KR20230080974A - A hybrid anomaly detection method combining signature-based and behavior-based anomaly detection methods - Google Patents

Abstract

A hybrid anomaly detection method combining a signature-based anomaly detection method and a behavior-based anomaly detection method is disclosed. A hybrid anomaly detection method performed by a computer-implemented hybrid anomaly detection system according to an embodiment includes a hybrid anomaly detection model composed of a signature-based anomaly detection model and a behavior-based anomaly detection model using data generated in an operating system. Receiving input to; performing anomaly detection from data generated in the operating system using the hybrid anomaly detection model; and transmitting data generated in the operating system and a result obtained by performing the anomaly detection to a server.

Description

Hybrid anomaly detection method combining signature-based anomaly detection method and behavior-based anomaly detection method

The description below relates to anomaly detection techniques.

In modern society, objects such as residential facilities, vehicles, factories, and social infrastructure that were physically controlled in the past are being connected to networks. As various devices are connected to the network, it is possible to efficiently manage and control it, but the threat of attack through the network, which was impossible in the past, has arisen. Although this threatens individual privacy, attacks on special purpose systems such as social infrastructure can cause costly losses and life threatening to the public.

In order to block these threats, applications that block attacks at the network level have been provided before the attack penetrates the system, but attackers can attack the system using undetected attacks such as zero-day attacks. detection and blocking cannot be relied solely on network security solutions. Accordingly, research has been conducted to detect whether the system is operating normally or abnormally due to an attack by grasping the current state of the system.

Such an anomaly detection method is generally classified into a signature-based anomaly detection method and a behavior-based anomaly detection method. The signature-based detection method analyzes the characteristics of a known attack or normal operation, and based on this, determines whether the input data is normal or abnormal. Behavior-based detection method is a method of determining whether an abnormal operation of input data is performed by analyzing a behavior of normal or abnormal operation.

Since most operations in a general system are normal operations, the amount of abnormal data is very small compared to the amount of normal data. Therefore, abnormal behavior detection studies have been conducted toward detecting abnormal behavior based on feature extraction from normal data or its behavior.

It is possible to provide a hybrid anomaly detection method and system that enhances anomaly detection performance by connecting a signature-based anomaly detection method and a behavior-based anomaly detection method in series.

In order to detect abnormal behavior due to cyber attacks, a hybrid anomaly detection method and system applying statistical filtering techniques and autoencoders can be provided.

A hybrid anomaly detection method performed by a computer-implemented hybrid anomaly detection system includes receiving data generated from a system in operation into a hybrid anomaly detection model composed of a signature-based anomaly detection model and a behavior-based anomaly detection model; performing anomaly detection from data generated in the operating system using the hybrid anomaly detection model; and transmitting data generated in the operating system and a result obtained by performing the anomaly detection to a server.

The receiving of the input may include starting an anomaly detection process when the gateway receives data generated in a currently operating system.

The performing of the anomaly detection may include performing a signature-based anomaly detection operation as data generated by the operating system is input to a signature-based anomaly detection model configured in the hybrid anomaly detection model. .

The performing of the anomaly detection may include classifying data generated by the operating system into a normal operation or an abnormal operation according to a filtering criterion using the signature-based anomaly detection model.

The performing of the anomaly detection may include, when the data generated by the operating system is classified as an abnormal operation by the signature-based anomaly detection model, the anomaly detection process is terminated, and the data generated by the operating system The method may include forwarding data generated in the operating system to a behavior-based anomaly detection model when it is classified as a normal operation by the signature-based anomaly detection model.

The performing of the anomaly detection may include performing a behavior-based anomaly detection operation as data generated by the operating system is input to a behavior-based anomaly detection model configured in the hybrid anomaly detection model.

The performing of the anomaly detection may include classifying data generated by the operating system into a normal operation or an abnormal operation by using the behavior-based anomaly detection model.

The step of performing the anomaly detection may include obtaining new input data output by encoding and decoding through an autoencoder for data classified as normal operation through a signature-based anomaly detection model, and calculating difference information of the acquired new input data.

The performing of the anomaly detection may include comparing the calculated difference information with a threshold value for classifying the normal operation and the abnormal operation to determine whether the data classified as the normal operation is finally abnormal.

In the transmitting, data generated by the operating system and an anomaly detection result determined in the anomaly detection may be transmitted to the server.

A hybrid anomaly detection system implemented by a computer includes a data input unit that receives data generated from an operating system into a hybrid anomaly detection model composed of a signature-based anomaly detection model and a behavior-based anomaly detection model; an anomaly detection unit configured to perform anomaly detection from data generated in the operating system using the hybrid anomaly detection model; and a result transfer unit for transferring data generated by the operating system and a result obtained by performing the abnormality detection to a server.

By using the signature-based anomaly detection method and the behavior-based anomaly detection method in series, the performance of anomaly detection can be improved. That is, when signature or behavior-based anomaly detection is used alone, anomalies that cannot be detected can be mutually supplemented and detected. Through this, it is possible to improve the safety and reliability of system operation by reducing undetected abnormal operation.

1 is a diagram for explaining a hybrid anomaly detection operation in a hybrid anomaly detection system according to an exemplary embodiment.
2 is a diagram for explaining a hybrid anomaly detection operation using a hybrid anomaly detection model according to an embodiment.
3 is a block diagram illustrating a configuration of a hybrid anomaly detection system according to an exemplary embodiment.
4 is a flowchart illustrating a hybrid anomaly detection method performed by a hybrid anomaly detection system according to an exemplary embodiment.

Hereinafter, an embodiment will be described in detail with reference to the accompanying drawings.

1 is a diagram for explaining a hybrid anomaly detection operation in a hybrid anomaly detection system according to an exemplary embodiment.

The hybrid anomaly detection system 100 is implemented by a computer and may be operated based on a hybrid anomaly detection algorithm in the gateway 101 . In this case, the hybrid anomaly detection system 100 may perform anomaly detection based on a hybrid anomaly detection algorithm. For example, the hybrid anomaly detection system 100 may be operated in the form of a platform or program in the gateway 101 .

The gateway 101 refers to a device that connects a computer and a public communication network or a LAN and a public communication network when interconnecting a plurality of computers and a local area network. In the embodiment, the gateway 101 is described as an example, but other than the gateway 101, any network equipment capable of transmitting and receiving data, such as a router, can be applied.

Data generated or generated in the system 102 may be transmitted to the server 103 for managing the data via the gateway 101 . For example, the system may refer to an operating system connected to the gateway, and may correspond to a victim system attacked by the attacker 104 among systems connected to the gateway. At this time, an external attacker 104 may attempt to cause an abnormal operation by attacking the system through the gateway 101 . Data generated by the abnormal operation passes through the gateway 101 . The hybrid anomaly detection system 100 observes data generated by the anomaly operation passing through the gateway 101 based on the hybrid anomaly detection algorithm, and determines whether the current system is operating anomaly through the observation.

The hybrid anomaly detection system 100 may preemptively perform the following process in order to detect anomalies. The hybrid anomaly detection system 100 may collect time-series data D generated during normal operation of the target system. At this time, the collected time-series data D is time-series data generated during normal operation (hereinafter referred to as 'normal operation data') and may include a plurality of attributes. For example, when the data acquisition period of the system is 1 second, unit data has n data attributes and data (normal operating data) D collected for w seconds can be expressed as follows.

를 계산할 수 있다(j=1,...,n). 그리고 w초 동안 연속된 정상 동작 데이터들의 표준편차의 하한과 상한인

와

를 계산하고, 계산된 표준편차를 필터링 기준으로 설정할 수 있다. The hybrid anomaly detection system 100 may perform statistical analysis on the normal motion data D to calculate characteristics of the normal motion data for signature-based abnormal motion detection. The hybrid anomaly detection system 100 may perform statistical analysis such as mean, standard deviation, maximum value, minimum value, etc. using normal operation data D to set filtering criteria to be used in the signature-based anomaly detection method. For example, the hybrid anomaly detection system 100 calculates the standard deviation of values collected for w (w is a natural number) seconds for all n (n is a natural number) attribute values.

can be calculated (j=1,...,n). And the lower and upper limits of the standard deviation of continuous normal operating data for w seconds.

and

, and the calculated standard deviation can be set as a filtering criterion.

The hybrid anomaly detection system 100 may extract characteristics of a normal operating behavior for behavior-based abnormal behavior detection using the normal operating data D. The hybrid anomaly detection system 100 may set a criterion and a threshold to properly classify a normal operation from an abnormal operation by extracting characteristics of a normal operation behavior used in a behavior-based anomaly detection method from normal operation data. As an example, an autoencoder, which is an unsupervised deep learning method, may be used in an action-based detection method. An autoencoder provides normal operating data as input to deep learning, and learns a model that reconstructs the input data as output. Thereafter, using the difference between the input data and the output data as a criterion for judgment, a threshold value θ is set to classify the operation as normal when the difference between normal data and abnormal data is small and abnormal when the difference is large.

Referring to FIG. 2 , it is a diagram for explaining a hybrid anomaly detection operation using a hybrid anomaly detection model. The hybrid anomaly detection system may configure a hybrid anomaly detection model 200 based on a hybrid anomaly detection algorithm. The hybrid anomaly detection model 200 may include a signature-based anomaly detection model 210 and a behavior-based anomaly detection model 220 .

In the hybrid system located in the gateway, the hybrid anomaly detection method may be performed in the following order.

As the gateway receives the data generated by the currently operating system, an anomaly detection process may begin. For example, the currently operating system may refer to a system that is connected to the gateway and is operating. The received data may be input to the signature-based anomaly detection model 210, and a filtering process may be performed on the data input from the signature-based anomaly detection model. In this case, data received from the signature-based anomaly detection model 210 may be classified as a normal operation or an abnormal operation according to a filtering criterion. When the input data in the signature-based anomaly detection model 210 is classified as an abnormal operation, the anomaly detection process may be terminated, and when the input data is classified as a potentially normal operation, the behavior-based anomaly detection model 220 ) (that is, data classified as normal operation) may be transmitted.

In detail, data received from the signature-based anomaly detection model 210 may be determined to be abnormal according to criteria set for filtering. As an example, it is assumed that input data (hereinafter referred to as 'input data') D' , which is a target for determining normality, is as follows.

가 계산된 후,

의 값의 범위에 따라 정상 여부를 반환하는 술어논리(predicate)

가 계산될 수 있다. 즉

는 다음과 같다.Standard deviation for n attribute values of the input data D' when the lower and upper limits of the standard deviation are set as the filtering criteria

After is calculated,

Predicate logic that returns normality according to the range of values of

can be calculated. in other words

is as follows

에 대하여

인 경우, 즉, n개의 속성 모두가 정상 범위인 경우, 입력 데이터 D'이 정상 동작으로 분류되고, 그렇지 않은 경우 이상 동작으로 분류될 수 있다. 이상 동작으로 분류된 경우, 이상 탐지 과정은 종료되고, 잠재적 정상 동작으로 분류된 경우, 미탐을 방지하기 위해 입력 데이터 D'에 대해 행위 기반 이상 탐지가 추가로 수행될 수 있다. calculated as

about

, that is, when all of the n attributes are in the normal range, the input data D' is classified as a normal operation, and otherwise classified as an abnormal operation. When the operation is classified as an abnormal operation, the anomaly detection process is terminated, and when the operation is classified as a potentially normal operation, behavior-based anomaly detection may be additionally performed on the input data D' to prevent detection.

As the data transferred from the signature-based anomaly detection model 210 is input to the behavior-based anomaly detection model 220, an anomaly detection process may be performed. The input data may be transferred as an input to a behavior-based anomaly detection algorithm of the behavior-based anomaly detection model 220 . According to the behavior-based anomaly detection algorithm, input data may be classified as a normal operation or an abnormal operation.

)를 계산하기 위해 사용될 수 있다. 다음으로 행위 기반 이상 탐지 알고리즘에 의해 계산된 거리(Distance)는 정상 동작과 이상 동작을 분류하기 위한 임계값 θ와 비교되어 입력 데이터 D'의 최종 이상 여부 R이 다음과 같이 판단될 수 있다.In detail, data classified as potentially normal (data classified as normal operation) may be input to the behavior-based anomaly detection model 220 to perform behavior-based anomaly detection. For example, an autoencoder, which is one of the above-described unsupervised deep learning methods, may be used for behavior-based anomaly detection. When input data D' is input to the autoencoder for anomaly detection, the autoencoder encodes and decodes the input data D ' to output new input data D'' , and calculates the difference between D' and D'' . For example, the mean squared error (MSE) is the difference between the two data (

) can be used to calculate Next, the distance calculated by the behavior-based anomaly detection algorithm is compared with a threshold value θ for classifying normal and abnormal operations, and final abnormality R of the input data D' can be determined as follows.

As this abnormality detection process is performed, the abnormality detection process may end. Data and anomaly detection results may be delivered to the server. Through the input data D' , signature-based anomaly detection operation, and behavior-based anomaly detection operation, the result classified as normal or abnormal operation is delivered to the server, and the hybrid anomaly detection process is terminated.

3 is a block diagram illustrating a configuration of a hybrid anomaly detection system according to an embodiment, and FIG. 4 is a flowchart illustrating a hybrid anomaly detection method performed by the hybrid anomaly detection system according to an embodiment.

The processor of the hybrid anomaly detection system 100 may include a data input unit 310 , an anomaly detection execution unit 320 and a result delivery unit 330 . Components of the processor may represent different functions performed by the processor according to control instructions provided by program codes stored in the hybrid anomaly detection system. The processor and components of the processor may control the hybrid anomaly detection system to perform steps 410 to 430 included in the hybrid anomaly detection method of FIG. 4 . In this case, the processor and components of the processor may be implemented to execute instructions according to the code of an operating system included in the memory and the code of at least one program.

The processor may load the program code stored in the file of the program for the hybrid anomaly detection method into the memory. For example, when a program is executed in the hybrid anomaly detection system, the processor may control the hybrid anomaly detection system to load a program code from a file of the program into a memory under the control of an operating system. At this time, the data input unit 310, the anomaly detection unit 320, and the result delivery unit 330 each execute a command of a corresponding part of the program code loaded into the memory to execute subsequent steps 410 to 430. There may be different functional representations of the processor for

In step 410, the data input unit 310 may receive data generated by the operating system into a hybrid anomaly detection model composed of a signature-based anomaly detection model and a behavior-based anomaly detection model. The data input unit 310 may start an anomaly detection process as the gateway receives data generated by the currently operating system.

In step 420, the anomaly detection unit 320 may perform anomaly detection from data generated in the operating system using a hybrid anomaly detection model. The anomaly detection unit 320 may perform a signature-based anomaly detection operation as data generated by the operating system is input to the signature-based anomaly detection model configured in the hybrid anomaly detection model. The anomaly detection unit 320 may classify data generated in the operating system into normal operation or abnormal operation according to filtering criteria using a signature-based anomaly detection model. The anomaly detection unit 320 terminates the anomaly detection process when the data generated by the operating system is classified as an abnormal operation, and when the data generated by the operating system is classified as a normal operation, the abnormal operation is generated by the operating system. The collected data can be passed to a behavior-based anomaly detection model. The anomaly detection unit 320 may perform behavior-based anomaly detection as data generated by the operating system is input to the behavior-based anomaly detection model configured in the hybrid anomaly detection model. The anomaly detection unit 320 may classify data generated by the operating system into normal operation or abnormal operation using a behavior-based anomaly detection model. The anomaly detection unit 320 obtains new input data that is output by encoding and decoding data classified as normal operation through an autoencoder through a signature-based anomaly detection model, and acquires data classified as normal operation and the obtained data. The difference information of the new input data can be calculated. The anomaly detection unit 320 compares the calculated difference information with a threshold value for classifying a normal operation and an abnormal operation to determine whether data classified as a normal operation is finally abnormal.

In step 430, the result transmission unit 330 may transmit the data generated in the operating system and the result obtained by performing the anomaly detection to the server. The result transfer unit 330 may transmit the data generated in the currently operating system and the abnormality detection result determined in the process of performing the abnormality detection to the server. Thus, the hybrid anomaly detection process may end.

The devices described above may be implemented as hardware components, software components, and/or a combination of hardware components and software components. For example, devices and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , a programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions. A processing device may run an operating system (OS) and one or more software applications running on the operating system. A processing device may also access, store, manipulate, process, and generate data in response to execution of software. For convenience of understanding, there are cases in which one processing device is used, but those skilled in the art will understand that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that it can include. For example, a processing device may include a plurality of processors or a processor and a controller. Other processing configurations are also possible, such as parallel processors.

Software may include a computer program, code, instructions, or a combination of one or more of the foregoing, which configures a processing device to operate as desired or processes independently or collectively. You can command the device. Software and/or data may be any tangible machine, component, physical device, virtual equipment, computer storage medium or device, intended to be interpreted by or provide instructions or data to a processing device. can be embodied in Software may be distributed on networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer readable media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program commands recorded on the medium may be specially designed and configured for the embodiment or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. - includes hardware devices specially configured to store and execute program instructions, such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, as well as machine language codes such as those produced by a compiler.

As described above, although the embodiments have been described with limited examples and drawings, those skilled in the art can make various modifications and variations from the above description. For example, the described techniques may be performed in an order different from the method described, and/or components of the described system, structure, device, circuit, etc. may be combined or combined in a different form than the method described, or other components may be used. Or even if it is replaced or substituted by equivalents, appropriate results can be achieved.

Therefore, other implementations, other embodiments, and equivalents of the claims are within the scope of the following claims.

Claims (11)

In the hybrid anomaly detection method performed by a hybrid anomaly detection system implemented by a computer,
receiving data generated from the operating system into a hybrid anomaly detection model composed of a signature-based anomaly detection model and a behavior-based anomaly detection model;
performing anomaly detection from data generated in the operating system using the hybrid anomaly detection model; and
Delivering data generated in the operating system and a result obtained by performing the anomaly detection to a server
Hybrid anomaly detection method comprising a. According to claim 1,
In the step of receiving the input,
The step of starting the anomaly detection process as the gateway receives the data generated by the currently operating system.
Hybrid anomaly detection method comprising a. According to claim 1,
The step of performing the abnormality detection,
Performing a signature-based anomaly detection operation as data generated by the operating system is input to a signature-based anomaly detection model configured in the hybrid anomaly detection model.
Hybrid anomaly detection method comprising a. According to claim 3,
The step of performing the abnormality detection,
Classifying data generated in the running system into normal operation or abnormal operation according to filtering criteria using the signature-based anomaly detection model.
Hybrid anomaly detection method comprising a. According to claim 4,
The step of performing the abnormality detection,
When the data generated by the operating system is classified as an abnormal operation by the signature-based anomaly detection model, the anomaly detection process is terminated, and the data generated by the operating system is detected by the signature-based anomaly detection model. If it is classified as a normal operation, transferring data generated from the operating system to a behavior-based anomaly detection model.
Hybrid anomaly detection method comprising a. According to claim 1,
The step of performing the abnormality detection,
Performing a behavior-based anomaly detection operation as the data generated by the operating system is input to a behavior-based anomaly detection model configured in the hybrid anomaly detection model.
Hybrid anomaly detection method comprising a. According to claim 6,
The step of performing the abnormality detection,
classifying data generated by the operating system into normal operation or abnormal operation using the behavior-based anomaly detection model;
Hybrid anomaly detection method comprising a. According to claim 7,
The step of performing the abnormality detection,
Obtain new input data output by encoding and decoding through an autoencoder for data classified as normal operation through a signature-based anomaly detection model, and obtain difference information between the data classified as normal operation and the obtained new input data. steps to calculate
Hybrid anomaly detection method comprising a. According to claim 8,
The step of performing the abnormality detection,
Comparing the calculated difference information with a threshold value for classifying a normal operation and an abnormal operation to determine whether or not the data classified as normal operation is finally abnormal.
Hybrid anomaly detection method comprising a. According to claim 1,
The conveying step is
Transmitting the data generated in the currently operating system and the abnormality detection result determined in the abnormality detection step to the server
Hybrid anomaly detection method comprising a. In a hybrid anomaly detection system implemented by a computer,
a data input unit that receives data generated from the operating system into a hybrid anomaly detection model composed of a signature-based anomaly detection model and a behavior-based anomaly detection model;
an anomaly detection unit configured to perform anomaly detection from data generated in the operating system using the hybrid anomaly detection model; and
Result delivery unit for delivering the data generated by the operating system and the result obtained by performing the anomaly detection to the server.
A hybrid anomaly detection system comprising a.

Images