KR20230061925A - Apparatus and Method for Training Network Intrusion Detection Model Based on Extended Training Data - Google Patents

Abstract

An apparatus and method for learning a network intrusion threat detection model based on extended learning data are disclosed. An apparatus for training a network intrusion threat detection model based on extended learning data according to an embodiment of the present invention includes a memory in which at least one program is recorded and a processor that executes the program, and the program includes synthesized data generated based on an adversarial generated neural network. It includes the steps of learning an autoencoder based on the extended learning data added, extracting an encoder of an autoencoder that has been trained, and learning a network intrusion threat detection model in which the encoder is placed in the front end with the extended learning data. can

Description

Apparatus and Method for Training Network Intrusion Detection Model Based on Extended Training Data}

The disclosed embodiments relate to a technology capable of detecting cyber threats by analyzing system logs and security events generated from network security equipment.

As network communication technology develops, distributed networks are structured, and access environments are diversified to various types of sensors and built-in devices as well as communication-only devices. Accordingly, the attack surface for communication networks is also widening and cyber security threats are increasing exponentially.

To detect these cyber attacks, Intrusion Detection System (IDS) is being deployed as an essential security element in network configuration, but traditional intrusion detection systems based on signatures and rules detect intelligent and advanced new cyber attacks. I have a problem with not being able to.

Accordingly, research on applying artificial intelligence technology to an intrusion detection system to detect unknown cyber attacks is being actively conducted. The artificial intelligence-based network intrusion detection system uses machine learning and deep learning technology to learn security event data collected in advance, and the learned artificial intelligence model is used for the purpose of detecting new security threats that may occur in the future. . As examples of artificial intelligence models widely used in such network intrusion detection systems, a decision tree, a support vector machine (SVM), and a deep neural network (DNN) may be included.

These artificial intelligence models show high detection performance in intrusion detection systems, but because the learning of the model is highly dependent on the distribution of data, there is a concern that performance will deteriorate significantly if the training data is biased toward a specific label. In particular, in the case of network data, most network flows that occur in reality are normal, and events for security threats rarely occur. Moreover, certain types of attacks are extremely rare in the category of security threats, and these problems can be extended to problems in which artificial intelligence models do not learn enough data to significantly reduce the performance of intrusion detection systems. In other words, not only the size of the training data, but also the balance problem in terms of the label (type) of the data acts as an important factor in the performance of the artificial intelligence model.

The disclosed embodiments are aimed at solving a data imbalance problem and improving detection performance in an artificial intelligence-based network intrusion detection system.

The learning data extension method according to the embodiment includes the steps of dividing training data obtained in advance in a network flow into a predetermined number of classes according to data types, and generating an adversarial neural network model corresponding to each of the divided classes with training data for each class. It may include a step of learning, a step of generating synthesized data using generators included in adversarial generated neural network models for which learning has been completed, and a step of merging the generated synthesized data into training data.

At this time, the adversarial generative neural network model consists of a generator that receives a latent code and generates forged synthetic data, and a discriminator that compares the synthetic data and learning data to determine whether it is true or not. The generator generates synthetic data from the latent code. It is composed of a decoder, and the discriminator may be composed of an auto encoder including an encoder for extracting features from the training data and a decoder for reconstructing the training data from the extracted features.

In this case, the step of learning may be repeatedly performed until the reconstruction error and the discrimination error are less than or equal to a predetermined threshold value.

At this time, in the step of generating synthesized data, the proportion of generation may be adjusted according to the distribution of each class in the learning data.

In this case, the learning data expansion method according to the embodiment may further include labeling the generated synthetic data for each data type.

In this case, the label may be one of normal and at least one attack type.

In this case, the labeling may be performed in a one-hot format.

In this case, in the merging step, outliers may be removed from the synthesized data and merged.

A method for learning a network intrusion threat detection model based on extended learning data according to an embodiment includes the steps of learning an autoencoder based on extended learning data to which synthetic data generated based on a hostile generation neural network is added, and an encoder of the autoencoder after learning has been completed. It may include extracting and learning a deep learning-based detection model in which an encoder is placed in the front end with extended learning data.

At this time, the learning step may update only the parameters of the deep learning-based detection model.

An apparatus for learning an extended learning data-based network intrusion threat detection model according to an embodiment includes a memory in which at least one program is recorded and a processor that executes the program, wherein the program is added with synthetic data generated based on an adversarial generated neural network. It may include the step of learning an autoencoder based on the extended learning data, the step of extracting an encoder of an autoencoder that has been trained, and the step of learning a deep learning-based detection model in which an encoder is placed in the front end with the extended learning data.

At this time, in generating the synthetic data, the program divides the training data obtained in advance in the network flow into a predetermined number of classes according to the data type, the training data for each of the divided classes, and the adversarial generation neural network corresponding to each The steps of learning the model, generating synthesized data using generators included in the trained adversarial neural network models, and merging the generated synthesized data into training data may be performed.

At this time, the adversarial generative neural network model consists of a generator that receives a latent code and generates forged synthetic data, and a discriminator that compares the synthetic data and learning data to determine whether it is true or not. The generator generates synthetic data from the latent code. It is composed of a decoder, and the discriminator may be composed of an auto encoder including an encoder for extracting features from the training data and a decoder for reconstructing the training data from the extracted features.

In this case, the program may repeatedly perform the step of learning the adversarial generative neural network model until the reconstruction error and the discrimination error are less than or equal to a predetermined threshold.

In this case, in the step of generating the synthesized data, the program may adjust the generation proportion according to the distribution of each class in the learning data.

In this case, the program may further include labeling the generated synthetic data for each data type.

In this case, the label may be one of normal and at least one attack type.

In this case, the labeling may be performed in a one-hot format.

In this case, in the merging step, outliers may be removed from the synthesized data and merged.

At this time, the learning step may update only the parameters of the deep learning-based detection model.

According to the described embodiment, the performance of an artificial intelligence-based network intrusion detection system, which is widely used recently, can be maximized.

According to the described embodiment, it is possible to detect a potential security threat that may occur in the future by solving a data imbalance problem by using a BEGAN model to which reconstruction errors and discrimination errors are applied.

According to the described embodiment, the performance of an existing artificial intelligence-based intrusion detection model can be maximized by arranging the autoencoder model trained with the extended learning data in the first half of the intrusion detection model.

1 is an exemplary diagram of an adversarial generative neural network model according to an embodiment.
2 is a structural diagram of an auto-encoder according to an embodiment.
3 is a flowchart illustrating a learning data expansion method according to an embodiment.
4 and 5 are diagrams for explaining synthetic data extension according to an embodiment.
6 is a flowchart illustrating a method for learning a network intrusion threat detection model based on extended learning data according to an embodiment.
7 is an exemplary diagram for explaining a process of learning a network intrusion threat detection model based on extended learning data according to an embodiment.
8 is a diagram showing the configuration of a computer system according to an embodiment.

Advantages and features of the present invention, and methods of achieving them, will become clear with reference to the detailed description of the following embodiments taken in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in various different forms, only these embodiments make the disclosure of the present invention complete, and common knowledge in the art to which the present invention belongs. It is provided to fully inform the holder of the scope of the invention, and the present invention is only defined by the scope of the claims. Like reference numbers designate like elements throughout the specification.

Although "first" or "second" is used to describe various elements, these elements are not limited by the above terms. Such terms may only be used to distinguish one component from another. Therefore, the first component mentioned below may also be the second component within the technical spirit of the present invention.

Terms used in this specification are for describing embodiments and are not intended to limit the present invention. In this specification, singular forms also include plural forms unless specifically stated otherwise in a phrase. As used herein, "comprises" or "comprising" implies that a stated component or step does not preclude the presence or addition of one or more other components or steps.

Unless otherwise defined, all terms used herein may be interpreted as meanings commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in commonly used dictionaries are not interpreted ideally or excessively unless explicitly specifically defined.

Hereinafter, an apparatus and method for learning a network intrusion threat detection model based on extended learning data according to an embodiment will be described in detail with reference to FIGS. 1 to 8 .

The described embodiment proposes a technique capable of improving intrusion detection performance compared to conventional deep learning models by resolving an imbalance problem of training data for training an artificial intelligence-based network intrusion detection model.

To this end, the disclosed embodiments propose a method of solving the imbalance problem of learning data by artificially synthesizing sparse learning data based on a generative adversarial network (GAN). A detailed description thereof will be described later with reference to FIGS. 3 to 5 .

In addition, the described embodiment proposes a method for improving network anomaly detection performance by learning an auto-encoder model and a network intrusion threat detection model with artificially generated synthetic data and extended training data. A detailed description thereof will be described later with reference to FIGS. 7 and 8 .

First, an adversarial generative neural network and an autoencoder used in the described embodiment will be reviewed.

1 is an exemplary diagram of an adversarial generative neural network model according to an embodiment, and FIG. 2 is a structural diagram of an auto-encoder.

Referring to FIG. 1 , a Generative Adversarial Networks (hereinafter referred to as 'GAN') model 100 is composed of a Generator 110 and a Discriminator 120 having antagonistic purposes. can be configured.

At this time, the generator 110 may receive the latent code and generate forged synthesized data. At this time, the discriminator 120 may compare the synthesized data with the learning data 10 to determine whether the synthesized data is genuine or not.

That is, the purpose of the generator 110 is to deceive the discriminator 220, and the purpose of the discriminator 120 is to accurately distinguish whether the input data is genuine or false (real or synthetic). When the GAN model 100 is learned in the right direction, the generator 210 may generate synthesized data similar to actual training data to the extent that the discriminator 220 cannot distinguish whether it is genuine or not.

However, the method based on such a GAN model cannot guarantee the performance of the generator 110 due to a problem called mode collapse. Here, mode collapse refers to a problem in which the distribution of synthesized data generated by the generator 110 of the GAN model loses diversity and converges to a very small part. When mode collapse occurs, the generator 110 outputs only specific types of data. do.

In order to solve this problem, as shown in FIG. 1, in the embodiment, a Boundary Equilibrium GAN (BEGAN) based on an autoencoder 120 is used, and in the learning process, not only the discrimination error but also the reconstruction error (reconstruction error) is used. By learning the generator 110 based on errors, diversity of synthesized data generated by the generator 110 is ensured.

Referring to FIG. 2 , an auto-encoder 120 may include an encoder 121 that extracts (summarizes) meaningful features from training data and a decoder 122 that reconstructs data from the extracted (summarized) features.

Therefore, in the BEGAN 100 used in the embodiment, as shown in FIG. 1, the discriminator 120 has an autoencoder structure and the generator 110 has an autoencoder decoder structure. In addition, BEGAN 100 is learned based on reconstruction errors between training data and synthesis data, and the generator 110 generates data in a direction that minimizes reconstruction errors.

Figure 3 is a flow chart for explaining a learning data expansion method according to an embodiment, Figure 4 is a diagram for explaining generator learning according to an embodiment, Figure 5 is a synthetic data generation using a learned generator according to an embodiment It is a drawing for explanation.

Referring to FIG. 3 , in the learning data expansion method according to the embodiment, the learning data obtained in advance from the network flow is divided into a predetermined number of classes according to the data type (S210), and the training data for each divided class Training an adversarial neural network model corresponding to each (S220), generating synthetic data using generators included in the trained adversarial neural network models (S240 to S250), and converting the generated synthetic data into learning data It may include steps of merging into (S270 to S280).

That is, in the step of classifying according to the embodiment (S210), as illustrated in FIG. 4, the network flow learning data set 10 is classified into CLASS_1 data 10-1, CLASS_2 data 10-2, ...can be divided into CLASS_N data (10-N).

Then, in the step of learning (S220), the first BEGAN model 200-1 is learned with the CLASS_1 data 10-1, and the second BEGAN model 200-2 is learned with the CLASS_2 data 10-2. and the Nth BEGAN model 200-N may be learned with the CLASS_N data 10-N.

At this time, the step of learning (S220) may be repeatedly performed until the reconstruction error and the discrimination error become less than a predetermined threshold value.

In this case, the reconstruction error threshold may be 0.05, and the determination error threshold may be 0.5.

That is, referring to FIG. 3 , when the reconstruction error and the discrimination error are below a predetermined threshold in S230, the generator included in the adversarial generative neural network model is extracted to be used for generating synthesized data (S240). The generator extracted in S240 has been sufficiently trained and can generate synthetic data similar to actual data.

Therefore, in the step of generating synthetic data (S250), as illustrated in FIG. 5, the generator 110-1 generates synthetic data of GLASS_1, the generator 110-2 generates synthetic data of CLASS_2, The generator 110-N may generate CLASS_N composite data.

At this time, in the step of generating synthesized data (S250), the generation proportion may be adjusted according to the distribution of each class in the learning data 10. This takes into account the imbalance of the learning data, and in the case of data types with sufficient distribution in the training data, the generation proportion is reduced, and in the case of sparse data types, the generation proportion is increased.

In this case, the learning data expansion method according to the embodiment may further include labeling the generated synthetic data for each data type (S260). That is, as shown in FIG. 5, the synthesized data generated by each of the extracted generators 110-1, 110-2, .... 110-N is data for a single type, and is data for future detection model training. are labeled for use as

In this case, the label may be one of normal and at least one attack type. At this time, the attack type may include, for example, DoS, Probe, and the like.

In this case, the labeling may be performed in a one-hot format.

The following <Table 1> shows an example of one-hot encoding format.

normal type 1 type 2 type 3 type 4 0 0 0 One 0 0 One 0 One 0 0 0 2 0 0 0 One 0 3 0 0 0 0 One 4 0 0 0 One 0 5 0 0 0 0 One 6 One 0 0 0 0

Then, in the merging steps (S270 to S280), the outliers are removed from the labeled synthesis data (S270), and the training data are merged (S280).

6 is a flowchart illustrating a method of learning a network intrusion threat detection model based on extended learning data according to an embodiment, and FIG. 7 is an exemplary diagram illustrating a process of learning a network intrusion threat detection model based on extended learning data according to an embodiment. .

Referring to FIGS. 6 and 7 , the method for learning a network intrusion threat detection model based on extended learning data according to an embodiment is an auto encoder based on extended learning data 20 to which synthesized data generated based on an adversarial generation neural network is added. 410) (S310 to S320), extracting the encoder 411 of the learned auto-encoder 410 (S330), and a deep learning-based detection model 421 in which the encoder 411 is placed at the front end It may include steps (S340 to S360) of learning with the extended learning data 20.

In this case, the deep learning-based detection model 421 may be composed of machine learning and deep learning models.

At this time, in the learning step (S360), only parameters of the deep learning-based detection model 421 may be updated.

That is, since learning of the encoder 411 is completed in the step of learning the auto-encoder 410 (S320), parameters of the encoder 411 are not updated in S360.

As described above, the deep learning-based detection model 421 in which the encoder 411 is disposed at the front end of learning is used as the artificial intelligence-based network intrusion threat detection model 420. Depending on the embodiment, the performance of the existing artificial intelligence-based network intrusion detection system may be maximized by applying the learned auto-encoder to the detection model.

8 is a diagram showing the configuration of a computer system according to an embodiment.

An apparatus for learning an extended learning data-based network intrusion threat detection model according to an embodiment may be implemented in a computer system 1000 such as a computer-readable recording medium.

Computer system 1000 may include one or more processors 1010, memory 1030, user interface input devices 1040, user interface output devices 1050, and storage 1060 that communicate with each other over a bus 1020. can In addition, computer system 1000 may further include a network interface 1070 coupled to network 1080 . The processor 1010 may be a central processing unit or a semiconductor device that executes programs or processing instructions stored in the memory 1030 or the storage 1060 . The memory 1030 and the storage 1060 may be storage media including at least one of volatile media, nonvolatile media, removable media, non-removable media, communication media, and information delivery media. For example, memory 1030 may include ROM 1031 or RAM 1032 .

Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art can implement the present invention in other specific forms without changing its technical spirit or essential features. You will understand that there is Therefore, the embodiments described above should be understood as illustrative in all respects and not limiting.

10: training data 100: adversarial generative neural network model
110: generator, decoder 120: discriminator, autoencoder
121: encoder 122: decoder
20: extended training data 410: autoencoder
411: encoder 421: network intrusion threat detection model

Claims (20)

Dividing learning data obtained in advance from a network flow into a predetermined number of classes according to data types;
learning an adversarial generative neural network model corresponding to each of the divided classes with training data;
generating synthesized data using generators included in adversarial generative neural network models for which learning has been completed; and
A method for expanding training data, comprising merging the generated synthetic data into training data. The method of claim 1, wherein the adversarial generative neural network model,
a generator that receives the latent code and generates forged synthesized data; and
It consists of a discriminator that compares synthetic data and learning data to determine authenticity,
generator,
Consists of a decoder that generates synthesized data from latent code;
discriminator,
A method for extending learning data, consisting of an autoencoder including an encoder for extracting features from training data and a decoder for reconstructing training data from extracted features. The method of claim 2, wherein the step of learning,
A learning data extension method that is repeatedly performed until reconstruction errors and discrimination errors are less than or equal to a predetermined threshold. The method of claim 1, wherein generating synthetic data comprises:
A learning data expansion method that adjusts the generation proportion according to the distribution by class in the learning data. According to claim 1,
A method for extending training data, further comprising labeling the generated synthetic data by data type. The method of claim 5, wherein the label,
A training data extension method, one of normal and at least one type of attack. The method of claim 6, wherein the labeling step,
A method for expanding training data, labeling in a one-hot format. The method of claim 1, wherein the merging step,
A training data augmentation method that removes outliers from synthetic data and merges them. learning an auto encoder based on extended learning data to which synthetic data generated based on an adversarial generative neural network is added;
Extracting an encoder of an auto-encoder for which learning has been completed; and
A method for learning a network intrusion threat detection model based on extended learning data, comprising the step of training a network intrusion threat detection model in which an encoder is disposed at a front end with extended learning data. The method of claim 7, wherein the step of learning,
A method for learning a network intrusion threat detection model based on extended learning data, wherein only parameters of the network intrusion threat detection model are updated. a memory in which at least one program is recorded; and
A processor that executes a program;
program,
learning an auto encoder based on extended learning data to which synthetic data generated based on an adversarial generative neural network is added;
Extracting an encoder of an auto-encoder for which learning has been completed; and
An apparatus for learning a network intrusion threat detection model based on extended learning data, comprising the step of training a network intrusion threat detection model, in which an encoder is disposed at a front end, with extended learning data. The method of claim 11, wherein the program,
In generating synthetic data,
Dividing learning data obtained in advance from a network flow into a predetermined number of classes according to data types;
learning an adversarial generative neural network model corresponding to each of the divided classes with training data;
generating synthesized data using generators included in adversarial generative neural network models for which learning has been completed; and
An apparatus for training a network intrusion threat detection model based on extended learning data, which performs a step of merging the generated synthetic data into training data. The method of claim 11, wherein the adversarial generative neural network model,
a generator that receives the latent code and generates forged synthesized data; and
It consists of a discriminator that compares synthetic data and learning data to determine authenticity,
generator,
Consists of a decoder that generates synthesized data from latent code;
discriminator,
An apparatus for learning an extended training data-based network intrusion threat detection model, comprising an auto-encoder including an encoder for extracting features from training data and a decoder for reconstructing training data from extracted features. The method of claim 12, wherein the program,
An apparatus for learning a network intrusion threat detection model based on extended learning data, wherein the step of learning the adversarial generated neural network model is repeatedly performed until the reconstruction error and the discrimination error are below a predetermined threshold. The method of claim 12, wherein the program,
An apparatus for learning an extended learning data-based network intrusion threat detection model that adjusts the generation proportion according to the distribution by class in the training data in the step of generating synthetic data. The method of claim 12, wherein the program,
An apparatus for learning an extended training data-based network intrusion threat detection model, further comprising labeling the generated synthetic data by data type. The method of claim 16, wherein the label,
A device that trains a network intrusion threat detection model based on extended training data that is normal and at least one type of attack. 17. The method of claim 16, wherein the labeling step comprises:
A network intrusion threat detection model learning device based on extended learning data that labels in a one-hot format. The method of claim 12, wherein the merging step,
A network intrusion threat detection model training device based on extended training data that removes and merges outliers from synthetic data. The method of claim 11, wherein the step of learning,
An apparatus for learning a network intrusion threat detection model based on extended training data, which renews only the parameters of the network intrusion threat detection model.

Images