KR102619905B1 - Apparatus and method for preventing abnormal data access based on artificial intelligence - Google Patents

Abstract

An artificial intelligence-based abnormal data access prevention device and method are disclosed, and the artificial intelligence-based abnormal data access prevention method according to an embodiment of the present application includes the steps of collecting target data accessing a predetermined data server, the target data Detecting abnormal traffic from the target data by inputting it into a pre-trained artificial intelligence-based detection model; and when the abnormal traffic is detected, stopping transmission of data associated with the data server and sending the target data to a preset It may include storing in a buffer.

Description

Device and method for preventing abnormal data access based on artificial intelligence {APPARATUS AND METHOD FOR PREVENTING ABNORMAL DATA ACCESS BASED ON ARTIFICIAL INTELLIGENCE}

This application relates to devices and methods for preventing abnormal data access based on artificial intelligence.

Thanks to recent advances in artificial intelligence technology, cyber attackers are attempting cyber security attacks using new cyber attacks and automation technologies using new types of intelligent algorithms, and are effectively responding to increasingly sophisticated and diverse cyber attacks. Therefore, existing security solutions have many limitations.

In this regard, Network-Based Intrusion Detection (NIDS) refers to detecting and responding to actions by unauthorized users illegally accessing or depleting information resources. Most solutions currently in use are limited to blocking attacks based on signature and rule-based scenarios. Although this method shows relatively high accuracy, experts must be brought in to analyze various attacks and create patterns. , there are limitations in that maintenance costs are continuously incurred, and it is difficult to bypass existing patterns or detect modified attacks.

In addition, the Statistics-Based Anomaly Detection technique is also used, which secures statistical data on normal network users and then claims that an intrusion has occurred when the scope is exceeded. However, recent cyber threats have become more advanced, automated, and As intelligence becomes more sophisticated, it is very difficult to identify threats from all actions occurring on the network and manage them in real time.

Meanwhile, in order to actively prepare for cyber threats, attempts are being made to incorporate artificial intelligence in the security field. In the security field, artificial intelligence is used in various fields such as network threat analysis, vulnerability analysis, malware analysis, and real-time detection and response. It is expected that detection and defense functions can be dramatically improved.

The technology behind this application is disclosed in Korean Patent Publication No. 10-2313414.

This application is intended to solve the problems of the prior art described above. When a hacking attempt occurs or abnormal traffic is detected in a system that is likely to be attacked by an unspecified number of people, such as a server, an artificial intelligence-based detection model detects this and retrieves abnormal data. The purpose is to provide artificial intelligence-based abnormal data access prevention devices and methods that block access.

However, the technical challenges sought to be achieved by the embodiments of the present application are not limited to the technical challenges described above, and other technical challenges may exist.

As a technical means for achieving the above-described technical problem, an artificial intelligence-based abnormal data access prevention method according to an embodiment of the present application includes the steps of collecting target data accessing a predetermined data server, and learning the target data in advance. Detecting abnormal traffic from the target data by inputting it into an artificial intelligence-based detection model; and when the abnormal traffic is detected, stopping transmission of data associated with the data server and storing the target data in a preset buffer. It may include steps.

Additionally, the detection model may be a model based on a Transformer algorithm.

In addition, the artificial intelligence-based abnormal data access prevention method according to an embodiment of the present application may include the step of training the detection model based on learning data including hacking traffic and changes in traffic before and after the hacking traffic. .

In addition, the artificial intelligence-based abnormal data access prevention method according to an embodiment of the present application determines whether the target data is data linked to a hacking attempt on the data server through detailed analysis of the target data stored in the buffer. It may include a step of determining.

In addition, the artificial intelligence-based abnormal data access prevention method according to an embodiment of the present application may include the step of resuming interrupted data transmission when it is determined that the target data is data unrelated to the hacking attempt.

In addition, the artificial intelligence-based abnormal data access prevention method according to an embodiment of the present application may include the step of transmitting a warning signal to a preset user terminal when it is determined that the target data is data corresponding to the hacking attempt. You can.

In addition, the artificial intelligence-based abnormal data access prevention method according to an embodiment of the present application tracks information about the transmitting subject who transmitted the target data when it is determined that the target data is data corresponding to the hacking attempt. May include steps.

Meanwhile, an artificial intelligence-based abnormal data access prevention device according to an embodiment of the present application includes a collection unit that collects target data accessing a predetermined data server, and inputs the target data into a previously learned artificial intelligence-based detection model. It may include a detection unit that detects abnormal traffic from the target data, and a control unit that stops transmission of data associated with the data server when the abnormal traffic is detected and stores the target data in a preset buffer.

In addition, the artificial intelligence-based abnormal data access prevention device according to an embodiment of the present application may include a learning unit that trains the detection model based on learning data including hacking traffic and changes in traffic before and after the hacking traffic. .

In addition, the artificial intelligence-based abnormal data access prevention device according to an embodiment of the present application determines whether the target data is data linked to a hacking attempt on the data server through detailed analysis of the target data stored in the buffer. It may include an analysis unit that determines .

Additionally, if the control unit determines that the target data is data unrelated to the hacking attempt, it may resume interrupted data transmission.

Additionally, if the control unit determines that the target data is data corresponding to the hacking attempt, it may transmit a warning signal to a preset user terminal.

Additionally, if the control unit determines that the target data is data corresponding to the hacking attempt, the control unit may track information about the transmitting entity that transmitted the target data.

The above-described means of solving the problem are merely illustrative and should not be construed as intended to limit the present application. In addition to the exemplary embodiments described above, additional embodiments may be present in the drawings and detailed description of the invention.

According to the above-described means of solving the problem of this institute, when a hacking attempt occurs or abnormal traffic is detected in a system that is likely to be attacked by an unspecified number of people, such as a server, an artificial intelligence-based detection model detects this and blocks access to abnormal data. It is possible to provide devices and methods for preventing abnormal data access based on artificial intelligence.

However, the effects that can be obtained herein are not limited to the effects described above, and other effects may exist.

1 is a schematic configuration diagram of an artificial intelligence-based security system including an artificial intelligence-based abnormal data access prevention device according to an embodiment of the present application.
Figure 2 is a conceptual diagram to explain an artificial intelligence-based detection model.
Figure 3 is a schematic configuration diagram of an artificial intelligence-based abnormal data access prevention device according to an embodiment of the present application.
Figure 4 is an operation flowchart of an artificial intelligence-based abnormal data access prevention method according to an embodiment of the present application.
Figure 5 is a detailed operation flowchart of a process for performing follow-up actions according to the results of detailed analysis of target data.

Below, with reference to the attached drawings, embodiments of the present application will be described in detail so that those skilled in the art can easily implement them. However, the present application may be implemented in various different forms and is not limited to the embodiments described herein. In order to clearly explain the present application in the drawings, parts that are not related to the description are omitted, and similar reference numerals are assigned to similar parts throughout the specification.

Throughout this specification, when a part is said to be “connected” to another part, this means not only “directly connected” but also “electrically connected” or “indirectly connected” with another element in between. "Includes cases where it is.

Throughout this specification, when a member is said to be located “on”, “above”, “at the top”, “below”, “at the bottom”, or “at the bottom” of another member, this means that a member is located on another member. This includes not only cases where they are in contact, but also cases where another member exists between two members.

Throughout the specification of the present application, when a part "includes" a certain component, this means that it may further include other components rather than excluding other components unless specifically stated to the contrary.

This application relates to devices and methods for preventing abnormal data access based on artificial intelligence.

1 is a schematic configuration diagram of an artificial intelligence-based security system including an artificial intelligence-based abnormal data access prevention device according to an embodiment of the present application.

Referring to FIG. 1, the artificial intelligence-based security system 10 according to an embodiment of the present application is an artificial intelligence-based abnormal data access prevention device 100 (hereinafter referred to as 'data access prevention') according to an embodiment of the present application. It may include a 'device 100'), a data server 200, an access device 300, and a user terminal 400.

The data access prevention device 100, the data server 200, the access device 300, and the user terminal 400 may communicate with each other through the network 20. The network 20 refers to a connection structure that allows information exchange between nodes such as terminals and servers. Examples of such networks 20 include the 3rd Generation Partnership Project (3GPP) network, Long Term Evolution) network, 5G network, WIMAX (World Interoperability for Microwave Access) network, Internet, LAN (Local Area Network), Wireless LAN (Wireless Local Area Network), WAN (Wide Area Network), PAN (Personal Area) Network), wifi network, Bluetooth network, satellite broadcasting network, analog broadcasting network, DMB (Digital Multimedia Broadcasting) network, etc., but are not limited thereto.

In the description of the embodiment of the present application, the data server 200 may mean a protected target whose abnormal data access is monitored by the data access prevention device 100. In other words, the data access prevention device 100 disclosed herein monitors data transmitters who want to access the data server 200 and the data (traffic) transmitted accordingly to prevent hacking attempts, malicious software (malware, ransomware, etc.) ) It can be designed to continuously monitor abnormal data access, such as transmission attempts, and take immediate action.

Additionally, in the description of the embodiment of the present application, the access device 300 may be a device corresponding to the subject who transmitted predetermined data transmitted to the data server 200 for access to the data server 200.

More specifically, the data access prevention device 100 disclosed herein analyzes various data transmitted toward the data server 200 for each transmitting entity and classifies each access device 300 as a normal access device 301 and an abnormal access device. It can be divided into devices 302 and operate to selectively allow only normal access devices 301 to access the data server 200. Meanwhile, as described in detail below, when abnormal data is detected, the data access prevention device 100 operates the abnormal access device 302 and/or the abnormal access device 302 that transmitted the data (target data). It may operate to estimate information (eg, access path, IP, device information, etc.) about the abnormal data transmission subject 1.

In addition, in the description of the embodiment of the present application, when the data access prevention device 100 detects abnormal data access or determines that a hacking attempt has occurred, the user terminal 400 sends a notification/warning signal for the situation. It may be a device equipped to receive information from the access prevention device 100. For example, the user terminal 400 may be a device owned by a management/operation entity (administrator, etc.) for the data server 200.

The access device 300 and/or the user terminal 400 include, for example, a smartphone, a SmartPad, a tablet PC, a personal communication system (PCS), a global system for mobile communication (GSM), and a PDC. (Personal Digital Cellular), PHS (Personal Handyphone System), PDA (Personal Digital Assistant), IMT (International Mobile Telecommunication)-2000, CDMA (Code Division Multiple Access)-2000, W-CDMA (W-Code Division Multiple Access) , It can be any type of wireless communication device, such as a Wibro (Wireless Broadband Internet) terminal.

Hereinafter, specific functions and operations of the data access prevention device 100 will be described.

The data access prevention device 100 can collect target data accessing the data server 200. For example, target data may be a concept that broadly includes various network signals, packets, files, connection signals, etc. transmitted from the access device 300 to the data server 200.

Additionally, abnormal traffic can be detected from the target data by inputting the collected target data into a pre-trained artificial intelligence-based detection model.

Figure 2 is a conceptual diagram to explain an artificial intelligence-based detection model.

Referring to FIG. 2, the artificial intelligence-based detection model possessed by the data access prevention device 100 may be a model based on a Transformer algorithm. For reference, in the description of the embodiments of the present application, the artificial intelligence-based detection model may be referred to differently as 'Identify AI', etc.

Here, the Transformer algorithm may include an encoder-decoder structure that receives an input sequence from an encoder and outputs an output sequence from a decoder, like the conventional seq2seq architecture. However, unlike the conventional seq2seq architecture, a plurality of encoders and decoders may be provided. In addition, the Transformer algorithm uses the Attention algorithm only internally without connecting the encoder and decoder, and has the characteristic of being composed only of an Attention neural network, not a RNN such as LSTM or GRU.

However, the type of artificial intelligence-based detection model of the data access prevention device 100 disclosed herein is not limited to the above-described Transformer algorithm, and according to the implementation example of the present application, LSTM (Long-Short Term Memory) Various time series analysis algorithm models, such as Algorithm, Attention Algorithm, and BERT, which are already known or developed in the future, can be applied.

In this regard, the data access prevention device 100 may learn an artificial intelligence-based detection model (transformer model) based on learning data including hacking traffic and changes in traffic before and after the hacking traffic.

For example, hacking traffic may be data prepared (secured) in advance to include abnormal traffic in order to build an artificial intelligence-based detection model, and the learning data for building a detection model is normal before and after the time the hacking traffic occurred. By collecting traffic to include hacking traffic and hacking traffic in a time-series manner, a detection model can be learned to distinguish between normal traffic and hacking traffic based on the time-series characteristics of the traffic.

More specifically, referring to FIG. 2, the data access prevention device 100 collects learning data, which is time series data including hacking traffic and changes in traffic before and after the hacking traffic, and a transformer module that converts the data type of the collected learning data. Based on this, a detection model can be trained.

In other words, the detection model of the data access prevention device 100 can be repeatedly learned to understand the meaning of the hacking traffic by individually comparing the time series characteristics of the hacking traffic collected as learning data.

Additionally, according to an embodiment of the present application, the detection model possessed by the data access prevention device 100 may be implemented to analyze target data based on a preset monitoring cycle. For example, the monitoring cycle can be set in seconds to ensure real-time anti-hack performance, but is not limited to this. In this regard, the monitoring cycle, which is a time unit in which the detection model performs analysis on target data according to the implementation example of the present application, is the number of access devices 300 that transmit data to the data server 200, the data server 200 It may be variable based on storage, capacity, etc.

For example, referring to Figure 2, the data types converted by the transformer module (Model Transformer, View Transformer) are model data (D1), norm data (Norm data, D2), and view data (View data, D3). ) may include types such as.

In this regard, model data (D1) represents the basic data format used in the application in which the detection model is driven, norm data (D2) represents the data format in which the model data is normalized, and view data (D3) represents the data format used in the application in which the detection model is driven. It is a data format for filling a form field and indicates the data format in which the user submits data.

In addition, when abnormal traffic is detected based on the above-described artificial intelligence-based detection model, the data access prevention device 100 stops transmission of data associated with the data server 200 and stores the collected target data in a preset buffer. It can be saved at (not shown).

In other words, the data access prevention device 100 disclosed herein not only maintains security by delaying the connection when signs of abnormal access to the data server 200 are detected based on an artificial intelligence-based detection model. , the sensed data (target data) can be stored separately in a buffer so that it can be placed in a state where detailed traffic analysis, as described below, can be performed. As an example, the data access prevention device 100 may copy target data for which abnormal traffic is detected and then store (record) it in a buffer.

In other words, the data access prevention device 100 does not simply detect the occurrence of abnormal traffic, but rather stores the data containing the abnormal traffic (target data) in a storage space (buffer) provided independently from the data server 200. There is an advantage in that the physical path of data containing abnormal traffic (target data) toward the data server 200 can be blocked by storing it.

In addition, the data access prevention device 100 detects abnormal traffic and performs a detailed analysis of the target data temporarily stored in the buffer to finally determine whether the target data is data linked to a hacking attempt on the data server 200. there is.

In other words, the data access prevention device 100 primarily stores target data corresponding to abnormal traffic detected based on an artificial intelligence-based detection model in a buffer separate from the data server 200, and then performs detailed traffic analysis. Through this, it is possible to secondarily verify whether the data is transmitted for malicious purposes such as hacking the data server 200.

In other words, the data access prevention device 100 disclosed herein detects target data whose time series characteristics are judged to be abnormal through a detection model built to analyze the characteristics of time series data that is learned and input based on a transformer algorithm, etc. By storing it in a pre-built buffer and analyzing the traffic characteristics of the target data stored in the buffer in more detail, it is possible to specifically determine whether hacking has occurred.

In addition, according to an embodiment of the present application, the data access prevention device 100 detects abnormal traffic and performs detailed traffic analysis on the target data stored in the buffer, as well as the access device 300 that transmitted the target data. , the data transmission process for the data server 200 of the remaining access devices 300 other than the corresponding access device 300 may be stopped (stopped). In this regard, the data access prevention device 100 detects abnormal traffic for all access devices 300 that are transmitting or attempting to transmit data to the data server 200 in response to the time when detailed traffic analysis is performed. A signal (message) may be transmitted informing that data transmission from each device is temporarily suspended while detailed traffic analysis is performed.

Subsequently, if the data access prevention device 100 determines that the target data is data unrelated to the hacking attempt on the data server 200 as a result of detailed traffic analysis, it may resume the interrupted data transmission. In addition, according to an embodiment of the present application, when data transmission is resumed as the target data is determined to be unrelated to the hacking attempt on the data server 200, the data access prevention device 100 is connected to the data server 200. A signal (message) informing all access devices 300 that are transmitting data or attempting to transmit data that data transmission is switched to a state in which data transmission can be resumed or initiated may be transmitted.

In contrast, if the target data is determined to be data corresponding to a hacking attempt on the data server 200 as a result of detailed traffic analysis, the data access prevention device 100 may transmit a warning signal to the preset user terminal 400.

Additionally, the data access prevention device 100 may track information about the transmitter who transmitted the target data (for example, information about the abnormal data transmitter 1 or the abnormal access device 302, etc.). For example, the data access prevention device 100 may acquire header information, transmission/access path information, etc. included in the target data and store them as log information or transmit the information to the user terminal 400.

As another example, as a result of detailed traffic analysis, if it is determined that the target data is data corresponding to a hacking attempt on the data server 200, the data access prevention device 100 connects the access device 300 that transmitted the target data to an abnormal access device ( 302), it may operate to reversely transmit predetermined data for obtaining information about the abnormal access device 302 to the abnormal access device 302.

Figure 3 is a schematic configuration diagram of an artificial intelligence-based abnormal data access prevention device according to an embodiment of the present application.

Referring to FIG. 3, the data access prevention device 100 may include a learning unit 110, a collection unit 120, a detection unit 130, an analysis unit 140, and a control unit 150.

The learning unit 110 may learn an artificial intelligence-based detection model based on learning data including hacking traffic and changes in traffic before and after the hacking traffic.

The collection unit 120 may collect target data accessing the data server 200.

The detection unit 130 may detect abnormal traffic from the target data by inputting the target data into a previously learned artificial intelligence-based detection model.

The analysis unit 140 may determine whether the target data is data linked to a hacking attempt on the data server 200 through detailed analysis (detailed traffic analysis) of the target data stored in the buffer.

When abnormal traffic is detected by the detection unit 130, the control unit 150 may stop transmission of data associated with the data server 200.

Additionally, when abnormal traffic is detected by the detection unit 130, the control unit 150 may store the collected target data in a preset buffer.

Additionally, if the target data is determined by the analysis unit 140 to be unrelated to the hacking attempt, the control unit 150 may resume previously interrupted data transmission.

Additionally, if the target data is determined by the analysis unit 140 to be data corresponding to a hacking attempt, the control unit 150 may transmit a warning signal to the preset user terminal 400.

Additionally, if the target data is determined by the analysis unit 140 to be data corresponding to a hacking attempt, the control unit 150 may track information about the transmitting entity 1 that transmitted the target data.

Below, we will briefly look at the operation flow of the present application based on the details described above.

Figure 4 is an operation flowchart of an artificial intelligence-based abnormal data access prevention method according to an embodiment of the present application.

The artificial intelligence-based abnormal data access prevention method according to an embodiment of the present application shown in FIG. 4 can be performed by the data access prevention device 100 described above. Therefore, even if the content is omitted below, the content described regarding the data access prevention device 100 can be equally applied to the explanation of the artificial intelligence-based abnormal data access prevention method.

Referring to FIG. 4, in step S11, the learning unit 110 may learn an artificial intelligence-based detection model based on learning data including hacking traffic and changes in traffic before and after the hacking traffic.

According to an embodiment of the present application, the detection model built by the learning unit 110 in step S11 may be a model based on a Transformer algorithm.

Next, in step S12, the collection unit 120 may collect target data accessing the data server 200.

Next, in step S13, the detection unit 130 may detect abnormal traffic from the target data by inputting the target data into a previously learned artificial intelligence-based detection model.

If abnormal traffic is detected in step S13, the control unit 150 may stop transmission of data associated with the data server 200 in step S14.

Next, in step S15, the control unit 150 may store the collected target data in a preset buffer.

In the above description, steps S11 to S15 may be further divided into additional steps or combined into fewer steps, depending on the implementation of the present disclosure. Additionally, some steps may be omitted or the order between steps may be changed as needed.

Figure 5 is a detailed operation flowchart of a process for performing follow-up actions according to the results of detailed analysis of target data.

The process of performing follow-up actions according to the detailed analysis results for the target data shown in FIG. 5 may be performed by the data access prevention device 100 described above. Therefore, even if the content is omitted below, the content described with respect to the data access prevention device 100 can be equally applied to the description of FIG. 5.

Referring to FIG. 5, in step S21, the analysis unit 140 may perform detailed traffic analysis on target data stored in the buffer.

Next, in step S22, the analysis unit 140 may finally determine whether the target data as a result of detailed traffic analysis is data linked to a hacking attempt on the data server 200.

If it is determined in step S22 that the target data is data unrelated to the hacking attempt, the control unit 150 may resume data transmission associated with the interrupted data server 200 in step S23.

Conversely, if it is determined in step S22 that the target data is data corresponding to a hacking attempt on the data server 200, the control unit 150 may transmit a warning signal to the preset user terminal 400 in step S241.

Next, in step S242, the control unit 150 can track information about the transmitting subject 1 that transmitted the target data.

In the above description, steps S21 to S242 may be further divided into additional steps or combined into fewer steps, depending on the implementation of the present disclosure. Additionally, some steps may be omitted or the order between steps may be changed as needed.

The artificial intelligence-based abnormal data access prevention method according to an embodiment of the present application may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc., singly or in combination. Program instructions recorded on the medium may be specially designed and constructed for the present invention or may be known and usable by those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -Includes optical media (magneto-optical media) and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, etc. Examples of program instructions include machine language code, such as that produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

Additionally, the artificial intelligence-based abnormal data access prevention method described above may also be implemented in the form of a computer program or application executed by a computer stored in a recording medium.

The description of the present application described above is for illustrative purposes, and those skilled in the art will understand that the present application can be easily modified into other specific forms without changing its technical idea or essential features. Therefore, the embodiments described above should be understood in all respects as illustrative and not restrictive. For example, each component described as unitary may be implemented in a distributed manner, and similarly, components described as distributed may also be implemented in a combined form.

The scope of the present application is indicated by the claims described below rather than the detailed description above, and all changes or modified forms derived from the meaning and scope of the claims and their equivalent concepts should be construed as being included in the scope of the present application.

10: Artificial intelligence-based security system
100: Artificial intelligence-based abnormal data access prevention device
110: Learning Department
120: Collection department
130: detection unit
140: analysis department
150: control unit
200: data server
300: Access device
400: User terminal
20: Network
1: Abnormal data transmission subject

Claims (15)

In an artificial intelligence-based abnormal data access prevention method,
Learning an artificial intelligence-based detection model based on learning data including hacking traffic and changes in traffic before and after the hacking traffic;
Collecting target data accessed by a predetermined data server;
Inputting the target data into the detection model to detect abnormal traffic from the target data; and
When the abnormal traffic is detected, stopping transmission of data associated with the data server and storing the target data in a preset buffer;
Including,
The detection model is,
It is characterized as a model based on the Transformer algorithm,
The step of learning the detection model is,
Based on the learning data including the hacking traffic and normal traffic before and after the hacking traffic occurs in time series, and the transformer algorithm that converts the data type of the learning data, the time-series characteristics of the hacking traffic are converted into the normal traffic. Characterized by training the detection model to distinguish normal traffic and hacking traffic from the time series characteristics of the target data by comparing them with the time series characteristics of the traffic,
The step of detecting the abnormal traffic is,
A method for preventing abnormal data access, characterized by detecting the target data whose time series characteristics are determined to be abnormal through the detection model as the abnormal traffic. delete delete According to paragraph 1,
Determining whether the target data is data linked to a hacking attempt on the data server through detailed analysis of the target data stored in the buffer,
A method for preventing abnormal data access, further comprising: According to paragraph 4,
If the target data is determined to be unrelated to the hacking attempt, resuming interrupted data transmission;
A method for preventing abnormal data access, further comprising: According to paragraph 4,
If it is determined that the target data is data corresponding to the hacking attempt, transmitting a warning signal to a preset user terminal;
A method for preventing abnormal data access, further comprising: According to paragraph 4,
If it is determined that the target data is data corresponding to the hacking attempt, tracking information about the transmitting entity that transmitted the target data,
A method for preventing abnormal data access, further comprising: In artificial intelligence-based abnormal data access prevention device,
A learning unit that trains an artificial intelligence-based detection model based on learning data including hacking traffic and changes in traffic before and after the hacking traffic;
a collection unit that collects target data accessed by a predetermined data server;
a detection unit that inputs the target data into the detection model and detects abnormal traffic from the target data; and
When the abnormal traffic is detected, a control unit that stops transmission of data associated with the data server and stores the target data in a preset buffer;
Including,
The detection model is,
It is characterized as a model based on the Transformer algorithm,
The learning department,
Based on the learning data including the hacking traffic and normal traffic before and after the hacking traffic occurs in time series, and the transformer algorithm that converts the data type of the learning data, the time-series characteristics of the hacking traffic are converted into the normal traffic. Learning the detection model to distinguish normal traffic and hacking traffic from the time series characteristics of the target data by comparing them with the time series characteristics of the traffic,
The sensing unit,
Abnormal data access prevention device for detecting the target data whose time series characteristics are determined to be abnormal through the detection model as the abnormal traffic. delete delete According to clause 8,
An analysis unit that determines whether the target data is data linked to a hacking attempt on the data server through detailed analysis of the target data stored in the buffer;
An abnormal data access prevention device that further includes a. According to clause 11,
The control unit,
An abnormal data access prevention device that resumes interrupted data transmission when it is determined that the target data is data unrelated to the hacking attempt. According to clause 11,
The control unit,
An abnormal data access prevention device that transmits a warning signal to a preset user terminal when it is determined that the target data is data corresponding to the hacking attempt. According to clause 11,
The control unit,
If the target data is determined to be data corresponding to the hacking attempt, an abnormal data access prevention device that tracks information about the transmitter who transmitted the target data. A computer-readable recording medium recording a program for executing the method of any one of claims 1, 4 to 7 on a computer.

Images