WO2022270678A1

WO2022270678A1 - Network intrusion detection system using determination delay for packets

Info

Publication number: WO2022270678A1
Application number: PCT/KR2021/011914
Authority: WO
Inventors: 박우길; 김태훈
Original assignee: 영남대학교 산학협력단
Priority date: 2021-06-25
Filing date: 2021-09-03
Publication date: 2022-12-29
Also published as: KR102354467B1

Abstract

The present invention relates to an intrusion detection system for detecting whether or not there is an intrusion into a network comprising a plurality of packets, and comprises: a classifier that, by using an artificial neural network, classifies, into any one of a normal class and an attack class, according to whether or not there is an external intrusion, the packets that are targets for detecting whether or not there is an intrusion; and a determination unit that determines the packets as any one of a determination class and a determination hold class by learning a case in which the result of the classification of the classifier for the packets does not match whether or not there is an actual intrusion, wherein the classifier classifies the packets into any one of the normal class and the attack class, according to whether or not there is an intrusion, if the determination unit determines the packets as the determination class, and, if the packets are the determination hold class, holds the classification of the packets until packets received after the packets are classified. Therefore, it is possible to improve intrusion detection performance by reducing the possibility of misclassification, and to detect, in real time, whether or not there is an intrusion.

Description

Network intrusion detection system using packet decision delay

The present invention relates to an intrusion detection system for detecting whether an intrusion occurs in a network from the outside.

Existing machine-learning-based network intrusion detection system (ML-NIDS) detects whether it is a chip after the session is terminated. Since the ML-NIDS can detect the intrusion after the network intrusion has occurred, there is a time difference between the actual intrusion and the ML-NIDS detecting the intrusion. This causes many limitations in quickly and safely protecting the network because ML-NIDS cannot detect network intrusion in real time. Therefore, when an intrusion occurs in the network, a technique for ML-NIDS to detect the intrusion in real time is required.

To this end, the conventional ML-NIDS uses a method of using statistical characteristics of the entire session as a feature and a method of using some packets within a session as a feature in order to more quickly identify network intrusion. However, since the method using the statistical characteristics of the entire session as a feature creates a session feature necessary for detection after the session is terminated, it is still unable to detect an intrusion at the time of intrusion. That is, it is impossible to eliminate the delay for intrusion detection. On the other hand, the method using some packets within a session as a feature uses only the first few packets rather than the entire session, so it is possible to detect an attack with high accuracy. In addition, such a packet data-based method enables intrusion detection when only a certain number of packets are received without waiting until the session is terminated. The second method can detect an attack more quickly than the conventional method, but it is also impossible to prevent a delay in determining whether or not an intrusion occurs. The reason for this is that the second method cannot immediately detect an intrusion at the time it occurs, and can only be detected when a certain number of packets are received.

On the other hand, when an intrusion occurs, the simplest method for quickly detecting an intrusion without delay is to determine whether or not an intrusion occurs for all received packets. However, this method may cause a problem in that intrusion detection performance is very poor. This is because attack traffic intruding into the network may initially be indistinguishable from normal normal traffic. Rather, the intruding attack traffic is similar to normal traffic at the beginning of the session, but there are cases in which it differs from normal traffic as attempts for actual intrusion proceed. Therefore, when identifying an attack from the first packet of a session, depending on the type of attack, the attack traffic is often misclassified as normal traffic at the beginning of the session, so intrusion detection performance may be very low.

One of the simplest methods to solve this problem is to detect whether or not an attack is present for every packet belonging to a session that has already been determined to be normal. This method can detect the occurrence of an attack after a certain number of packets are transmitted in a session initially classified as normal, so it can solve the problem of misclassification in the early stage and detect intrusion in real time. However, the method of detecting all packets belonging to a normal session has a great limitation in applying it to actual ML-NIDS because the proportion of normal traffic in the total traffic is very high and the amount of traffic is large. In addition, the amount of recent traffic is constantly exploding, and accordingly, the network bandwidth to be processed by the NIDS is also increasing from several gigabps to hundreds of gigabps. Therefore, in order to examine packets of all normal sessions, much higher processing performance is required than the currently developed NIDS, which is very difficult to solve from a technical point of view.

Therefore, the conventional NIDS has a problem of poor detection performance due to the large amount of traffic to be processed, a problem of low accuracy in detecting intrusion by misclassifying an attacked case and a normal case, and a problem of not being able to detect intrusion in real time at the same time. have Accordingly, the present applicant researches and develops an intrusion detection system capable of detecting in real time and preventing the packet from being misclassified by reducing the amount of traffic to be processed and deferring judgment on attack traffic that is difficult to distinguish from normal traffic at the beginning. proceeded.

[Prior art literature]

[Patent Literature]

Korean Patent Registration No. 10-2083028

Korean Patent Publication No. 10-2013-0006750

Korean Patent Registration No. 10-1139913

The present invention, as a network intrusion detection system, is intended to provide a system capable of detecting intrusion in real time while increasing the accuracy of detection when an intrusion into a network occurs from the outside.

The problems to be solved by the present invention are not limited to the problems mentioned above. Other problems and advantages of the present invention will be more clearly understood from the description below.

In order to achieve the above object, the present invention provides an intrusion detection system for detecting intrusion into a network composed of a plurality of packets, by using an artificial neural network, classifying the packet as a normal class or an intrusion detection target according to whether an external intrusion occurs. A classifier for classifying into one of the attack classes; and a determination unit learning a case in which a classification result of the classifier for the packet and actual intrusion do not match, and determining the packet as one of a judgment class or a judgment pending class, wherein the classifier, in the determination unit If the packet is determined to be in the judgment class, the packet is classified into either the normal class or the attack class according to whether or not it is intruded, and if the packet is in the judgment pending class, a packet received next to the packet is classified. It is characterized in that it detects in real time whether there is an intrusion into the network by holding classification of the packet until it is done, and determining intrusion for each individual packet.

Preferably, it further comprises a processing unit for processing the packet according to a classification result of the packet classified by the classifier, wherein the processing unit forwards the packet when the packet is classified into the normal class by the classifier, When the packet is classified as the attack class, the packet may be discarded.

Preferably, the classifier includes: a feature generator for generating a feature for the packet as an input to the artificial neural network; and a classification unit classifying the packet into one of the normal class and the attack class according to the output of the artificial neural network for the feature.

Preferably, the artificial neural network provided in the classifier is a recurrent neural network formed by sequentially connecting a plurality of units, and the units are provided for each packet, and the units are connected back and forth to affect input and output. there is.

Preferably, the classifier, when the packet is classified into the judgment pending class by the determination unit, the input of the unit (unit n) matching the packet is a feature of the packet and a previous unit (unit n+1). Including the output of , the characteristics of the previous packet may be reflected.

Preferably, the feature generator may independently create the feature for each received packet based on data of a predetermined size including a header among data of the packet.

Preferably, the determination unit includes: a decision-sustaining learning model for learning the packet corresponding to the case where the classification result of the classifier and actual intrusion do not match; and a determination module that compares the reference data with data of the packet and classifies whether the packet belongs to the determination class or the determination pending class.

Preferably, the decision-withholding learning model includes an extraction module for classifying arbitrary learning data composed of the packets with respect to the classifier and extracting misclassified data in which a classification result of the classifier and actual intrusion do not match; a learning module that designates the misclassified data as the decision-deferred class and performs single classification and learning on the misclassified data for the decision-deferred class; and a single classification module for performing single classification learned in the learning module on the learning data.

In the present invention, when it is not clear whether normal traffic or attack traffic is initially identified, detection is suspended until accurate classification is possible. This prevents normal traffic from being misclassified as attack traffic and attack traffic as normal traffic, enabling highly accurate intrusion detection and detecting intrusion in real time.

According to the present invention, the execution speed of the intrusion detection system can be increased by reducing the amount of traffic to be processed. The present invention can reduce the amount of traffic to be processed by detecting normal traffic, which accounts for most of the total network traffic, as normal traffic at an early stage and not detecting intrusion in traffic classified as normal. In addition, it is possible to reduce the amount of traffic to be processed by determining whether each packet is intruded or not, and when the traffic of a specific packet is classified as normal or attack after the packet for which the judgment is suspended, the judgment is not made on the subsequent packet. have

In the present invention, in applying a classifier to a packet, a feature in which the characteristics of the corresponding packet are reflected is used for each packet. In generating the feature, the byte value of the entire packet is not used, but among some byte values, SIP, DIP, ID, Source The size of the feature can be reduced because only the value with Port removed is used.

1 shows a configuration diagram of an intrusion detection system according to an embodiment of the present invention.

2 shows a process in which an intrusion detection system according to an embodiment of the present invention and a conventional classifier determine that a session including a plurality of packets is an attack session.

3 shows a configuration diagram of a classifier according to an embodiment of the present invention.

4 shows a process of constructing a decision-withholding learning model according to an embodiment of the present invention.

5 shows a process of classifying whether or not an intrusion has occurred in an intrusion detection system according to an embodiment of the present invention.

Hereinafter, the present invention will be described in detail with reference to the contents described in the accompanying drawings. However, the present invention is not limited or limited by exemplary embodiments. The same reference numerals in each figure indicate members performing substantially the same function.

The objects and effects of the present invention can be naturally understood or more clearly understood by the following description, and the objects and effects of the present invention are not limited only by the following description. In addition, in describing the present invention, if it is determined that a detailed description of a known technology related to the present invention may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted.

1 shows a configuration diagram of an intrusion detection system 1 according to an embodiment of the present invention. The intrusion detection system 1 is a system that detects intrusion into a network composed of a plurality of packets, and can detect intrusion into the network in real time by determining intrusion for each individual packet. The intrusion detection system 1 may include a determination unit 10 , a classifier 30 and a processing unit 50 .

The determination unit 10 may learn a case in which the classification result of the classifier 30 for the packet and actual intrusion do not match, and determine the packet as one of the judgment class and the judgment pending class. That is, the determination unit 10 can suspend the determination until an accurate determination of the corresponding packet is possible by learning sessions that may be misclassified in advance through machine learning when determining whether an initially received packet is an intrusion. can

The determination unit 10 may include a judgment-deferred learning model 110 and a determination module 130 . The decision-sustaining learning model 110 may learn a packet corresponding to a case where the classification result of the classifier 30 and actual intrusion do not match.

The decision-withholding learning model 110 may include an extraction module 1101 , a learning module 1130 and a single classification module 1105 . The extraction module 1101 may classify arbitrary learning data composed of packets with respect to the classifier 30 to extract misclassified data in which the classification result of the classifier 30 and actual intrusion do not match. The learning module 1103 may designate the misclassified data as a decision-deferred class, and perform single classification training on the misclassified data for the decision-deferred class. At this time, the learning module 1103 may extract misclassified data using a one-class classifier and classify it into a judgment deferred class. The single classification module 1105 may select packets having traffic similar to the misclassified data traffic by performing the single classification learned in the learning module 1103 on the learning data. A description of the decision-sustaining learning model 110 will be described later in detail with reference to FIGS. 4 and 5 .

The decision module 130 may compare the reference data and the data of the packet to classify whether the packet belongs to the decision class or the decision pending class. In the decision module 130, when the corresponding packet belongs to the decision pending class, classification may be performed multiple times in the artificial neural network 330 of the classifier 30 thereafter.

The classifier 30 may classify a packet, which is an intrusion detection target, into one of a normal class and an attack class according to whether an external intrusion occurs using an artificial neural network. The classifier 30 classifies the packet into either a normal class or an attack class depending on whether the packet is intruded when the determination unit 10 determines that the packet is in the judgment class, and if the packet is in the judgment pending class, the packet is received next to the packet. Classification of packets can be withheld until packets have been classified.

The classifier 30 may include a feature generator 310 , an artificial neural network 330 and a classifier 350 . The feature generator 310 may generate features for packets as an input to the artificial neural network 330 . The feature generator 310 may independently create a feature for each received packet based on data of a predetermined size (n bytes) including a header among packet data. When the feature creation unit 310 creates a feature, it excludes values corresponding to SIP, DIP, and IP ID from the created feature in order to avoid learning dependent on a specific session, and when it has a port number such as TCP or UDP, the source port (or destination port in the case of reverse packets), etc. may be excluded. n, which is a value for determining the overall size of the feature, may be set differently according to training data, and may be set to an optimal value based on the training data.

The artificial neural network 330 may be a recurrent neural network formed by sequentially connecting a plurality of units 3301 . The unit 3301 may be provided for each packet, and a plurality of units 3301 may be connected back and forth to affect the input/output of the next unit 3301. When a packet is classified as a judgment pending class in the determination unit 10, an input of a unit (unit n) matching the corresponding packet may include a feature of the corresponding packet and output information of the previous unit (unit n-1). .

The classification unit 350 may classify the packet into either a normal class or an attack class according to the output of the artificial neural network 330 for the feature. The artificial neural network 330 may include a DNN in an output portion, and an object determined to be a normal class or an attack class in the classification unit 350 may be an output that has passed through the unit 3301 classification and DNN.

The processing unit 50 may process packets using information stored as whitelist for sessions classified as normal in the past intrusion determination and information stored as blacklist for sessions classified as intrusion. The processing unit 50 searches for a session to which a packet received from the whitelist or blacklist belongs, classifies whether the received packet is a normal packet or an attacked packet, and processes the received packet. If the received packet is the same as the packet of the session classified as normal, the processing unit 50 forwards the corresponding packet, and if it is the same as the packet of the session classified as attack, the processing unit 50 may discard the corresponding packet. If the corresponding packet is clearly determined to be normal or an attack, further intrusion determination may not be performed. If the packet is normal, the amount of traffic to be processed by the intrusion detection system 1 can be reduced because additional double-determination is not performed on normal packets received thereafter. On the other hand, if the corresponding packet is an attack packet and is malicious, attack traffic such as a DDoS attack may explode instantaneously. Since the corresponding traffic is immediately discarded, the amount of traffic to be processed can be reduced even at this time.

The processing unit 50 may process packets according to a classification result of the packets classified by the classifier 30 . The processor 50 processes the corresponding packet differently according to whether the corresponding packet belongs to the normal class or the attack class as a result of classification by the classifier 30 . If the corresponding packet is classified as a normal class, the processor 50 forwards the packet, and if the packet is classified as an attack class, the processor 50 may discard the packet. Even if class classification is not made for the first packet in a specific session and the judgment is suspended, as a result, the class for the second half packet is classified, so according to the classification result of the classification unit 350, the processing unit 50 classifies the corresponding packet. can be processed

2 shows a comparison between the intrusion detection system 1 according to an embodiment of the present invention and a conventional classifier determining a session including a plurality of packets as an attack session. Figure 2 assumes a case of a specific session composed of 7 packets and classified as an attack session. The ‘session feature-based classifier’ can detect intrusion after the corresponding session is terminated. As shown in FIG. 2, it is possible to determine an 'attack' after the session is terminated in the last packet 7, without judging packets 1 through 6. Therefore, the session feature-based classifier has a problem in that the amount of traffic to be processed is large and intrusion cannot be detected in real time.

The second ‘cumulative packet (1~t packet) feature-based classifier’ determines that packets 1 through 3 are normal, and then determines that packets 4 and above are attack. This means that the cumulative packet classifier incorrectly detected packets 1 to 3 and correctly detected packets 4 and up. Therefore, if a result that is determined to be normal and later determined to be an attack continues, there is a problem in that the determination that it is normal in the beginning cannot be trusted and it is not known which result is correct.

On the other hand, the third intrusion detection system, which is an embodiment of the present invention, creates and learns a feature for each partial session using packets sequentially received for each session, and determines intrusion based on this. In the embodiment of the present invention, judgment is suspended for packets for which accurate judgment is impossible, and judgment is performed as normal or attack only when accurate judgment is possible. Referring to FIG. 2 , in the embodiment of the present invention, packets 1 to 3 were judged to be undeterminable in the intrusion detection system 1 and were withheld, and packet 4 was determined to be an attack. That is, the present invention can reduce misclassification of the judgment results and increase reliability, compared to the cumulative packet feature-based classifier, by suspending the judgment instead of making an arbitrary unreliable judgment until an accurate judgment is possible. In addition, if packet 4 is clearly determined to be an attack, packet 4 is discarded and packets 5 to 7 are not judged thereafter, so the amount of traffic to be processed can be reduced compared to the session feature-based classifier.

As such, even for the same attack session, the order of packets determined as an attack may be different according to the determination method of each classifier. As shown in FIG. 2, it can be confirmed that the present invention detects the occurrence of an attack the fastest, and the accuracy is also high.

3 shows a configuration diagram of a classifier 30 according to an embodiment of the present invention.

The classifier 30 determines whether each packet is a normal packet or an attack packet and classifies the corresponding packet into either a normal class or an attack class. In particular, the classifier 30 is characterized in that if the determination unit 10 cannot accurately determine the corresponding packet, the classification unit 30 suspends the determination of the corresponding packet and determines the next packet. However, at this time, the reason why the judgment on the previous packet can be suspended and whether the next packet is intruded is determined because the classifier 30 of the present invention uses information about the attack in the previous packets. In other words, when a feature is created for each individual packet for a session, it is difficult to detect the characteristics of an attack made over several packets if only an independent individual feature unrelated to the previous packet is created and used. Therefore, even if the determination of whether a packet is intruded is independently performed, the attack characteristic applied to the previous packet should be designed to be used in determining the next packet.

Meanwhile, as a method of generating a feature, there is a method of generating a partial session feature using a certain number of packets received for each session. However, this method takes up a lot of memory capacity and requires a lot of processing power, so it is almost impossible to actually implement it. The reason is that if k packets are currently received for a specific session, all k packets must be stored in order to generate features for the k packets in real time, and k packets are received whenever a new packet is received. This is because features must be created in real time by reading all of them.

Accordingly, the embodiment of the present invention uses the output of the unit 3301 applied to the k−1 th packet and the k th feature data as input to the k th unit 3301 to determine the k th packet. That is, in determining a specific packet (k-th packet), it is a method of using output information for the immediately previous packet (k-1-th packet). In this way, the k-2 th packet information is used for the k-1 th packet, and the k-3 th packet information is used for the k-2 th packet. It can be performed including the characteristics of the accumulated session using all the information on the -1st packet.

To this end, the artificial neural network 330 provided in the classifier 30 of the present invention may be a recurrent neural network formed by sequentially connecting a plurality of units 3301 . Units 3301 may be provided as many as the number of packets included in the session, or may be more than that. Each unit 3301 corresponds to a packet, and the first unit 3301 (unit n) may determine whether or not the first packet is intruded. Determination of whether a packet is intruded is performed centering on the unit 3301, the feature of the corresponding packet is input to the unit 3301 as an input value, and the normal/attack state of the corresponding packet can be determined as an output thereof.

The classifier 30 of FIG. 3 shows a structure in which an LSTM consisting of a total of N units 3301 and a DNN are added to the output part of each unit as an embodiment of the present invention. In this case, N may be set to a value showing optimal performance based on the learning data. The t-th unit 3301 of the LSTM is used to classify the t-th packet, and the last N-th unit 3301 can be used to classify not only the N-th packet but all packets after the N-th.

In the classifier 30, the feature x _N generated for each packet in the feature generator 310 may be input to a corresponding unit N as an input, and h _N and c _N may be output as outputs. As described above, since the DNN may be included in the output part of the classifier 30, h _N may go through the DNN and finally output o _N.

Referring to FIG. 3 in more detail, it can be seen that x ₁ is input to unit 1 and h ₁ and c ₁ are output as a result. h ₁ passes through the DNN and finally o ₁ is output, and o ₁ is a classification result for the corresponding packet and may indicate whether it is a normal packet or an attack packet. If o ₁ is classified as a normal or attack packet, then the classification unit 350 classifies the corresponding packet according to the class, and the processing unit 50 may forward or discard the corresponding packet.

On the other hand, if the corresponding packet is unclassifiable, the classifier 30 may suspend the determination of the corresponding packet and attempt to classify the second packet. In this case, x ₂ , a feature of packet 2, and h ₁ and c ₁ , outputs of unit 1, may be used as inputs of unit 2. That is, when the classification result for the t-1 th packet is 'not classifiable', c _t-1 and h _t-1 can be stored and used in advance to perform classification when the next t-th packet is received. Basically, c _t-1 and h _t-1 partially include the characteristics of packets 1 through t-1. Therefore, it is possible to create a feature reflecting the characteristics of all packets received in the past without storing information on all packets. A feature (F _t ) of the t-th packet in a specific session may be defined as follows.

4 shows a process of constructing a decision-withholding learning model 110 according to an embodiment of the present invention. The decision-sustaining learning model 110 is a component for preventing attack traffic similar to normal traffic from being classified as normal when an initial packet is received at the beginning of a session. To this end, the decision-withholding learning model 110 learns the classifier 30 using session traffic in which the initial attack traffic is misclassified as normal. Through this, the decision deferral learning model 110 can determine whether to immediately perform an attack determination on the corresponding packet or defer the determination to the next packet.

The judgment-deferred learning model 110 learns the classifier 30 using the dataset D _t composed of the t-th packets for several sessions, and classifies arbitrary learning data with the classifier 30. As a result, misclassification It is possible to create a dataset M _t consisting of only the data M={M _t | t=1, 2, … , N }, we can learn M using a one-class classifier. In an embodiment of the present invention, a case of using Deep-SVDD as a one-class classifier is exemplified. Deep-SVDD is easy to control misclassification probability because it can determine which class a packet belongs to by mapping a feature domain to an optimal domain through deep learning.

In the method of constructing the decision-deferred learning model 110, first, in one step, the entire training dataset T ¹ and the dataset D ₁ consisting of only the first packets of all sessions belonging to T ¹ are generated. Unit 1 of the LSTM of the classifier 30 is learned using T ¹ and D ₁ . After training, the training dataset T ¹ is classified into LSTM unit 1, and then misclassified data M ₁ composed of misclassified data is generated. Regardless of the actual class of M ₁ , M ₁ is collectively designated as a judgment deferred class. Deep SVDD ₁ , a one-class classifier, is learned using M ₁ . At this time, since Deep SVDD is a one-class classifier, it can be learned with a dataset consisting of one deferred decision class. D ₁ learned for unit 1 is classified as Deep SVDD ₁ . As a result of the classification, a dataset T ² composed of sessions classified as pending judgment may be newly created.

Similar to the previous process, D ₂ is created using the created training dataset T ² , and unit 2 of the LSTM is learned using it. Note that D ₂ used for learning from the second process includes not only the second packet feature x ₂ but also h ₁ and c ₁ outputs of LSTM unit 1. Similar to the first process, the training dataset T ² is classified as LSTM unit 2, misclassified data M ₂ is obtained, M ₂ is designated as a decision-deferred class, and Deep SVDD ₂ is learned using M ₂ . D ₂ learned with unit 2 is classified as Deep SVDD ₂ , and then a dataset T ³ composed of sessions classified as pending judgment is constructed. Through this process, the judgment suspension learning model 110 can be built.

More generalizing this, it can be defined as: Using the training dataset T ^t (t>1), D _t is generated for all sessions belonging to T ^t , and unit t of LSTM is learned using this. At this time, D _t used for learning may include h _t-1 and c _t- 1 outputs of the LSTM unit t as well as the feature x _t of the corresponding packet. After classifying the training dataset T ^t with LSTM unit t, misclassified data M _t is obtained. Designate the corresponding M _t as a decision-deferred class and learn Deep SVDD _t using M _t . After classifying the learned D _t as Deep SVDD _t , a dataset T ^t ⁺ ¹ consisting of sessions classified as pending decision is constructed. This process can be repeated until M _t is an empty set or t=N. In addition, if there are packets after the Nth, they may all be included in D _N . So at the Nth step, D _N is D _N ₊₁ , D _N ₊₂ , … may include all.

5 shows a process of classifying whether an intrusion occurs in the intrusion detection system 1 according to an embodiment of the present invention.

First, the received packet is searched in the Whitelist or Blacklist to see if there is a normal or attack session to which the packet belongs. In FIG. 5, the step of searching the whitelist is shown first, but the order is not limited and it is okay to check the blacklist first. If the session to which the corresponding packet belongs is detected in the Whitelist, the corresponding packet is forwarded. If not detected, the Blacklist is searched and if the session is detected, the corresponding packet is discarded. If the corresponding packet is not detected in both the whitelist or blacklist, it is searched whether the corresponding packet belongs to the session table. When the corresponding packet is not detected in the session table, the classifier 30 sets c=0, h=0, and t=1 as conditions to be performed. On the other hand, if the corresponding packet is detected in the session table, c _t-1 , h _t-1 , and t values are read from the session information.

The next step is to create a feature x _t for that packet in both cases, take x _t, , c _t _-1 , h _t-1 as input and classify it in unit t, x _t, , c _t _-1 , h Classification is performed with _t- ₁ as the input of Deep SVDD _t . As a result of classification in Deep SVDD _t where the decision-deferred class is a single classification, if the packet can be classified, the corresponding packet or session information is added to the Whitelist or Blacklist depending on whether an intrusion has occurred. If it is a normal packet, it is added to the whitelist and the packet is forwarded. If it is an attack packet, it is added to the blacklist and the packet is discarded. On the other hand, as a result of classification in Deep SVDD _t , if the corresponding packet cannot be classified, c _t , h _t , t are updated and stored according to the order of the corresponding packet, or stored immediately and the packet is forwarded.

Although the present invention has been described in detail through representative embodiments, those skilled in the art will understand that various modifications are possible to the above-described embodiments without departing from the scope of the present invention. will be. Therefore, the scope of the present invention should not be limited to the described embodiments and should not be defined, and should be defined by all changes or modifications derived from the claims and equivalent concepts as well as the claims to be described later.

Claims

In the intrusion detection system for detecting whether there is an intrusion on a network composed of a plurality of packets,

a classifier for classifying the packet, which is an intrusion detection target, into either a normal class or an attack class according to an external intrusion by using an artificial neural network; and

A determination unit configured to learn a case in which a classification result of the classifier for the packet and actual intrusion do not match, and determine the packet as one of a judgment class or a judgment pending class;

The classifier,

If the determination unit determines that the packet is in the determination class, the packet is classified into either the normal class or the attack class according to whether or not it is intruded, and if the packet is in the judgment pending class, it is received next to the packet. The classification of the packet is suspended until the packet is classified,

An intrusion detection system characterized in that it is possible to detect in real time whether or not there is an intrusion into the network by determining whether or not there is an intrusion for each individual packet.
According to claim 1,

Further comprising a processing unit for processing the packet according to a classification result of the packet classified by the classifier,

The processing unit,

The intrusion detection system of claim 1 , wherein the classifier forwards the packet when the packet is classified as the normal class, and discards the packet when the packet is classified as the attack class.
According to claim 1,

The classifier,

a feature generating unit generating a feature for the packet as an input to the artificial neural network; and

and a classification unit classifying the packet into one of the normal class and the attack class according to the output of the artificial neural network for the feature.
According to claim 3,

The artificial neural network provided in the classifier,

A recurrent neural network formed by sequentially connecting a plurality of units, wherein the units are provided for each packet, and the units are connected back and forth to affect input and output.
According to claim 4,

The classifier,

When the packet is classified into the judgment pending class by the determination unit,

The input of the unit (unit n) matching the packet includes the feature of the packet and the output of the previous unit (unit n + 1),

An intrusion detection system characterized by reflecting the characteristics of previous packets.
According to claim 3,

The feature creation unit,

The intrusion detection system characterized in that the feature is independently generated for each packet received based on data of a certain size including a header among data of the packet.
According to claim 1,

The judge,

a judgment suspension learning model for learning the packet corresponding to the case where the classification result of the classifier and actual intrusion do not match; and

and a determination module comparing the reference data with data of the packet and classifying whether the packet belongs to the determination class or the determination pending class.
According to claim 7,

The judgment suspension learning model,

an extraction module for classifying arbitrary training data composed of the packets with respect to the classifier and extracting misclassified data in which a classification result of the classifier and actual intrusion do not match;

a learning module that designates the misclassified data as the decision-deferred class and performs single classification and learning on the misclassified data for the decision-deferred class; and

and a single classification module for performing a single classification learned in the learning module on the learning data.