network traffic receiver 130 is a component that receives network traffic information generated in the service system 110 or the service network 120 in real time.

The network traffic receiving unit 130 transfers the network traffic information received from the service system 110 or the service network 120 to the image conversion unit 140 and stores it.

Meanwhile, the network traffic information basically refers to all data traveling on the Internet, and is referred to as a packet.

The packet is a compound word of a package and a bucket, which means a lump. When data is exchanged over the Internet, if the data is larger than a certain size, it is cut into appropriate sizes and transmitted over the network. .

That is, the packet is a transmission unit of data cut to be easily transmitted through a network.

More specifically, the packet simply has the form of "Data Packet = Header + Data (Payload) + Tail". The header contains the Internet address and order of the destination, and error information is recorded in the tail.

In the present invention, learning to determine intrusion is automatically performed using data in the payload.

The image conversion unit 140 converts the network traffic information transmitted from the network traffic reception unit 130 into image data, which is optimal data for the artificial intelligence algorithm to learn.

The image conversion unit 140 can be used in various forms depending on the type of data, such as a “Word To Vector” method.

On the other hand, the image referred to in the present invention generally refers to data in the payload (payload), that is, data obtained by digitizing the payload data so that the artificial intelligence model can understand, rather than a commonly thought picture.

The digitized data may be the number of repetitions of specific characters (attack characters) in the payload data, or may indicate the distance between specific characters (attack characters).

Network attacks attack using network packet data, and the types are very diverse. These types of attacks are created by the National Intelligence Service at the national level and also by the Cyber Security Control Center in each administrative department.

Because public enterprises in the energy sector are affected by the Ministry of Trade, Industry and Energy, they use attack types defined by the Ministry of Trade, Industry and Energy's Cyber Security Control Center, and the present invention also targets attack types created by the Ministry of Industry and the National Intelligence Service.

Of course, each company or the company that produces the security control product makes it, but most of them edit and use the type created by the higher authority.

As described above, for various types of attacks, image data is created by quantifying the frequency of specific characters appearing in the type or the distance between specific characters.

[Table 1] and [Table 1] can be the same

1^M
0.9682332 2. 2. 0. 1.01779 0.95491135 0.7194433 2. 0.70200163 0.8353117 0.94830054 0.7439148 0. 0.80252534 0.8993441 0.6703^M645
0.9682332 2. 2. 0. 1.01779 2. 0.713479 1.1102833 0.6413943 0.8353117 0.94830054 0.703838 0. 0.8044252 0.8993441 0.64295757 1^M
0.9682332 2. 2. 0. 1.01779 2. 0.7194433 1.1102833 0.75359005 0.8353117 0.94830054 0.703838 0. 0.7892828 0.8993441 0.75035995 1^
1^M
2. 1.1365895 2. 0. 0.9806293 1.0023578 0.91741335 1.0499628 0.8835612 0.78502715 0.8929321 0.79431415 0^ 0.8307875 0.95784518 0.95784512
0.9682332 2. 1.0570022 0. 2. 0.96169907 0.8284959 1.1102833 0.83699673 0.78502715 0.94830054 0.7560764 0^0.
0.9682332 2. 2. 0. 1.01779 2. 0.7194433 1.1102833 0.75359005 0.8353117 0.94830054 0.703838 0. 0.7892828 0.8993441 0.75035995 1^
0.9682332 2. 2. 0. 1.01779 2. 0.7194433 1.1102833 0.75359005 0.8353117 0.94830054 0.703838 0. 0.7892828 0.8993441 0.75035995 1^
0.9682332 2. 2. 0. 1.01779 1.0013722 0.70126694 2. 0.7277234 0.76816434 0.94830054 0.7395296 0. 0.7892828 0.8993441 0.7742419

Since characters are a way to express human language and computers are machines that understand only 0 and 1, in order to process data based on characters, it is necessary to digitize it and express this number in binary and put it into a computer to obtain more accurate and faster results. Even if the character itself is used as a direct input to learn the model, the result is obtained, but the speed and accuracy are greatly reduced, so the image data conversion process by the image conversion unit 140 is required in the present invention.

The virtual image data generation unit 150 is a component that generates data of a new network intrusion detection type, and the data generated here means virtual intrusion detection data similar to actual data, not data that actually exists.

On the other hand, the virtual image data generator 150 learns to create more perfect virtual intrusion detection data in consideration of the result of discrimination in the previous sequence by the data discrimination unit 160 in order to generate virtual data. do.

The converted actual image data output through the image conversion unit 140 is data converted based on actual network traffic.

The virtual intrusion detection data generated and output through the virtual image data generator 150 is virtual data similar to actual intrusion data, and is a new type of intrusion detection data.

The data discriminating unit 160 collects the real image data converted by the image conversion unit 140 and the virtual image data generated by the virtual image data generating unit 150, the real image data and the virtual image data. Determine the authenticity of all data.

More specifically, the data discrimination unit 160 analyzes the pattern of real image data used for learning by the learned artificial intelligence model, and discriminates the real image data from the virtual image data according to the pattern.

For reference, the judgment of the artificial intelligence model cannot be explained by any formula, and through verification, the accuracy is calculated using the number of fakes as fake and the number of fakes as real, and as a result, this artificial intelligence model has a specific The model determines that the virtual image data is fake with a probability of accuracy.

The data discrimination unit 160 transfers the discrimination result to the visualization unit 170 at the output stage, and the visualization unit 170 makes the discrimination result graphically.

As mentioned above, the visualization unit 170 diagrams the result discriminated by the data discriminating unit 160 of the system for detecting an undiscovered network intrusion type using the generative adversarial network according to the present invention, and displays the result to the service target. It is provided to the service system 110 and the service network 120.

The system for detecting undiscovered network intrusion types using the generative adversarial neural network according to the present invention can create an artificial intelligence model as shown in FIG. 2a by quantifying and clustering them using actual image data.

Clustering by type of network attack is a method of learning a cluster artificial intelligence model, which is a kind of unsupervised learning.

When virtual image data is input to the model learned in this way, an image as shown in FIG. 2B is generated.

As shown in part A in FIG. 2B, a cluster made of only virtual image data is found, and the corresponding data is converted back into character payload data, and the operator analyzes it.

In summary, the present invention, as described above, finds a part in which the virtual image data is clustered, such as part A, and based on this, the operator determines whether there is an attack type.

As another embodiment, a detection method by a system for detecting an undiscovered network intrusion type using a generative adversarial network having the above configuration will be described.

The network traffic receiver 130 performs a step of receiving network traffic information generated in the service system 110 or the service network 120 in real time (S100).

Next, as a data pre-processing step, the image conversion unit 140 converts the network traffic information transmitted from the network traffic reception unit 130 into image data, which is optimal data for the artificial intelligence algorithm to learn. Do (S200).

In particular, as shown in FIG. 4, the service target system provides data in the form of a file or DB in step S100, and the receiver provides one consistent data for AI model learning in various types of data in step S200. Convert to type and save to DB.

In step S200, preprocessing steps such as removing missing information of traffic information, normalization, and calculating the distance between words are performed.

In addition, as shown in FIG. 5, for data received as a flow for a part that changes to an image (digitized data required for artificial intelligence model learning) and converted by a single method for artificial intelligence model learning, the corresponding data After going through refining (error correction) and normalization, and digitizing using Word2Vec, one of the artificial intelligence algorithms, the final image data for artificial intelligence model learning is finally generated.

The virtual image data generation unit 150 is a component that generates data of a new network intrusion detection type, and performs a step of generating virtual image data for detecting virtual intrusion that is similar to reality rather than actually existing data (S300). ).

It is preferable that the virtual intrusion detection data generated by the virtual image data generation unit 150 in step S300 is data converted by the image conversion unit 140 so that the artificial intelligence algorithm can learn it.

Only then can the virtual intrusion detection data generated by the virtual image data generator 150 be combined with the data converted by the image conversion unit 140 so that the artificial intelligence algorithm can learn.

Thereafter, the data discrimination unit 160 first performs a step of combining the actual image data converted by the image conversion unit 140 and the virtual image data generated by the virtual image data generation unit 150 ( S400).

Next, the data discriminating unit 160 performs a step of determining authenticity for both real image data and virtual image data collected as described above (S500).

Finally, the visualization unit 170 performs a step of visualizing the result of discrimination by the data discrimination unit 160 by drawing a diagram (S600).

Then, it is preferable that the visualization unit 170 performs a step of providing the result of the visualization of the diagram to the service system 110 and the service network 120, which are service targets.

In the above, the technical idea of the present invention has been described together with the accompanying drawings, but this is an illustrative example of a preferred embodiment of the present invention, but does not limit the present invention. In addition, it is obvious that various modifications and imitations can be made by anyone having ordinary knowledge in the technical field to which the present invention belongs without departing from the scope of the technical idea of the present invention.

110: service system
120: service network
130: network traffic receiving unit
140: image conversion unit
150: virtual image data generation unit
160: data identification unit
170: visualization unit

Claims (7)

In a system for detecting an undiscovered network intrusion type using a generative adversarial network,
service systems that wish to receive intrusion detection services;
a service network to receive the intrusion detection service;
a network traffic receiver for receiving network traffic information generated in the service system or service network in real time;
an image converter converting the network traffic information received by the network traffic receiver into actual image data;
a virtual image data generating unit that generates virtual image data using virtual intrusion detection data similar to actual data rather than actual data;
a data discriminating unit that discriminates whether the real image data and the virtual image data are authentic; and
A visualization unit for plotting the results of the discrimination by the data discrimination unit and providing the results to the service system and service network, which are service targets,
The virtual image data generating unit
In order to generate virtual image data, the data discrimination unit collects the actual image data converted by the image conversion unit for the previous sequence and the virtual image data generated by the virtual image data generation unit, and then learns New intrusion detection data with virtual data similar to real intrusion data, considering the result of analyzing the real image data pattern used for learning the artificial intelligence model and discriminating the real image data and virtual image data collected according to the pattern A system for detecting undiscovered network intrusion types using a generative adversarial network, characterized in that it learns to create virtual intrusion detection data.
According to claim 1,
The image conversion unit
Generative adversarial, characterized in that the payload data in the payload constituting the packet of the network traffic information is converted into actual image data by digitizing it so that the generative adversarial neural network can understand it in a "Word To Vector" method A system that uses neural networks to detect types of undiscovered network intrusions.
delete delete In the method of detecting an undiscovered network intrusion type using a generative adversarial network,
(a) receiving, in real time, network traffic information generated in the service system 110 or the service network to receive the detection service by the network traffic receiving unit;
(b) converting, by an image conversion unit, into actual image data that can be learned by an artificial intelligence algorithm using network traffic information transmitted from the network traffic reception unit;
(c) generating virtual image data for virtual intrusion detection similar to real by a virtual image data generating unit;
(e) determining whether the real image data and the virtual image data are authentic by the data discrimination unit;
(f) visualizing and visualizing the results discriminated by the data discriminating unit by the visualization unit, and providing the results to the service system and the service network;
In step (c) above
The virtual image data generating unit
In order to generate virtual image data, the data discrimination unit collects the actual image data converted by the image conversion unit for the previous sequence and the virtual image data generated by the virtual image data generation unit, and then learns New intrusion detection data with virtual data similar to real intrusion data, considering the result of analyzing the real image data pattern used for learning the artificial intelligence model and discriminating the real image data and virtual image data collected according to the pattern A method of detecting an undiscovered network intrusion type using a generative adversarial network, characterized in that it learns to create virtual intrusion detection data.
According to claim 5,
Between steps (c) and (e)
The method of detecting an undiscovered network intrusion type using a generative adversarial network, further comprising: (d) determining whether the data discriminating unit is authentic to the real image data and the virtual image data.
According to claim 6,
In step (e) above
The data discrimination unit analyzes the actual image data pattern used for learning the learned artificial intelligence model and discriminates between the real image data and the virtual image data collected according to the pattern. Discovery How to detect types of network intrusions.

Images