Convergence Security Journal (융합보안논문지)

Korea convergence Security Association (한국융합보안학회)
권호 표지
DOI QR코드

DOI QR Code

A study on intrusion detection performance improvement through imbalanced data processing

불균형 데이터 처리를 통한 침입탐지 성능향상에 관한 연구

  • Received : 2021.09.01
  • Accepted : 2021.09.17
  • Published : 2021.09.30
Download PDF
⟨ Previous Next ⟩

Abstract

As the detection performance using deep learning and machine learning of the intrusion detection field has been verified, the cases of using it are increasing day by day. However, it is difficult to collect the data required for learning, and it is difficult to apply the machine learning performance to reality due to the imbalance of the collected data. Therefore, in this paper, A mixed sampling technique using t-SNE visualization for imbalanced data processing is proposed as a solution to this problem. To do this, separate fields according to characteristics for intrusion detection events, including payload. Extracts TF-IDF-based features for separated fields. After applying the mixed sampling technique based on the extracted features, a data set optimized for intrusion detection with imbalanced data is obtained through data visualization using t-SNE. Nine sampling techniques were applied through the open intrusion detection dataset CSIC2012, and it was verified that the proposed sampling technique improves detection performance through F-score and G-mean evaluation indicators.

침입탐지 분야에서 딥러닝과 머신러닝을 이용한 탐지성능이 검증되면서 이를 활용한 사례가 나날이 증가하고 있다. 하지만, 학습에 필요한 데이터 수집이 어렵고, 수집된 데이터의 불균형으로 인해 머신러닝 성능이 현실에 적용되는데 어려움이 있다. 본 논문에서는 이에 대한 해결책으로 불균형 데이터 처리를 위해 t-SNE 시각화를 이용한 혼합샘플링 기법을 제안한다. 이를 위해 먼저, 페이로드를 포함한 침입탐지 이벤트에 대해서 특성에 맞게 필드를 분리한다. 분리된 필드에 대해 TF-IDF 기반의 피처를 추출한다. 추출된 피처를 기반으로 혼합샘플링 기법을 적용 후 t-SNE를 이용한 데이터 시각화를 통해 불균형 데이터가 처리된 침입탐지에 최적화된 데이터셋을 얻게 된다. 공개 침입탐지 데이터셋 CSIC2012를 통해 9가지 샘플링 기법을 적용하였으며, 제안한 샘플링 기법이 F-score, G-mean 평가 지표를 통해 탐지성능이 향상됨을 검증하였다.

Keywords

Acknowledgement

본 논문은 2021년 정부(국토교통부)의 재원으로 국토교통과학기술진흥원(KAIA)의 지원을 받아 연구가 수행된 연구임(21TLRP-B152768-03, 자율협력주행 도로교통체계 통합보안시스템 운영을 위한 기술 및 제도개발).

References

  1. TAN X P, SU S J, HUANG Z P, et al. Wireless sensor networks intrusion detection based on SMOTE and the random forest algorithm. Sensors, 2019, 19(1): 203. https://doi.org/10.3390/s19010203
  2. LI C L, LIU S G. A comparative study of the class imbalance problem in Twitter spam detection. Concurrency and Computation: Practice and Experience, 2017, 30(5): e4281. https://doi.org/10.1002/cpe.4281
  3. LI Y L, SUN G S, ZHU Y H. Data imbalance problem in text classification. Proc. of the 3rd International Symposium on Information Processing, 2010: 301 - 305.
  4. ZHU M, XIA J, JIN X Q, et al. Class weights random forest algorithm for processing class imbalanced medical data. IEEE Access, 2018, 6: 4641-4652. https://doi.org/10.1109/access.2018.2789428
  5. Yan, B.; Han, G.; Sun, M.; Ye, S. A Novel Region Adaptive SMOTE Algorithm for Intrusion Detection on Imbalanced Problem. In Proceedings of the 2017 3rd IEEE International Conference on Computer and Communications (ICCC); IEEE: Chengdu, December 2017; pp. 1281-1286.
  6. H. Haibo , A. Garcia, E.: "Learning from Imbalanced Data", IEEE Transactions On Knowledge And Data Engineering, Vol.2, No.9, September (2009).
  7. HAN H, WANG W Y, MAO B H. Borderline-SMOTE: a new over-sampling method in imbalanced data sets learning. Proc. of the International Conference on Advances in Intelligent Computing, 2005: 878 - 887.
  8. CHAWLA N V, LAZAREVIC A, HALL L O, et al. SMOTE- Boost: improving prediction of the minority class in boosting. Proc. of the 7th European Conference on Principles and Prac- tice of Knowledge Discovery in Databases, 2003: 107 - 119.
  9. FREUND Y. Experiment with a new boosting algorithm. Proc. of the 13th International Conference on Machine Learning, 1996: 148 - 156.
  10. Yong Sun; Feng Liu SMOTE-NCL: A Re-Sampling Method with Filter for Network Intrusion Detection. In Proceedings of the 2016 2nd IEEE International Conference on Computer and Communications (ICCC); IEEE: Chengdu, China, October 2016; pp. 1157-1161.
  11. 정일옥, 전이학습과 불균형 데이터 처리를 통한 침입탐지 성능향상에 관한 연구, 박사학위논문, 고려대학교 2021. 8
  12. Leea, H.J.; Lee, S. 데이터 전처리와 앙상블 기법을 통한 불균형 데이터의 분류모형 비교 연구. 응용통계연구 2014, 27, 357-371, doi:10.5351/KJAS.2014.27.3.357.
  13. Son, M.J.; Jung, S.W.; Hwang, E.J. 불균형 데이터 분류를 위한 딥러닝 기반 오버샘플링 기법. 정보처리학회논문지:소프트웨어 및 데이터공학 2019, 8, 311-316, doi:10.3745/KTSDE.2019.8.7.311.
  14. Kim, D.; Kang, S.; Song, J. 불균형 자료에 대한 분류분석. 응용통계연구 2015, 28, 495-509, doi:10.5351/KJAS.2015.28.3.495.
  15. M. Kubat and S. Matwin, "Addressing the curse of imbalanced training sets: one-sided selection," in Proceedings of the International Conference on Machine Learning, pp. 179-186, Nashville, Tenn, USA, 1997.
  16. Y. Liu, X. H. Yu, J. X. Huang, and A. J. An, "Combining integrated sampling with SVM ensembles for learning from imbalanced datasets," Information Processing & Management, vol. 47, no. 4, pp. 617-631, 2011. https://doi.org/10.1016/j.ipm.2010.11.007
  17. Csic torpeda 2012, http data sets, July 20, 2021. [Online]. Available: http://www.tic.itefi.csic.es/torpeda.
  18. Carmen Torrano-Gimenez, Alejandro Perez-Villegas, and Gonzalo Alvarez. "TORPEDA: Una Especificacion Abierta de Conjuntos de Datos para la Evaluacion de Cortafuegos de Aplicaciones Web." 2012. TIN2011-29709-C0201.
  19. Web Attacks Detection based on CNN - Csic torpedo 2012 http data sets - GitHub, July 20, 2021. [Online]. Available: https://github.com/DuckDuckBug/cnn_waf.