KR102617150B1 - Device, method and program for preventing false positives based on artificial intelligence using rule filtering - Google Patents

Abstract

This disclosure relates to an artificial intelligence-based false positive prevention device using rule filtering. When artificial intelligence-based prediction data for a monitored asset is generated, a rule filter is applied to predict whether there is a threat, and whether the prediction result is a false positive. It can be determined.

Description

Device, method and program for preventing false positives based on artificial intelligence using rule filtering}

This disclosure relates to a device for preventing false positives.

With the development of the Internet and systems, many changes are taking place in the security control field.

Based on these changes, the data required for security control is generated exponentially, resulting in a large amount of data that security control agents need to check, leading to a situation where people cannot control all situations.

The need for AI is emerging as one of the ways to solve these problems, and attempts are actually being made to introduce AI into the security control field.

However, in security control using AI, side effects due to large amounts of data and incorrect learning data cause false positives in AI's predicted data, which causes the problem of increased time consumption for security control agents.

Republic of Korea Patent No. 10-1871406, (2018.06.20)

The purpose of the embodiment disclosed in this disclosure is to provide an artificial intelligence-based false positive prevention device using rule filtering.

In addition, the embodiment disclosed in the present disclosure seeks to solve the problem of false positives occurring in artificial intelligence-based false positive prediction.

The problems to be solved by the present disclosure are not limited to the problems mentioned above, and other problems not mentioned can be clearly understood by those skilled in the art from the description below.

An artificial intelligence-based false positive prevention device using rule filtering according to an embodiment of the present disclosure to solve the above-described problem includes: a classification unit that classifies the security level of log data according to security risk; A prediction model that predicts whether there is a security threat to the monitored equipment by analyzing log data classified into at least one preset security level; a memory storing a rule table including at least one rule for determining whether first log data predicted to be in a security risk state through the prediction model is a false positive; and a processor that determines whether the prediction result is a false positive based on the at least one rule.

In addition, based on the determination result, the processor may provide the security control agent with second log data excluding the log data determined to be a false positive among the log data predicted to be in a security risk state through the prediction model.

In addition, the processor calculates the amount of the first log data predicted to be in a security risk state through the prediction model during a preset specific time, and the amount of the second log data provided to the security control agent during the specific time. and the efficiency of the rule table can be calculated based on the calculated amounts of first log data and second log data.

In addition, the actual efficiency of the rule table can be calculated based on the amount of log data selected as a security risk state by the security control agent among the second log data provided to the security control personnel during the specific time.

Additionally, if at least one of the calculated efficiency and the calculated actual efficiency is less than or equal to a preset value, the processor may request the security control agent to check the rule table.

In addition, when at least one new rule is received, the processor compares at least one rule included in the rule table and the received at least one new rule based on rule categories to determine rule pattern changes in each rule category. and derive at least one of a new rule pattern, and generate learning data for input into the prediction model based on the derived rule pattern change point and the new rule pattern.

In addition, it further includes a threat score calculation unit that calculates a security risk by analyzing security-related log data of the monitored equipment in real time, and the classification unit can classify the security level of the log data according to the calculated security risk.

In addition, the memory stores information on at least one monitoring element set according to the equipment type of the monitoring target device, and the prediction model analyzes the classified log data to determine at least one monitoring element set for the monitoring target device. By determining whether a risk factor that poses a threat to the monitored element exists, it is possible to predict whether there is a security threat to the monitored equipment.

In addition, the artificial intelligence-based false positive prevention method using rule filtering according to an embodiment of the present disclosure to solve the above-described problem is a method performed by a false positive prevention device, and logs of devices to be monitored according to security risk. Classifying the security level of data; Analyzing the classified log data to determine whether there is a security threat to the monitored equipment; and determining whether the prediction result is a false positive based on at least one rule for determining whether the first log data predicted to be in a security risk state through a prediction model is a false positive.

In addition to this, a computer program stored in a computer-readable recording medium for execution to implement the present disclosure may be further provided.

In addition, a computer-readable recording medium recording a computer program for executing a method for implementing the present disclosure may be further provided.

According to the means for solving the above-described problem of the present disclosure, the effect of preventing false positives based on artificial intelligence is provided using rule filtering.

In addition, according to the means for solving the above-described problem of the present disclosure, when artificial intelligence-based prediction data for an asset to be monitored is generated, it is possible to predict whether there is a threat by applying a rule filter and determine whether the prediction result is a false positive.

The effects of the present disclosure are not limited to the effects mentioned above, and other effects not mentioned may be clearly understood by those skilled in the art from the description below.

Figure 1 is a diagram illustrating the conventional way security control agents and artificial intelligence models performed security control.
Figure 2 is a schematic diagram of an artificial intelligence-based false positive prevention device using rule filtering according to an embodiment of the present disclosure.
Figure 3 is a block diagram of an artificial intelligence-based false positive prevention system using rule filtering according to an embodiment of the present disclosure.
Figure 4 is a flowchart of an artificial intelligence-based false positive prevention method using rule filtering according to an embodiment of the present disclosure.
Figure 5 is a diagram illustrating the operation of an artificial intelligence-based false positive prevention device using rule filtering according to an embodiment of the disclosure.
Figure 6 is a diagram illustrating that rules set for each equipment type are stored in memory.
Figure 7 is a diagram illustrating the step-by-step operation of an artificial intelligence model for log data generated from monitored equipment.

The advantages and features of the present disclosure and methods for achieving them will become clear by referring to the embodiments described in detail below along with the accompanying drawings. However, the present disclosure is not limited to the embodiments disclosed below and may be implemented in various different forms. The present embodiments are merely provided to ensure that the disclosure is complete and to provide a general understanding of the technical field to which the present disclosure pertains. It is provided to fully inform those skilled in the art of the scope of the present disclosure, and the present disclosure is defined only by the scope of the claims.

The terminology used herein is for the purpose of describing embodiments and is not intended to limit the disclosure. As used herein, singular forms also include plural forms, unless specifically stated otherwise in the context. As used in the specification, “comprises” and/or “comprising” does not exclude the presence or addition of one or more other elements in addition to the mentioned elements. Like reference numerals refer to like elements throughout the specification, and “and/or” includes each and every combination of one or more of the referenced elements. Although “first”, “second”, etc. are used to describe various components, these components are of course not limited by these terms. These terms are merely used to distinguish one component from another. Therefore, it goes without saying that the first component mentioned below may also be the second component within the technical spirit of the present disclosure.

Unless otherwise defined, all terms (including technical and scientific terms) used in this specification may be used with meanings commonly understood by those skilled in the art to which this disclosure pertains. Additionally, terms defined in commonly used dictionaries are not interpreted ideally or excessively unless clearly specifically defined.

Figure 1 is a diagram illustrating the conventional way security control agents and artificial intelligence models performed security control.

Referring to (A) in Figure 1, before artificial intelligence models were applied to the conventional security control field, security control personnel performed security control by directly monitoring log data of monitored equipment. However, as the amount of data became increasingly vast, human It is difficult to perform all security control directly.

Referring to Figure 1 (B), an artificial intelligence model is applied to monitor log data of the monitored equipment and perform security control.

However, determining whether there is a security threat is not a simple decision, and artificial intelligence models do not have separate rules for each case when analyzing log data to determine whether there is a security threat, so false positives often occur, which ultimately leads to security control issues. The problem is that the agent has to double check.

The inventor of the present disclosure seeks to solve the problems of the prior art described above through an artificial intelligence-based false positive prevention device and method using rule filtering according to an embodiment of the present disclosure.

Figure 2 is a schematic diagram of an artificial intelligence-based false positive prevention device 100 using rule filtering according to an embodiment of the present disclosure.

Referring to FIG. 2, the artificial intelligence-based false positive prevention device 100 using rule filtering according to an embodiment of the present disclosure applies a rule filter to AI security monitoring and security control to reduce the occurrence of false positives compared to the existing device. Significantly reducing the probability is illustrated.

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the attached drawings.

Figure 3 is a block diagram of an artificial intelligence-based false positive prevention system 10 using rule filtering according to an embodiment of the present disclosure.

Figure 4 is a flowchart of an artificial intelligence-based false positive prevention method using rule filtering according to an embodiment of the present disclosure.

Referring to FIG. 3, the false positive detection device 100 according to an embodiment of the present disclosure includes a processor 110, a communication unit 120, a classification unit 130, a prediction model 140, a memory 150, and an artificial intelligence model. (160) and statistical module (170).

However, in some embodiments, the false positive detection device 100 may include fewer or more components than those shown in FIG. 3 .

The communication unit 120 may receive or load log data of monitoring target equipment set as a monitoring target of the false positive detection device 100 in real time.

The classification unit 130 may classify the security level of log data according to the security risk.

The prediction model 140 predicts whether there is a security threat to the monitored equipment by analyzing log data classified into at least one preset security level.

At this time, the prediction model 140 may be an artificial intelligence model 160 learned through deep learning, machine learning, etc.

The memory 150 stores a rule table including at least one rule.

The false positive detection device 100 according to an embodiment of the present disclosure analyzes log data using an artificial intelligence-based prediction model 140 to determine whether the monitored equipment poses a security threat.

This artificial intelligence-based prediction model 140 can make decisions faster than those made by humans (security control personnel), but it has the problem that the probability of false positives rapidly increases.

In the embodiment of the present disclosure, the rule is used to determine whether log data predicted by the artificial intelligence-based prediction model 140 to be in a security risk state for the monitored equipment is a false positive.

Therefore, in the disclosed embodiment, the processor 110 performs rule filtering using the artificial intelligence model 160 to filter out false positives and provide information about security threats to security control agents.

The memory 150 stores various commands, algorithms, etc. for executing the false positive prevention method according to an embodiment of the present disclosure, and may also store an artificial intelligence model 160.

Additionally, the memory 150 may store various learning data for learning and upgrading the artificial intelligence model 160.

The statistical module 170 may generate statistical information by calculating the rule filtering efficiency and performance of the false positive detection device 100.

The processor 110 is responsible for controlling the components within the false positive detection device 100 and can execute false positive prevention methods and programs by executing instructions and algorithms stored in the memory 150.

Figure 4 is a flowchart of an artificial intelligence-based false positive prevention method using rule filtering according to an embodiment of the present disclosure.

FIG. 5 is a diagram illustrating the operation of the artificial intelligence-based false positive prevention device 100 using rule filtering according to an embodiment of the disclosure.

Figure 6 is a diagram illustrating that rules set for each equipment type are stored in the memory 150.

Figure 7 is a diagram illustrating the step-by-step operation of the artificial intelligence model 160 for log data generated from monitored equipment.

Below, the false positive detection device 100 and method according to an embodiment of the present disclosure will be described with reference to the flowchart of FIG. 4 and other drawings.

The processor 110 controls the classification unit 130 to classify the security level of log data for the monitored equipment according to the security risk. (S100)

The false positive detection device 100 according to an embodiment of the present disclosure may further include a threat score calculation unit that calculates the security risk by analyzing security-related log data of the monitored equipment in real time.

In one embodiment, the memory 150 stores information on at least one monitoring element set according to the type of equipment to be monitored.

This monitoring element information refers to the target, purpose, and precautions monitored by the monitored equipment, and can serve as a factor in determining at least one of the security level, security importance, and security risk of the monitored equipment.

Referring to FIG. 6, it is exemplified that a rule set classified by equipment type is stored in the memory 150.

This is an example of classification according to the type of monitoring target equipment managed by the false positive detection device 100.

However, the classification of the ruleset is not limited to this, and may be classified based on at least one of the type of equipment to be monitored, security level, and monitoring element information to determine whether false positives are detected in more detail.

The processor 110 analyzes the log data classified in S100 and determines whether there is a security threat to the monitored equipment. (S200)

The processor 110 determines whether the prediction result of S200 is a false positive based on at least one rule for determining whether the first log data predicted to be in a security risk state through the prediction model 140 is a false positive. (S300)

In detail, the processor 110 analyzes the log data classified in S100 using the artificial intelligence-based prediction model 140 to predict whether there is a security threat to the monitored equipment.

In one embodiment, the prediction model 140 is used in the process of analyzing log data classified in S100.

In S300, the processor 110 uses the artificial intelligence model 160 to determine whether the S200 prediction result is a false positive based on at least one rule. At this time, the security level of the monitored equipment corresponding to the predicted result is also considered to determine whether it is a false positive. can be determined.

In one embodiment, the memory 150 stores the average false positive rate for each type of monitored equipment accumulated over a preset time (long time), and in some embodiments, the average false positive rate for each time period may be stored.

When the processor 110 uses the artificial intelligence model 160 to determine whether the S200 prediction result is a false positive based on at least one rule, it determines whether the S200 prediction result is a false positive by referring to the average false positive rate of the monitored equipment corresponding to the predicted result. It can be determined.

In some embodiments, the processor 110 may further consider the current time to determine whether a false positive is present.

Based on the determination result of S300, the processor 110 provides the security control agent with second log data excluding the log data determined to be a false positive among the log data predicted to be a security risk state through the prediction model 140.

At this time, the processor 110 may output the second log data through the output means (e.g., video, voice, etc.) of the false positive detection device 100, and transmit it to the terminal of the security control agent through the communication unit 120. You can also provide it.

The processor 110 calculates the amount of first log data predicted to be in a security risk state through the prediction model 140 during a preset specific time.

The processor 110 calculates the amount of second log data provided to the security control personnel during a specific preset time.

Additionally, the processor 110 may calculate the efficiency of the rule table based on the amount of calculated first log data and calculated second log data.

In one embodiment, the processor 110 provides the second log data to the security control agent, then requests the security control agent to determine whether the second log data corresponds to the dangerous state of the monitored equipment, and the security control agent The judgment result can be received.

In one embodiment, the processor 110 may calculate the actual efficiency of the rule table based on the amount of log data selected as a security risk state by the security control agent among the second log data provided to the security control personnel during a specific time. .

If the efficiency of the rule table described above was a numerical efficiency calculated by the processor 110, the actual efficiency of the rule table may mean the actual efficiency determined by using feedback information received from security control personnel. .

In one embodiment, the processor 110 may request a security control agent to check the rule table when at least one of the calculated efficiency and the uncalculated actual efficiency is less than or equal to a preset value.

In one embodiment, when at least one new rule is received, the processor 110 compares at least one rule included in the rule table and at least one new rule received based on the rule category (type) to determine each rule. At least one of a category's rule pattern change and a new rule pattern can be derived.

Additionally, the processor 110 may generate learning data to be input into the prediction model 140 based on the derived rule pattern changes and new rule patterns.

In one embodiment, when at least one of the addition, change, and update of the monitored equipment is detected, the processor 110 checks whether a rule that needs to be confirmed exists among at least one rule in the rule table based on the detection result. You can.

The method according to an embodiment of the present disclosure described above may be implemented as a program (or application) and stored in a medium in order to be executed in combination with a server, which is hardware.

The above-mentioned program is C, C++, JAVA, machine language, etc. that can be read by the processor (CPU) of the computer through the device interface of the computer in order for the computer to read the program and execute the methods implemented in the program. It may include code coded in a computer language. These codes may include functional codes related to functions that define the necessary functions for executing the methods, and include control codes related to execution procedures necessary for the computer's processor to execute the functions according to predetermined procedures. can do. In addition, these codes may further include memory reference-related codes that indicate at which location (address address) in the computer's internal or external memory additional information or media required for the computer's processor to execute the above functions should be referenced. there is. In addition, if the computer's processor needs to communicate with any other remote computer or server in order to execute the above functions, the code uses the computer's communication module to determine how to communicate with any other remote computer or server. It may further include communication-related codes regarding whether communication should be performed and what information or media should be transmitted and received during communication.

The storage medium refers to a medium that stores data semi-permanently and can be read by a device, rather than a medium that stores data for a short period of time, such as a register, cache, or memory. Specifically, examples of the storage medium include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc., but are not limited thereto. That is, the program may be stored in various recording media on various servers that the computer can access or on various recording media on the user's computer. Additionally, the medium may be distributed to computer systems connected to a network, and computer-readable code may be stored in a distributed manner.

The steps of the method or algorithm described in connection with the embodiments of the present disclosure may be implemented directly in hardware, implemented as a software module executed by hardware, or a combination thereof. The software module may be RAM (Random Access Memory), ROM (Read Only Memory), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), Flash Memory, hard disk, removable disk, CD-ROM, or It may reside on any type of computer-readable recording medium well known in the art to which this disclosure pertains.

Above, embodiments of the present disclosure have been described with reference to the attached drawings, but those skilled in the art will understand that the present disclosure can be implemented in other specific forms without changing its technical idea or essential features. You will be able to understand it. Therefore, the embodiments described above should be understood in all respects as illustrative and not restrictive.

10: False positive prevention system
100: False positive prevention device
110: processor
120: Department of Communications
130: Classification department
140: Prediction model
150: memory
160: Artificial intelligence model
170: Statistics module

Claims (10)

A classification unit that classifies the security level of log data according to security risk;
A prediction model that predicts whether there is a security threat to the monitored equipment by analyzing log data classified into at least one preset security level;
a memory storing a rule table including at least one rule for determining whether first log data predicted to be in a security risk state through the prediction model is a false positive; and
A processor that determines whether the prediction result is a false positive based on the at least one rule,
The processor,
Based on the determination result, providing second log data excluding the log data determined as a false positive among the log data predicted to be in a security risk state through the prediction model to the security control agent,
Calculating the amount of the first log data predicted to be in a security risk state through the prediction model during a preset specific time,
Calculating the amount of the second log data provided to the security control personnel during the specific time,
Characterized in calculating the efficiency of the rule table based on the calculated amounts of first log data and second log data,
Artificial intelligence-based false positive prevention device using rule filtering.
delete delete According to paragraph 1,
Characterized in calculating the actual efficiency of the rule table based on the amount of log data selected as a security risk state by the security control agent among the second log data provided to the security control agent during the specific time.
Artificial intelligence-based false positive prevention device using rule filtering.
According to paragraph 4,
The processor,
When at least one of the calculated efficiency and the calculated actual efficiency is less than or equal to a preset value, requesting the security control agent to check the rule table,
Artificial intelligence-based false positive prevention device using rule filtering.
According to paragraph 1,
The processor,
If at least one new rule is received,
Compare at least one rule included in the rule table and the at least one new rule received based on the rule category to derive at least one of a rule pattern change point and a new rule pattern for each rule category,
Characterized in generating learning data for input into the prediction model based on the derived rule pattern changes and new rule patterns,
Artificial intelligence-based false positive prevention device using rule filtering.
According to paragraph 1,
It further includes a threat score calculation unit that calculates a security risk level by analyzing security-related log data of the monitored equipment in real time,
The classification unit classifies the security level of the log data according to the calculated security risk,
Artificial intelligence-based false positive prevention device using rule filtering.
According to paragraph 1,
The memory stores information about at least one monitoring element set according to the equipment type of the monitoring target equipment,
The prediction model predicts whether there is a security threat to the monitored device by analyzing the classified log data and determining whether there is a risk factor that may pose a threat to at least one monitoring element set for the monitored device. Characterized in that,
Artificial intelligence-based false positive prevention device using rule filtering.
In a manner carried out by an anti-false positive device,
Classifying the security level of log data for monitored equipment according to security risk;
Analyzing the classified log data to determine whether there is a security threat to the monitored equipment; and
It includes determining whether the prediction result is a false positive based on at least one rule for determining whether the first log data predicted to be in a security risk state through a prediction model is a false positive,
The false positive prevention device,
Based on the determination result, providing second log data excluding the log data determined as a false positive among the log data predicted to be in a security risk state through the prediction model to the security control agent,
Calculate the amount of the first log data predicted to be in a security risk state through the prediction model during a preset specific time,
Calculate the amount of the second log data provided to the security control personnel during the specific time,
Characterized in calculating the efficiency of the rule table based on the calculated amounts of first log data and second log data,
Artificial intelligence-based false positive prevention method using rule filtering.
A computer-readable recording medium combined with a hardware computer and storing a program for executing the method of claim 9.