Method for analyzing application of packet based on deep learning model and apparatus for performing same

Abstract

To provide a method for analyzing an application of a packet based on a deep learning model.SOLUTION: The method includes generating a plurality of packet images based on a packet transmitted through a network, training a deep learning model to determine an application of the packet image based on metadata corresponding to the packet image, collecting packet data transmitted in real time through the network and converting the packet data into the packet image, and determining the application of the packet data by inputting the packet image and metadata information of the packet data to the deep learning model. By using the deep learning model, it is possible to analyze an application by imaging a packet without directly analyzing a pattern of the packet, and analyze an application of a packet without a process of analyzing and patterning a packet of a service generated in advance.SELECTED DRAWING: Figure 7

Description

[Technical Field]

[0001] The present application relates to a method for analyzing the application of packets based on a deep learning model and an apparatus for performing the same. [Background technology]

[0002] DPI (Deep Packet Inspection) technology is a technology that collects packets generated on a network and analyzes the applications. It patterns the characteristics of the applications within the packets and, when identical packets are generated, determines what application or service the packets belong to.

[0003] Existing DPI technology development involves analyzing all packets generated by services and identifying their characteristic patterns. However, as cloud services evolve, new services and streaming services emerge, generating a large number of packets that are unknown to existing methods. Also, since it is impossible to identify packet patterns for every service generated worldwide in advance, a different approach to DPI technology is needed.

[0004] Existing methods are particularly difficult to analyze traffic in IoT and OT networks. To analyze undisclosed protocols, existing methods require either sending packets of the undisclosed protocol out to the outside or having developers personally visit the site and create patterns through long-term analysis, which limits the ability to analyze undisclosed protocols.

[0005] Therefore, in order to effectively handle protocol analysis of IoT and OT networks where applications are not publicly disclosed, a method is needed that allows users to quickly classify packets without developers having to directly analyze packet patterns. Summary of the Invention [Problem to be solved by the invention]

[0006] One problem to be solved by the present invention is to provide a method for analyzing packet applications without requiring developers to directly analyze packet patterns, and an apparatus for performing this method.

[0007] Another problem to be solved by the present invention is to provide a method and an apparatus for analyzing packet applications without a process of analyzing packets of a service that is generated in advance and forming a pattern.

[0008] Another problem to be solved by the present invention is to provide a method for analyzing the application of a packet based on a deep learning model and an apparatus for performing the method.

[0009] The problems to be solved by the present invention are not limited to those described above, and problems not mentioned will be clearly understood by those skilled in the art to which the present invention pertains from this specification and the accompanying drawings. [Means for solving the problem]

[0010] A method for analyzing packet applications based on a deep learning model according to one embodiment of the present invention may include the steps of generating a plurality of packet images based on packets transmitted over a network, training a deep learning model to determine the application of the packet images based on the plurality of packet images and metadata corresponding to the plurality of packet images, collecting packet data transmitted over the network in real time and converting it into packet images, and inputting metadata information of the packet images and the packet data into the deep learning model to determine the application of the packet data.

[0011] An application analysis device according to one embodiment of the present invention includes a communication unit, a memory, and a processor, and the processor generates a plurality of packet images based on packets transmitted over a network, trains a deep learning model to determine the application of the packet images based on the plurality of packet images and metadata corresponding to the plurality of packet images, collects packet data transmitted over the network in real time, converts it into packet images, and inputs metadata information of the packet images and the packet data into the deep learning model to determine the application of the packet data.

[0012] The means for solving the problems of the present invention are not limited to the above-mentioned means, and any unmentioned means will be clearly understood by a person having ordinary skill in the art to which the present invention pertains from this specification and the accompanying drawings. [Effects of the Invention]

[0013] According to one embodiment of the present invention, a deep learning model can be used to image packets and analyze applications without developers having to directly analyze packet patterns.

[0014] According to one embodiment of the present invention, a deep learning model can be used to analyze packet applications without the need for a process of analyzing and patterning packets of pre-generated services. [Brief explanation of the drawings]

[0015] [Figure 1] 1 is a block diagram showing a simplified configuration of an apparatus according to an embodiment of the present application. [Figure 2] FIG. 2 is a block diagram showing a simplified configuration of a processor of an apparatus according to an embodiment of the present application. [Figure 3] 1 is a diagram illustrating a method for generating a packet image according to an embodiment of the present application; [Figure 4] 1 is a diagram illustrating a method for generating a packet image according to an embodiment of the present application; [Figure 5] 1 is a diagram illustrating a method for training a deep learning model to determine an application of a packet image according to an embodiment of the present application. [Figure 6] 1 is a diagram illustrating a method for determining an application of packet data using a deep learning model according to an embodiment of the present application. [Figure 7] 1 is a flowchart illustrating a method for analyzing an application of a packet based on deep learning according to an embodiment of the present application. [Figure 8] 1 is a diagram illustrating data classification according to an embodiment of the present application. DETAILED DESCRIPTION OF THE INVENTION

[0016] The above-mentioned objects, features, and advantages of the present application will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. However, since the present application can be modified in various ways and can have various embodiments, the following will describe in detail a specific embodiment by way of example in the drawings.

[0017] The same reference numerals will be used throughout the specification to refer to the same elements in principle. Furthermore, elements having the same function within the same concept shown in the drawings of each embodiment will be described using the same reference numerals, and redundant description thereof will be omitted.

[0018] If it is determined that a detailed description of a known function or configuration related to this application may unnecessarily obscure the gist of this application, the detailed description will be omitted. In addition, numbers (e.g., 1, 2, etc.) used in the description of this specification are merely identification symbols for distinguishing one component from another.

[0019] In addition, the suffixes "module" and "section" for components used in the following examples are given or used interchangeably only for the sake of ease of writing the specification, and do not have any meanings or roles that are distinct from each other in themselves.

[0020] In the following examples, the singular expression includes the plural expression unless the context clearly indicates otherwise.

[0021] In the following examples, terms such as "include" or "have" mean that the features or components described in the specification are present, and do not preclude the possibility that one or more other features or components may be added.

[0022] In the drawings, the size of elements may be exaggerated or reduced for the sake of convenience. For example, the size and thickness of each element shown in the drawings are arbitrarily shown for the sake of convenience, and the present invention is not necessarily limited to those shown in the drawings.

[0023] If an embodiment can be implemented differently, the order of certain processes may be performed differently from the order described. For example, two processes described in succession may be performed substantially simultaneously or may be performed in the reverse order from that described.

[0024] In the following examples, when elements are said to be connected, this includes not only the case where the elements are directly connected, but also the case where the elements are indirectly connected through an intervening element.

[0025] For example, when it is stated in this specification that components are electrically connected, this includes not only cases where the components are directly electrically connected, but also cases where the components are indirectly electrically connected through an intervening component.

[0026] Packets transmitted and received over a network can contain application information. For example, when a user connects to website A, a session is established and packets are transmitted and received. The initial packets transmitted and received each time a user connects to website A contain similar information. In addition, in the case of IoT or streaming services, packets are compressed and transmitted using a codec, so the initial packets can contain similar information. In this way, when users use the same service, the initial packets transmitted and received can contain similar information, and when users use different services, the packets can contain different information. Taking this into account, an image corresponding to the initial packets can be generated, and if the images are similar, it can be determined that the same service is being used.

[0027] Hereinafter, a method for analyzing the application of a packet based on the deep learning model of the present application will be described with reference to FIGS.

[0028] 1 is a block diagram showing a simplified configuration of an apparatus according to an embodiment of the present application. Referring to FIG. 1, an apparatus 100 may include a communication unit 110, a processor 120, and a memory .

[0029] The communication unit 110 can support the establishment of a direct (wired) communication channel or a wireless communication channel between the device 100 and an external device (e.g., a server) and the performance of communication through the established communication channel. The communication unit 110 can include one or more communication processors that operate independently of the processor 120 (e.g., an application processor) and support direct (e.g., wired) communication or wireless communication. According to one embodiment, the communication unit 110 can include a wireless communication module (e.g., a cellular communication module, a short-range wireless communication module, or a global navigation satellite system (GNSS) communication module) or a wired communication module (e.g., a local area network (LAN) communication module, or a power line communication module).

[0030] The communication unit 110 can transmit and receive packets through a network. For example, when connecting to a website, the communication unit 110 can connect a session and transmit and receive packets.

[0031] Processor 120 can execute software to control at least one other component (e.g., a hardware or software component) of device 100 coupled to processor 120 and perform various data processing or computations. According to one embodiment, as at least a part of the data processing or computation, processor 120 can store instructions or data received from another component (e.g., communication unit 110) in volatile memory, process the instructions or data stored in volatile memory, and store the resulting data in non-volatile memory. According to one embodiment, processor 120 can include a main processor (e.g., a central processing unit or application processor) or an auxiliary processor (e.g., a neural processing unit (NPU)) that can operate independently or in conjunction with the main processor. For example, if device 100 includes a main processor and an auxiliary processor, the auxiliary processor can be configured to use less power than the main processor or to specialize in a designated function. The auxiliary processor can be implemented separately from or as part of the main processor.

[0032] According to one embodiment, the auxiliary processor (e.g., a neural network processing device) may include a hardware structure specialized for processing an artificial intelligence model. The artificial intelligence model may be generated through machine learning. Such learning may be performed, for example, within the device 100 itself where the artificial intelligence is performed, or may be performed through a separate server. The learning algorithm may include, for example, supervised learning, unsupervised learning, semi-supervised learning, or reinforcement learning, but is not limited to the above examples. The artificial intelligence model may include multiple artificial neural network layers. The artificial neural network may be one of, but is not limited to, a deep neural network (DNN), a convolutional neural network (CNN), a recurrent neural network (RNN), a restricted Boltzmann machine (RBM), a deep belief network (DBN), a bidirectional recurrent deep neural network (BRDNN), a deep Q-network, or a combination of two or more of the above. In addition to hardware structures, an artificial intelligence model may additionally or primarily include software structures.

[0033] The processor 120 may generate multiple packet images based on packets transmitted over a network. For example, the processor 120 may classify packets transmitted over a network by session and generate one packet image using packets transmitted and received in one session. Specifically, the processor 120 may generate a data block by combining packets from the first packet to the nth packet in the chronological order of packets transmitted and received in one session. In this case, the nth packet is determined so that the sum of the capacities of the first packet to the nth packet is equal to a predetermined capacity, where n may be a value greater than or equal to 1. In addition, if the total capacity of packets transmitted and received in one session is less than the predetermined capacity, all packets may be combined to generate a data block. The processor 120 may then generate a packet image by converting the hex code of packets included in the data block into RGB values. The multiple packet images generated in this manner may be used as learning data for training a deep learning model that determines the application of packets.

[0034] The processor 120 can train a deep learning model to determine the application of a packet based on multiple packet images and their metadata. Specifically, the processor 120 can train a deep learning model by labeling the packet identification information and application information included in the metadata in the packet images.

[0035] The processor 120 can collect packet data transmitted over a network in real time and convert it into a packet image, and can input specific information of the packet image and metadata of the packet data into a deep learning model to determine the application of the packet data.

[0036] The memory 130 may store various data used by at least one component (e.g., the processor 120) of the device 100. The data may include, for example, input data or output data for software and related instructions. The memory 130 may include volatile or non-volatile memory.

[0037] FIG. 2 is a block diagram illustrating a simplified configuration of a processor of an apparatus according to an embodiment of the present application. FIG. 2 will be described in more detail with reference to FIGS. 3 to 6. FIG. 3 is a diagram illustrating a method for generating a packet image according to an embodiment of the present application. FIG. 4 is a diagram illustrating a method for generating a packet image according to an embodiment of the present application. FIG. 5 is a diagram illustrating a method for training a deep learning model to determine the application of a packet image according to an embodiment of the present application. FIG. 6 is a diagram illustrating a method for determining the application of packet data using a deep learning model according to an embodiment of the present application.

[0038] Referring to FIG. 2 , the processor 120 may include a packet image generator 121, a deep learning model trainer 123, and an application analyzer 125.

[0039] The packet image generator 121 may generate a packet image to generate data for training a deep learning model, and may also generate a packet image to analyze the application of packets transmitted and received in real time over a network.

[0040] According to one embodiment, the packet image generator 121 classifies packets transmitted over a network by session and generates one packet image using packets transmitted and received in one session. The size of a packet used to generate a packet image may vary depending on the number of pixels of the packet image to be generated. For example, if one pixel in a black and white image indicates brightness with a value between 0 and 255, one byte (8 bits) is required to indicate the brightness of one pixel. Therefore, as an example, a 32x32 pixel packet image corresponding to a packet may be generated using a 1024 byte packet. For convenience, the following description will be given assuming that a 32x32 pixel packet image is generated using a 1024 byte packet, but there is no limit to the size of the packet constituting the data block or the pixels of the packet image.

[0041] Specifically, the packet image generator 121 can combine packets transmitted and received in one session. For example, as shown in FIG. 3, packets AAAAAA, BBBBBB, CCCCCC, DDDDDD, and EEEEEE transmitted and received in one session can be combined with padding to generate a 2048-byte data block. The packet image generator 121 can then modify the combination of packets so that the capacity of the data block becomes a preset capacity. For example, as shown in FIG. 4, the packet image generator 121 can generate a 1024-byte data block by combining AAAAAA, BBBBBB, and CCCCCC packets with some data from the DDDDDD packet according to the order in which the packets were transmitted and received. The packet image generator 121 can then convert the hex code representing the 1024-byte data block into RGB values ​​to generate a 32 x 32 pixel packet image.

[0042] The deep learning model training unit 123 can train a deep learning model to determine the application of a packet image based on the packet image and its corresponding metadata. Meanwhile, although a method of training a deep learning model for determining the application of a packet image will be described as being performed by the deep learning model training unit 123, it may be performed by an external device separate from the apparatus 100. Hereinafter, it will be described as if the deep learning model training unit 123 of the apparatus 100 performs training of a deep learning model for determining the application of a packet image. However, this is merely an example and should not be construed as being limiting.

[0043] The deep learning model training unit 123 may assign application information to packet images to obtain a prepared training set. Additionally, the deep learning model training unit 123 may prepare a training set by labeling the packet images with at least one of characteristic information such as a protocol, an application category type, a method type or a content type if the application is HTTP, or a TLS version if the application is TLS, based on packet metadata. The operation of assigning label information to packet images may be performed using any appropriate software or may be passively performed by any practitioner.

[0044] The deep learning model training unit 123 may classify a plurality of packet images by characteristics based on metadata corresponding to the packets, label packet images corresponding to specific characteristics with the characteristics, and perform training by characteristics.

[0045] The deep learning model may include an input layer, an output layer, and a hidden layer. The input layer may receive a packet image, and the output layer may output an output value related to the packet's application. The hidden layer may have multiple nodes connecting the input layer and the output layer. However, in the present invention, in consideration of the learning speed, the deep learning model training unit 123 may train the deep learning model using only the input layer and the output layer. Also, a ResNet152V2 training model may be used, using 1024 neurons to process 32 × 32 (1024) pixel values. Also, as shown in FIG. 5, the input layer may use ReLU, the output layer may use Softmax, and the optimizer may use adam.

[0046] The application analyzer 125 can input the newly generated packet image and metadata information into the trained deep learning model to determine the application of the packet image. For example, as shown in FIG. 6, the application analyzer 125 can output a result value related to the application of the packet based on the newly generated packet image and training data.

[0047] In addition, if a newly generated packet image does not have a similar image in the learning data (e.g., a packet image generated from a packet in an OT network), the application analysis unit 125 can determine application information based on the most similar image or receive new labeling input. For example, if a newly generated packet image does not have a similar image in the learning data, the deep learning model training unit 123 can label the newly generated packet image with information that it is a factory control protocol and train the deep learning model. In this case, the developer can confirm that the packet image is a factory control protocol using the packet image without analyzing the packet pattern.

[0048] Fig. 7 is a flowchart illustrating a method for analyzing the application of a packet based on deep learning according to an embodiment of the present application. Fig. 7 will be described in more detail with reference to Fig. 8. Fig. 8 is a diagram illustrating data classification according to an embodiment of the present application.

[0049] The order of the operations in Fig. 7 is not limited, and other operations may be performed between two adjacent operations. Also, at least some of the operations in Fig. 7 may be omitted. In the present invention, the expression that the apparatus 100 performs a specific operation may mean that the processor 120 of the apparatus 100 performs the specific operation, or that the processor 120 controls other hardware to perform the specific operation.

[0050] 7, the device 100 may generate a plurality of packet images based on packets transmitted over a network (S100). Specifically, the device 100 may classify packets transmitted over a network by session and generate a packet image using at least some of the packets transmitted in one session. For example, the device 100 may generate a data block by combining a predetermined amount of packets transmitted earlier in one session. The device 100 may then convert the hex code of the packets included in the data block into RGB values ​​to generate a packet image.

[0051] The apparatus 100 may train a deep learning model to determine the application of a packet image based on a plurality of packet images and metadata corresponding to the plurality of packet images (S200). Specifically, the apparatus 100 may train the deep learning model by labeling the packet image with packet application information. Additionally, the apparatus 100 may label the packet image with packet-specific information (e.g., protocol, application category type, method type if the application is HTTP, content type if the application is HTTP, or TLS version if the application is TLS) along with the application information, and train the deep learning model.

[0052] In addition, the device 100 can classify packet images based on application-specific information and train a deep learning model for each classified image. For example, the device 100 can classify packets by application or application category, as shown in FIG. 8. If the application is HTTP, the device 100 can classify packets based on the HTTP method type and HTTP content type, and if the application is TLS, the device 100 can classify packets based on the TLS version. The device 100 can label the packet's application information and classification criteria for each classified packet and train a deep learning model.

[0053] The device 100 may collect packet data transmitted in real time over a network and convert it into a packet image (S300). Specifically, the device 100 may collect packet data transmitted in real time over a network and classify the collected packet data by session. The device 100 may then combine packets of a predetermined capacity for each classified session to generate a data block. The device 100 may then convert the hex code of the packets included in the data block into RGB values ​​to generate a packet image.

[0054] The device 100 can input metadata information of a packet image and packet data into a deep learning model to determine the application of the packet data (S400). Specifically, the device 100 can input a newly generated packet image and learning data into a pre-trained deep learning model, output a result value related to the application, and determine the application of the packet data.

[0055] According to an embodiment of the present invention, a method and apparatus for analyzing packet applications using a deep learning model has an advantage that developers can image packets and analyze applications without having to directly analyze packet patterns in advance.

[0056] The features, structures, effects, etc. described in the above embodiments are included in at least one embodiment of the present invention and are not necessarily limited to only one embodiment. Furthermore, the features, structures, effects, etc. exemplified in each embodiment can be combined or modified in other embodiments by a person skilled in the art to which the embodiments belong. Therefore, content related to such combinations and modifications should be interpreted as being included in the scope of the present invention.

[0057] Furthermore, although the above description focuses on the embodiments, these are merely examples and do not limit the present invention. Those skilled in the art will recognize that various modifications and applications not exemplified above are possible within the scope of the essential characteristics of the present invention. In other words, each component specifically illustrated in the embodiments can be modified and implemented. Differences related to such modifications and applications should be construed as being included within the scope of the present invention as defined by the appended claims. [Explanation of symbols]

[0058] 100: Equipment 110: Communications Department 120: Processor 130: Memory

Claims

1. 1. A method for analyzing an application of a packet based on a deep learning model, comprising: generating a plurality of packet images based on packets transmitted over the network; training a deep learning model to determine an application of a packet image based on the plurality of packet images and metadata corresponding to the plurality of packet images; collecting packet data transmitted in real time through the network and converting the packet data into a packet image; inputting the packet image and metadata information of the packet data into the deep learning model to determine an application of the packet data.

2. generating a plurality of packet images based on packets transmitted over the network; classifying packets transmitted through the network by session; generating a data block by combining packets of a predetermined capacity among packets included in each session; and 2. The method of claim 1, further comprising: converting, for each data block, a hex code of a packet included in the data block into an RGB value to generate a packet image.

3. The step of generating a data block for each session by combining packets of a predetermined capacity among packets included in the session includes:

3. The application analysis method of claim 2, further comprising: generating a first data block by combining packets corresponding to a predetermined capacity from a first packet according to an order in which packets included in the first session were generated.

4. generating a packet image by converting a hex code of a packet included in each data block into an RGB value, 4. The application analysis method of claim 3, further comprising: generating a first packet image composed of pixels corresponding to a capacity of the first data block based on a hex code of a packet included in the first data block.

5. The application analysis method of claim 4 , wherein the preset capacity is 1024 bytes, and the pixels corresponding to the capacity of the first data block are 32×32 pixels.

6. training a deep learning model to determine an application of a packet image based on the plurality of packet images and metadata corresponding to the plurality of packet images; The method of claim 1 , further comprising: labeling and grouping applications of each of the plurality of packet images.

7. training a deep learning model to determine an application of a packet image based on the plurality of packet images and metadata corresponding to the plurality of packet images; classifying the plurality of packet images by characteristics based on metadata corresponding to the plurality of packet images; and The method of claim 6, further comprising: labeling a packet image corresponding to a particular characteristic with the particular characteristic.

8. 8. The application analysis method of claim 7, wherein the characteristic is one of an application category type of packet data, a method type if the application is HTTP, a content type if the application is HTTP, or a TLS version if the application is TLS.

9. A computer-readable recording medium having recorded thereon a program for causing a computer to execute the method according to any one of claims 1 to 8.

10. In the application analysis device, Communications Department; memory; and a processor; The processor: An application analysis device that generates a plurality of packet images based on packets transmitted through a network, trains a deep learning model to determine an application of the packet images based on the plurality of packet images and metadata corresponding to the plurality of packet images, collects packet data transmitted through the network in real time, converts the packet data into packet images, and inputs metadata information of the packet images and the packet data into the deep learning model to determine an application of the packet data.

Images