KR20230046182A - Apparatus, method and computer program for detecting attack on network - Google Patents

Abstract

A device for detecting an intrusion attack on a network comprises: a collection unit that collects packet data including headers and payloads; an embedding unit that tokenizes the headers and payloads of the collected packet data and embeds the tokenized headers and payloads; a learning unit that trains an artificial intelligence model based on embedding results; a detection unit that detects an intrusion attack on a target network by using the artificial intelligence model; and an analysis unit that analyzes the detected intrusion attack.

Description

DEVICE, METHOD AND COMPUTER PROGRAM FOR DETECTING ATTACK ON NETWORK}

The present invention relates to an apparatus, method and computer program for detecting an intrusion attack on a network.

Explainable AI models (eXplainable Artificial Intelligence, XAI) give reasons for judgments in a way that humans can understand. An explainable artificial intelligence model is a concept contrasted with 'black box' artificial intelligence, in which even the designer of the algorithm cannot explain the reason for a particular decision. Explainable artificial intelligence models can increase the reliability of artificial intelligence models by resolving the uncertain decision-making process of artificial intelligence.

Research on network security systems using artificial intelligence models is being actively conducted. However, the conventional security system lacks a technique for specifically deriving the basis for the discrimination result and the analysis result.

In addition, it was necessary to improve the detection rules of the security system based on the inference results of the artificial intelligence model, and quantitatively analyze whether the false positive rate and the true positive rate were improved.

Korean Registered Patent Publication No. 1814368 (registered on December 27, 2017)

The present invention is to solve the problems of the prior art described above, and collects packet data including headers and payloads, tokenizes the headers and payloads of the collected packet data, and tokenizes the headers and payloads. Embedding, learning an artificial intelligence model based on the embedding results, detecting an intrusion attack on the target network using the artificial intelligence model, and analyzing the detected intrusion attack.

It is intended to provide a device, method, and computer program that detects an intrusion attack on a network and analyzes the basis for discrimination using a transformer-based ensemble model and a self-attention-based explainable artificial intelligence model.

It is intended to provide an intrusion attack detection device, method, and computer program that analyzes the correlation and causal relationship between an intrusion attack on a detected network and other intrusion attacks.

However, the technical problem to be achieved by the present embodiment is not limited to the technical problems described above, and other technical problems may exist.

As a means for achieving the above-mentioned technical problem, an embodiment of the present invention is an apparatus for detecting an intrusion attack on a network, a collection unit for collecting packet data including a header and a payload, the collected packets An embedding unit that tokenizes the header and payload of data and embeds the tokenized header and payload, a learning unit that learns an artificial intelligence model based on the embedding result, and a target network using the artificial intelligence model. It may include a detection unit that detects an intrusion attack on the system and an analyzer that analyzes the detected intrusion attack.

In an embodiment, the embedding unit may derive embedding vectors of the tokenized header and payload, and the learning unit may train the artificial intelligence model based on the derived embedding vectors.

In one embodiment, the learning unit may extract feature points by performing a convolution operation on the embedding vector, and may train the artificial intelligence model based on the extracted feature points.

In one embodiment, the artificial intelligence model includes a first model for detecting an intrusion attack based on a transformer-based ensemble model learned based on the extracted feature points and a self-attention model for deriving an attention weight for each token of the payload. It may include a second model, which is an explainable artificial intelligence model that analyzes the basis for discrimination of the infringement attack based on .

In an embodiment, the learning unit may select a threat information token from tokens of the payload based on the derived attention weight.

In an embodiment, the learning unit may further derive location information of the threat information token and an attention weight value of the threat information token.

In an embodiment, the learning unit may improve a detection rule of the artificial intelligence model based on location information of the threat information token and an attention weight value of the threat information token.

In one embodiment, the analyzer may analyze at least one of a correlation and a causal relationship between the detected intrusion attack and other intrusion attacks.

In an embodiment, the analyzer may analyze the correlation between the detected invasion attack and another invasion attack occurring at the same time based on an association law learning technique.

In one embodiment, the analysis unit may analyze the causal relationship between the detected invasion attack and other invasion attacks that have occurred in the past based on a sequence reasoning technique.

Another embodiment of the present invention is a method for detecting an intrusion attack on a network, comprising: collecting packet data including headers and payloads; tokenizing headers and payloads of the collected packet data; Embedding the tokenized header and payload, learning an artificial intelligence model based on the embedding result, detecting an intrusion attack on a target network using the artificial intelligence model, and the detected intrusion attack It may include the step of analyzing.

Another embodiment of the present invention is a computer program stored on a computer readable recording medium containing a sequence of instructions for detecting an intrusion attack on a network, the computer program comprising a header and a payload when executed by a computing device. Collecting packet data including, tokenizing headers and payloads of the collected packet data, embedding the tokenized headers and payloads, learning an artificial intelligence model based on the embedding results, It may include a sequence of instructions for detecting an intrusion attack on a target network using an artificial intelligence model and analyzing the detected intrusion attack.

The above-described means for solving the problems is only illustrative and should not be construed as limiting the present invention. In addition to the exemplary embodiments described above, there may be additional embodiments described in the drawings and detailed description.

According to any one of the problem solving means of the present invention described above, the present invention collects packet data including headers and payloads, tokenizes the headers and payloads of the collected packet data, and tokenizes the headers and payloads. It is possible to embed the load, train an artificial intelligence model based on the embedding result, detect an intrusion attack on the target network using the artificial intelligence model, and analyze the detected intrusion attack.

By improving the detection rules of the artificial intelligence model, intrusion attacks on the network can be detected more accurately and efficiently.

It can strengthen the security of the network and prevent damage caused by intrusion attacks.

1 is a block diagram of an infringement attack detection device according to an embodiment of the present invention.
2 is an exemplary diagram for explaining a method of learning an artificial intelligence model according to an embodiment of the present invention.
3 is an exemplary diagram for explaining a method of learning an artificial intelligence model according to an embodiment of the present invention.
4 is an exemplary diagram for explaining a method of learning an artificial intelligence model according to an embodiment of the present invention.
5 is an exemplary diagram for explaining an ensemble model according to an embodiment of the present invention.
6 is an exemplary diagram for explaining a method of improving a detection rule of an artificial intelligence model according to an embodiment of the present invention.
7 is an exemplary diagram for explaining a method of analyzing a causal relationship between a detected invasion attack and another invasion attack according to an embodiment of the present invention.
8 is a flowchart of a method for detecting an intrusion attack on a network according to an embodiment of the present invention.
9 is an exemplary view of an interface screen provided to a user by an infringement attack detection device according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail so that those skilled in the art can easily practice the present invention with reference to the accompanying drawings. However, the present invention may be embodied in many different forms and is not limited to the embodiments described herein. And in order to clearly explain the present invention in the drawings, parts irrelevant to the description are omitted, and similar reference numerals are attached to similar parts throughout the specification.

Throughout the specification, when a part is said to be "connected" to another part, this includes not only the case where it is "directly connected" but also the case where it is "electrically connected" with another element interposed therebetween. . In addition, when a part "includes" a certain component, this means that it may further include other components, not excluding other components, unless otherwise stated, and one or more other characteristics. However, it should be understood that it does not preclude the possibility of existence or addition of numbers, steps, operations, components, parts, or combinations thereof.

In this specification, a "unit" includes a unit realized by hardware, a unit realized by software, and a unit realized using both. Further, one unit may be realized using two or more hardware, and two or more units may be realized by one hardware. On the other hand, '~ unit' is not limited to software or hardware, and '~ unit' may be configured to be in an addressable storage medium or configured to reproduce one or more processors. Therefore, as an example, '~unit' refers to components such as software components, object-oriented software components, class components, and task components, processes, functions, properties, and procedures. , subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays and variables. Functions provided within components and '~units' may be combined into smaller numbers of components and '~units' or further separated into additional components and '~units'. In addition, components and '~units' may be implemented to play one or more CPUs in a device or a secure multimedia card.

The "network" referred to below refers to a connection structure capable of exchanging information between nodes such as terminals and servers, such as a local area network (LAN) and a wide area network (WAN). , the Internet (WWW: World Wide Web), wired and wireless data communications networks, telephone networks, and wired and wireless television communications networks. Examples of wireless data communication networks include 3G, 4G, 5G, 3rd Generation Partnership Project (3GPP), Long Term Evolution (LTE), World Interoperability for Microwave Access (WIMAX), Wi-Fi, Bluetooth communication, infrared communication, ultrasonic communication, visible light communication (VLC: Visible Light Communication), LiFi, and the like, but are not limited thereto.

In this specification, some of the operations or functions described as being performed by a terminal or device may be performed instead by a server connected to the terminal or device. Likewise, some of the operations or functions described as being performed by the server may also be performed in a terminal or device connected to the corresponding server.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram of an infringement attack detection device according to an embodiment of the present invention.

The intrusion attack detection apparatus 100 may detect an intrusion attack on a network by determining, for example, whether a combination of a header and a payload included in packet data is malicious.

The intrusion attack detection device 100 may analyze, for example, headers and payloads included in packet data of the detected intrusion attack, and gradually improve detection performance of the device using the analysis result.

Referring to FIG. 1 , an intrusion attack detection device 100 may include a collection unit 110 , an embedding unit 120 , a learning unit 130 , a detection unit 140 and an analysis unit 150 .

The collection unit 110 may collect packet data including headers and payloads.

In one embodiment, the collection unit 110 may classify and label the collected packet data as normal or malicious based on predetermined criteria. The intrusion attack detection apparatus 100 may train an artificial intelligence model for detecting an intrusion attack using labeled packet data.

The embedding unit 120 may tokenize the header and payload of the collected packet data. The embedding unit 120 may tokenize the header and payload using any one of, for example, N-GRAM, BPE, or WPE.

The embedding unit 120 may embed the tokenized header and payload. The embedding unit 120 may derive embedding vectors of the tokenized header and payload.

For example, the embedding unit 120 may embed the tokenized header and payload using SentencePiece. Alternatively, the embedding unit 120 may embed the tokenized header and payload using Word2vec and FastText techniques.

The learning unit 130 may train an artificial intelligence model based on the embedding result. For example, the learning unit 130 may train an artificial intelligence model using a 1D-CNN technique. Here, the artificial intelligence model may be a model that detects an intrusion attack based on a transformer-based ensemble model learned based on hair and payload feature points.

The learning unit 130 may, for example, train an artificial intelligence model based on the derived embedding vectors of the header and payload. The learning unit 130 may extract feature points by performing a convolution operation on the embedding vector. The learning unit 130 may train an artificial intelligence model based on the extracted feature points.

2 to 4 are exemplary diagrams for explaining a method of learning an artificial intelligence model according to an embodiment of the present invention.

When tokenization, padding, and embedding are performed on the natural language sentence 'wait for the video and don't rent it', a sentence-type matrix as shown in FIG. 2 is derived. In FIG. 2, n may represent the length of a sentence, and k may represent the dimension of an embedding vector.

In the 1D-CNN technique, the width of the kernel is set equal to the dimension (k) of the embedding vector, and the height of the kernel can be set flexibly. Accordingly, the size of the kernel may mean the height of the kernel. As for the size of the kernel, a value that gives the best performance experimentally through hyperparameter tuning can be used.

3 exemplarily illustrates a method of extracting feature points by performing a convolution operation on an embedding vector when the size of the kernel, that is, the height of the kernel is set to 2.

Referring to FIG. 3, when the size of the kernel is 2, a convolution operation is performed on 'wait for' in the first step, a convolution operation is performed on 'for the' in the second step, and a convolution operation is performed on 'for the' in the third step. A convolution operation may be performed on 'the video', and a convolution operation may be performed on 'video and' in the fourth step. In the same way, the convolution operation can be performed on the entire embedding vector.

In the 1D-CNN technique, pooling may be performed after performing a convolution operation on an embedding vector. As an example of pooling, max-pooling, which takes the largest value from the resulting vector obtained from each convolution operation, can be performed.

FIG. 4 exemplarily illustrates extraction of feature points by performing a convolution operation on an embedding vector and max pooling in cases where the kernel size is 2 and the kernel size is 3, respectively.

As described with reference to FIGS. 2 to 4 , the present invention can improve the learning speed and accuracy of the artificial intelligence model by extracting feature points other than sentences themselves and training the artificial intelligence model based on the extracted feature points.

For example, the learning unit 130 may determine whether the packet data is normal or malicious by applying the feature points extracted by the ID-CNN technique to the ensemble model. The ensemble model can utilize header information as well as payload data of packet data for modeling. In addition, the ensemble model can finally determine whether it is normal or malignant by applying the structure of another model according to each feature point and using the average value of the calculated result.

5 is an exemplary diagram for explaining the structure of an ensemble model according to an embodiment of the present invention. The intrusion attack detection apparatus 100 may determine whether the packet data is normal or malicious using the CMAE model shown in FIG. 5 .

The intrusion attack detection device 100 may determine whether an intrusion incident has occurred based on a result of determining whether the intrusion attack is normal or malicious using the CMAE model.

In another embodiment, the intrusion attack detection apparatus 100 may determine whether the packet data is normal or malicious after learning by variably changing a preprocessing method and a model structure according to data characteristics.

For example, the infringement attack detection apparatus 100 may apply the result determined using the CMAE model to an explainable artificial intelligence (XAI) model and analyze the basis for the determination.

The explainable artificial intelligence model can analyze the basis for discrimination of infringement attacks based on the self-attention model that derives the attention weight for each token of the payload.

The self-attention model may derive an attention weight representing which feature value a specific feature in a sentence refers to in a context.

To obtain the attention weight using the self-attention model, first, three vectors are created with the embedding value of each word, which is the input vector of each encoder, and then multiplied by another matrix to create Q, K, and V vectors for each word. In the case of self-attention, the values of Q, K, and V may all be the same.

Next, the attention value is derived by calculating the dot product of Q and K of each word. The attention value can determine the degree to which other words in the input sentence are focused when encoding a word at a particular position.

Next, the output of the self-attention layer can be generated by multiplying each V vector by an attention value and adding a weight vector. Specifically, an attention distribution, which is a probability distribution in which the sum of all values becomes 1, can be obtained by using the softmax function. Each value of the attention distribution is an attention weight. That is, each token has an attention weight, and FIG. 5 is an exemplary diagram visualizing this in the form of a matrix.

The learning unit 130 may select a threat information token from payload tokens based on the attention weight derived using the self-attention model. For example, the learning unit 130 may select five tokens having the highest attention weight values among tokenized headers and payloads as threat information tokens.

The learning unit 130 may further derive location information of the threat information token and an attention weight value of the threat information token. The learning unit 130 may indicate where a main part constituting an infringement attack is located in a payload by deriving the location information of the threat information token, thereby providing a basis for discrimination of the artificial intelligence model.

The learning unit 130 may improve detection rules of the artificial intelligence model based on the location information of the threat information token and the attention weight value of the threat information token. For example, the learning unit 130 may improve detection rules of the artificial intelligence model so that the artificial intelligence model can determine a key symptom of a threat information token having a high attention weight value.

6 is an exemplary diagram for explaining a method of improving a detection rule of an artificial intelligence model according to an embodiment of the present invention.

Referring to FIG. 6 , the compromise attack detection apparatus 100 improves the detection rule of the artificial intelligence model based on the location information of the threat information token and the attention weight value of the threat information token so as to determine the key symptoms of the threat information token. can do.

The intrusion attack detection apparatus 100 may derive an attention weight in units of n bytes, for example, and visualize the attention matrix as shown in FIG. 6 to determine key symptoms of the threat information token.

The detection unit 140 may detect an intrusion attack on a target network using an artificial intelligence model. For example, the detection unit 140 may detect an attack on the target network by monitoring the target network in real time.

The analysis unit 150 may analyze the detected infringement attack. The analysis unit 150 may analyze at least one of a correlation and a causal relationship between the detected intrusion attack and other intrusion attacks.

For example, the analyzer 150 may analyze a correlation between an intrusion attack detected based on an association law learning technique and another intrusion attack occurring at the same time. As an association law learning technique, for example, any one of Apriori and FP-Growth may be used.

The analysis unit 150 may analyze a correlation between two intrusion attacks by quantitatively analyzing at least one indicator of support, reliability, and improvement between the detected intrusion attack and other intrusion attacks.

The degree of support may be derived, for example, as a ratio of the number of simultaneous occurrences of threat determination factors of two intrusion attacks based on the total number of occurrences of threats.

For example, the reliability may be derived as a ratio of the number of simultaneously occurring threat factors of two intrusion attacks based on the number of occurrences of threat factors of the detected intrusion attack.

The degree of improvement may be derived as a ratio of reliability based on, for example, the number of occurrences of threat determination factors of other intrusion attacks to the total number of occurrences of threats.

For example, when a specific type of intrusion attack is recognized, the intrusion attack detecting apparatus 100 may analyze past records in which the same type of intrusion attack occurred. The intrusion attack detection device 100 expresses the correlation with other intrusion attacks that occur concurrently with the same type of intrusion attack as quantitative indicators such as support, reliability, and improvement, and analyzes other intrusion attacks showing high values for each indicator. can do.

The intrusion attack detecting apparatus 100 may provide a basis for determining which threat alert elements have a high possibility of becoming an accident by analyzing a correlation between a detected intrusion attack and another intrusion attack occurring at the same time.

For example, the analyzer 150 may analyze a causal relationship between an intrusion attack detected based on a sequence reasoning technique and another intrusion attack that occurred in the past. The sequence reasoning technique may analyze the occurrence time series of the infringement attack using, for example, any one of Prefix-Span and Sequential Bayesian.

The analysis unit 150 may extract and analyze a pattern of a newly occurring infringement attack by analyzing a causal relationship based on a sequence reasoning technique.

7 is an exemplary diagram for explaining a method of analyzing a causal relationship between a detected invasion attack and another invasion attack that occurred in the past according to an embodiment of the present invention.

Referring to FIG. 7 , the intrusion attack detection apparatus 100 may analyze the causal relationship between the detected intrusion attack and other intrusion attacks that have occurred in the past by recognizing repetition patterns A and B based on a sequence inference technique.

For example, the intrusion attack detection apparatus 100 may analyze a sequence of repetitive intrusion attacks centering on other intrusion attacks having a high correlation with the detected intrusion attack. The intrusion attack detection apparatus 100 may recognize and extract a partial sequence that is repeated in the analyzed intrusion attack sequence. In this way, it is possible to analyze the causes of other intrusion attacks having high correlation, or to extract patterns of security attacks occurring over several steps.

As another example, the intrusion attack detection device 100 may include, in relation to an incident caused by an intrusion attack, an institution, a threat attack IP, a threat damage IP, a blacklist IP, an attack type, an asset, a threat attack PORT, and a threat damage PORT. , accident damage protocols, detection rules, intentions, attack country, and victim country information can be collected and a database can be built.

The intrusion attack detection apparatus 100 may extract a set of items with a high frequency of occurrence from the database. For example, a set of frequently occurring sequences may be extracted.

The infringement attack detection device 100 derives the support of the sequence extracted using the database, and the cause of the sequence (institution, threat attack IP, threat damage IP, blacklist IP, asset, threat attack PORT, threat damage PORT, accident damage It can be classified based on protocol, detection rules, intent, attacking country, victim country) and result (type of attack).

The intrusion attack detection device 100 may update the analysis result at preset time intervals.

The intrusion attack detection apparatus 100 analyzes the causal relationship between the intrusion attack detected based on the sequence reasoning technique and other intrusion attacks that have occurred in the past, thereby providing a basis for an intrusion attack pattern that is highly likely to be a newly occurring incident. . In addition, predictive information on a newly occurring accident pattern can be provided by using the analysis result of the causal relationship.

8 is a flowchart of a method for detecting an intrusion attack on a network according to an embodiment of the present invention. A method 800 for detecting an intrusion attack on a network performed by the intrusion attack detection device 100 shown in FIG. 8 is processed time-sequentially by the intrusion attack detection device 100 according to the embodiment shown in FIG. includes steps to Therefore, even if the details are omitted below, they are also applied to the method of detecting an intrusion attack on a network performed by the intrusion attack detection apparatus 100 according to the embodiment shown in FIG. 1 .

In step S810, the intrusion attack detection device 100 may collect packet data including a header and a payload.

In step S820, the intrusion attack detection apparatus 100 may tokenize the header and payload of the collected packet data and embed the tokenized header and payload.

In step S830, the intrusion attack detection device 100 may learn an artificial intelligence model based on the embedding result.

In step S840, the intrusion attack detection device 100 may detect an intrusion attack on the target network using an artificial intelligence model.

In step S850, the intrusion attack detection device 100 may analyze the detected intrusion attack.

In the above description, steps S810 to S850 may be further divided into additional steps or combined into fewer steps, depending on an embodiment of the present invention. Also, some steps may be omitted as needed, and the order of steps may be switched.

9 is an exemplary view of an interface screen provided to a user by the intrusion attack detection device 100 according to an embodiment of the present invention.

9(a) is a screen for providing a user with a detection result of an intrusion attack on a target network. As shown in (a) of FIG. 7 , a part of the payload that has played a major role in the determination is highlighted and displayed, and a result of calculating the location and importance of each part may be provided in the reason for determination.

9(b) is an exemplary view of a screen providing a result of analyzing a correlation between a detected intrusion attack and another intrusion attack occurring at the same time. The correlation analysis result may include a correlation result between detailed fields such as an IP address, a port, and a protocol constituting the threat information. For example, a period for analyzing the correlation may be set by the user.

9(c) is an exemplary view of a screen providing a result of analyzing a causal relationship between a detected intrusion attack and another intrusion attack that occurred in the past. The result of analyzing the causal relationship may include repeated sequence information and cause information of an infringement attack identified through the repeated sequence.

The interface screen provided to the user by the intrusion attack detection device 100 may include a screen requesting improvement of detection rules of the artificial intelligence model. The intrusion attack detection device 100 may receive a request for improvement of detection rules, perform improvement of the detection rules, and then verify the improvement contents. The improvement content may include information about the false positive rate and true positive rate when using the existing detection rule and the false positive rate and true positive rate when using the modified detection rule.

The method for detecting an intrusion attack on a network in the intrusion attack detection device described with reference to FIGS. 1 to 9 may be in the form of a computer program stored in a medium executed by a computer or a recording medium including instructions executable by a computer. can be implemented

Computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. Also, computer readable media may include computer storage media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data.

The above description of the present invention is for illustrative purposes, and those skilled in the art can understand that it can be easily modified into other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, the embodiments described above should be understood as illustrative in all respects and not limiting. For example, each component described as a single type may be implemented in a distributed manner, and similarly, components described as distributed may be implemented in a combined form.

The scope of the present invention is indicated by the following claims rather than the detailed description above, and all changes or modifications derived from the meaning and scope of the claims and equivalent concepts should be construed as being included in the scope of the present invention. do.

100: intrusion attack detection device
110: collection unit
120: embedding unit
130: learning unit
140: detection unit
150: analysis unit

Claims (20)

A device for detecting an intrusion attack on a network,
a collection unit that collects packet data including a header and a payload;
an embedding unit that tokenizes headers and payloads of the collected packet data and embeds the tokenized headers and payloads;
A learning unit for learning an artificial intelligence model based on an embedding result;
a detection unit that detects an intrusion attack on a target network using the artificial intelligence model; and
An analysis unit that analyzes the detected infringement attack
To include, intrusion attack detection device.
According to claim 1,
The embedding unit derives an embedding vector of the tokenized header and payload,
Wherein the learning unit learns the artificial intelligence model based on the derived embedding vector.
According to claim 2,
Wherein the learning unit extracts feature points by performing a convolution operation on the embedding vector, and learns the artificial intelligence model based on the extracted feature points.
According to claim 3,
The artificial intelligence model is based on a first model that detects an infringement attack based on a transformer-based ensemble model learned based on the extracted feature points and a self-attention model that derives an attention weight for each token of the payload. An intrusion attack detection device comprising a second model, which is an explainable artificial intelligence model that analyzes the basis for discrimination of an attack.
According to claim 4,
Wherein the learning unit selects a threat information token from tokens of the payload based on the derived attention weight.
According to claim 5,
Wherein the learning unit further derives location information of the threat information token and an attention weight value of the threat information token.
According to claim 6,
wherein the learning unit improves a detection rule of the artificial intelligence model based on location information of the threat information token and an attention weight value of the threat information token.
According to claim 1,
Wherein the analysis unit analyzes at least one of a correlation and a causal relationship between the detected intrusion attack and other intrusion attacks.
According to claim 8,
Wherein the analysis unit analyzes the correlation between the detected intrusion attack and another intrusion attack occurring at the same time based on a correlation law learning technique.
According to claim 8,
Wherein the analysis unit analyzes the causal relationship between the detected invasion attack and other invasion attacks that occurred in the past based on a sequence inference technique.
A method for detecting an intrusion attack on a network,
Collecting packet data including header and payload;
Tokenizing headers and payloads of the collected packet data;
embedding the tokenized header and payload;
Learning an artificial intelligence model based on the embedding result;
detecting an intrusion attack on a target network using the artificial intelligence model; and
Analyzing the detected infringement attack
To include, intrusion attack detection method.
According to claim 11,
Deriving an embedding vector of the tokenized header and payload
Including more,
Wherein the step of learning the artificial intelligence model is learning the artificial intelligence model based on the derived embedding vector.
According to claim 12,
In the step of learning the artificial intelligence model, a feature point is extracted by performing a convolution operation on the embedding vector, and the artificial intelligence model is trained based on the extracted feature point.
According to claim 13,
The artificial intelligence model is based on a first model that detects an infringement attack based on a transformer-based ensemble model learned based on the extracted feature points and a self-attention model that derives an attention weight for each token of the payload. A method for detecting intrusion attacks, including a second model, which is an explainable artificial intelligence model that analyzes the discrimination basis of an attack.
15. The method of claim 14,
Selecting a threat information token from tokens of the payload based on the derived attention weight
To further include, infringement attack detection method.
According to claim 15,
Deriving location information of the threat information token and an attention weight value of the threat information token
To further include, infringement attack detection method.
17. The method of claim 16,
Improving a detection rule of the artificial intelligence model based on location information of the threat information token and an attention weight value of the threat information token.
To further include, infringement attack detection method.
According to claim 11,
Analyzing a correlation between the detected intrusion attack and other intrusion attacks occurring at the same time based on a correlation law learning technique
To further include, infringement attack detection method.
According to claim 11,
Analyzing a causal relationship between the detected intrusion attack and other intrusion attacks that occurred in the past based on a sequence reasoning technique
To further include, infringement attack detection method.
A computer program stored on a computer readable recording medium comprising a sequence of instructions for detecting an intrusion attack on a network,
When the computer program is executed by a computing device,
Collect packet data including header and payload;
Tokenize headers and payloads of the collected packet data;
Embedding the tokenized header and payload;
Train an artificial intelligence model based on the embedding result,
Detect an intrusion attack on the target network using the artificial intelligence model,
A computer program stored on a computer readable recording medium comprising a sequence of instructions for analyzing the detected compromise attack.

Images