A method for detecting abnormal behavior by analyzing network activity from multiple perspectives, and an electronic device for performing this analysis.
A neural network-based method for analyzing network activity addresses the limitations of pattern-based and machine learning systems by providing comprehensive detection of abnormal user behavior across scenarios, enhancing threat detection accuracy and reducing false positives.
Patent Information
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- クワッド マイナー カンパニー リミテッド
- Filing Date
- 2025-09-26
- Publication Date
- 2026-05-07
AI Technical Summary
Existing network security systems struggle to detect Zero-Day Attacks and unknown attack methods due to pattern-based detection limitations, and machine learning-based methods face issues with over-generalization and high false detection rates.
A method for detecting abnormal behavior by analyzing network activity through multifaceted analysis using a pre-trained neural network, specifically an RNN Autoencoder, which processes packet information and statistical data to identify abnormal user behavior across various scenarios without requiring separate data collection and preprocessing.
Enables effective detection of abnormal user behavior from multiple perspectives, reducing the need for repetitive data collection and preprocessing, and improving the accuracy of identifying unknown threats.
Smart Images
Figure 2026075055000001_ABST
Abstract
Description
Technical Field
[0001] This application relates to a method for comprehensively analyzing network behaviors to detect abnormal behaviors and an electronic device for performing the same.
Background Art
[0002] Existing systems often use IDS (Intrusion Detection System) network security equipment to detect abnormal user behaviors. Among them, the detection pattern grammar of Snort is a common pattern used by CERT (Computer Emergency Response Team) incident response teams worldwide and has been popularized. However, such a pattern-based detection method can detect known attacks but cannot detect Zero-Day Attacks or unknown attack methods targeting specific targets.
[0003] Once attack techniques become known to the public and detection methods emerge as patterns, there will be various derived attack techniques that bypass existing attack patterns or use other strings to avoid detection. Therefore, in addition to pattern-based detection methods, statistical methods have also been used to approach the detection of unknown attacks.
[0004] There is a method for detecting insider threats based on machine learning, such as the prior literature "Machine Learning-Based Insider Threat Detection Technique: Detecting Abnormal Behaviors Using RNN Autoencoder", but there is a problem of over-generalizing user behaviors. Therefore, due to the lack of clarity in user behaviors, a further procedure for verifying the results detected by this method is required, and there is a problem of a high false detection rate.
[0005] Along with this, there is a need for a method that can detect abnormal behaviors through a comprehensive analysis of user behaviors.
[0006] [Prior art document]
[0007] [Non-patent literature]
[0008] Machine Learning-Based Insider Threat Detection Techniques: Anomaly Detection Using RNN Autoencoders (https: / / doi.org / 10.13089 / JKIISC.2017.27.4.763) [Overview of the project] [Problems that the invention aims to solve]
[0009] One problem that this invention aims to solve is to detect abnormal behavior by users by analyzing network activity from multiple perspectives.
[0010] One problem that this invention aims to solve is to obtain training data or input data for determining abnormal behavior based on various behavior analysis scenarios, without having to perform data collection and data preprocessing for each of the various behavior analysis scenarios.
[0011] The problems that this invention aims to solve are not limited to those described above, and any problems not mentioned can be clearly understood by a person with ordinary skill in the art to which this invention pertains from this specification and the accompanying drawings. [Means for solving the problem]
[0012] A method for detecting abnormal behavior by multifaceted analysis of network activity using an electronic device according to one embodiment of the present invention may include the steps of: acquiring transmitted and received packets; analyzing the acquired packets to generate packet information; generating statistical information for a predetermined period based on the generated packet information; extracting scenario data corresponding to each of a plurality of behavior analysis scenarios using the packet information and statistical information; inputting the scenario data into a pre-trained neural network and confirming the result value; and determining the user's abnormal behavior based on the result value.
[0013] An electronic device for detecting abnormal behavior by multifaceted analysis of network behavior according to one embodiment of the present invention includes a communication unit for sending and receiving packets over a network, a memory, and a processor. The processor acquires the transmitted and received packets, analyzes the acquired packets to generate packet information, generates statistical information for a preset period based on the generated packet information, extracts scenario data corresponding to each of a plurality of behavior analysis scenarios from the packet information and statistical information, inputs the scenario data into a pre-trained neural network to check the result value, and can determine the abnormal behavior of the packet based on the result value.
[0014] The means of solving the problems of the present invention are not limited to the means described above, and means of solving that are not mentioned can be clearly understood by a person skilled in the art to which the present invention pertains from this specification and the accompanying drawings. [Effects of the Invention]
[0015] According to one embodiment of the present invention, abnormal behavior by a user can be detected by analyzing network activity from multiple perspectives.
[0016] According to one embodiment of the present invention, in order to extract learning data or input data for determining abnormal behavior based on various behavior analysis scenarios using pre-processed data, it is not necessary to perform data collection and data preprocessing for each of the various behavior analysis scenarios. [Brief explanation of the drawing]
[0017] [Figure 1] This is a simplified block diagram illustrating the configuration of an electronic device according to one embodiment of this application. [Figure 2] This is a simplified block diagram illustrating the configuration of a processor according to one embodiment of this application. [Figure 3] This is a drawing illustrating a method for generating packet information according to one embodiment of this application. [Figure 4] This is a diagram illustrating a method for generating statistical information according to one embodiment of this application. [Figure 5] This diagram illustrates a method for training a neural network corresponding to each of multiple behavioral analysis scenarios according to one embodiment of this application. [Figure 6] This is a diagram illustrating a method for detecting abnormal user behavior according to one embodiment of this application. [Figure 7] This is a flowchart illustrating a method for detecting abnormal behavior by multifaceted analysis of network activity according to one embodiment of this application. [Modes for carrying out the invention]
[0018] The aforementioned objectives, features, and advantages of this application will become clearer through the following detailed description in relation to the attached drawings. However, since this application can be modified in various ways and has various embodiments, specific embodiments will be illustrated in the drawings below and described in detail.
[0019] Throughout the specification, the same reference numerals generally denote the same components. Also, components with the same functions within the same conceptual scope shown in the drawings of each embodiment are described using the same reference signs, and redundant explanations thereof will be omitted.
[0020] If it is determined that a detailed description of known functions or configurations related to the present application may potentially obscure the gist of the present application unnecessarily, the detailed description thereof will be omitted. Also, the numbers (e.g., first, second, etc.) used in the process of the description in this specification are merely identification symbols for distinguishing one component from other components.
[0021] Also, the suffixes "module" and "unit" for the components used in the following embodiments are given or mixed only in consideration of the ease of preparing the specification, and do not have distinct meanings or roles that distinguish them from each other by themselves.
[0022] In the following embodiments, the singular form includes the plural form unless the context clearly dictates otherwise.
[0023] In the following embodiments, terms such as "comprising" or "having" mean that the features or components described in the specification exist, and do not preclude the possibility of adding one or more other features or components in advance.
[0024] In the drawings, the sizes of the components may be exaggerated or reduced for the convenience of explanation. For example, the sizes and thicknesses of each configuration shown in the drawings are arbitrarily shown for the convenience of explanation, and the present invention is not necessarily limited to what is shown.
[0025] If a particular embodiment can be implemented separately, the order of a specific process may be performed differently from the order described. For example, two processes described consecutively may be performed substantially simultaneously, or may proceed in the order opposite to the described order.
[0026] In the following embodiments, when we say that components are connected, this includes not only cases where components are directly connected, but also cases where components are indirectly connected with other components interposed between them.
[0027] For example, when we refer to components being electrically connected in this specification, this includes not only cases where components are directly electrically connected, but also cases where components are interposed in between and the components are indirectly electrically connected.
[0028] On the other hand, in this specification, multifaceted analysis of network behavior may mean determining network behavior based on multiple behavior analysis scenarios. In this case, multiple behavior analysis scenarios may include an overall behavior analysis scenario, an application-specific behavior analysis scenario, an attachment-specific behavior analysis scenario, and an email-specific behavior analysis scenario. An overall behavior analysis scenario may represent the traffic and behavior generally generated by each IP address, based on statistics of all data generated during a specific period (e.g., one day) using the origin IP address as the basis. An application-specific behavior analysis scenario may represent the usage status of each application by IP address, based on statistics of application behavior generated during a specific period using the origin IP address as the basis. An attachment-specific behavior analysis scenario may represent the usage status of attachments by IP address, based on statistics of attachment upload / download activity generated during a specific period using the origin IP address as the basis. An email-specific behavior analysis scenario may represent the usage status of each email service by representing statistics of email receiving / sending activity generated during a day using the origin IP address as the basis. The behavior analysis scenarios are examples and may be added / modified / deleted.
[0029] The following describes a method for detecting abnormal network activity by performing a multifaceted analysis of network activity, and an electronic device for carrying out this analysis, with reference to Figures 1 to 8.
[0030] Figure 1 is a simplified block diagram illustrating the configuration of an electronic device according to one embodiment of this application. Referring to Figure 1, the electronic device 100 may include a communication unit 110, a processor 120, and a memory 130.
[0031] The communication unit 110 can assist in establishing a direct (wired) communication channel or a wireless communication channel between the device 100 and an external device (e.g., a server), and in carrying out communication through the established communication channel. The communication unit 110 operates independently of the processor 120 (e.g., an application processor) and may include one or more communication processors that support direct (e.g., wired) communication or wireless communication. According to one embodiment, the communication unit 110 may include a wireless communication module (e.g., a cellular communication module, a short-range wireless communication module, or a GNSS (global navigation satellite system) communication module) or a wired communication module (e.g., a LAN (local area network) communication module, or a power line communication module).
[0032] The communication unit 110 can send and receive packets over the network. For example, when connecting to a website, the communication unit 110 can establish a session and send and receive packets.
[0033] The processor 120 can execute software to control at least one other component (e.g., hardware or software component) of the device 100 connected to the processor 120, and can perform various data processing and calculations. According to one embodiment, as at least part of the data processing or calculation, the processor 120 can store instructions or data received from other components (e.g., communication unit 110) in volatile memory, process the instructions or data stored in volatile memory, and store the resulting data in non-volatile memory. According to one embodiment, the processor 120 may include a main processor (e.g., a central processing unit or application processor) or auxiliary processors that can operate independently or together with it (e.g., a graphics processing unit, a neural network processing unit (NPU), an image signal processor, a sensor hub processor, or a communication processor).
[0034] According to one embodiment, an auxiliary processor (e.g., a neural network processing unit) may include a hardware structure specialized for processing the artificial intelligence model. The artificial intelligence model may be performed on the electronic device 100 itself, or it may be performed through a separate server. The learning algorithm may include, but is not limited to, supervised learning, unsupervised learning, semi-supervised learning, or reinforcement learning. The artificial intelligence model may include multiple artificial neural network layers. The artificial neural network may be a deep neural network (DNN), convolutional neural network (CNN), recurrent neural network (RNN), restricted Boltzmann machine (RBM), deep belief network (DBN), bidirectional recurrent deep neural network (BRDNN), deep Q-networks, or one of two or more combinations of the above, but is not limited to the examples above. In addition to the hardware structure, the artificial intelligence model may additionally or alternatively include a software structure.
[0035] The processor 120 can acquire packets sent and received over the network during a specific period of time. This specific period can be set to a time sufficient to collect learning data for determining the normal behavior of the user. For example, the processor 120 can acquire packets sent and received over the network of company A during a specific period (e.g., 90 days) sufficient to determine which applications are frequently used by employees of company A, the types and number of applications, the number of file uploads, the IP addresses to which they connect, the number of file downloads, etc.
[0036] The processor 120 can analyze acquired packets and generate packet information. In one embodiment, the processor 120 can parse acquired packets using a first parser (e.g., a packet parser). The processor 120 can then generate packet information, which is information about packets that can be temporarily extracted by parsing the acquired packets. For example, the packet information generated using the first parser may include UTC time information, IP information, port information, and packet size information. In one embodiment, the remaining information, excluding the information analyzed using the first parser, can be transmitted to a second parser (e.g., a contents parser). The processor 120 can use the second parser to combine the data contained in the packets and generate packet information. For example, the packet information generated using the second parser may include file information attached to an email, attachment information uploaded at the origin IP address, and so on.
[0037] The processor 120 can generate statistical information for a predetermined period based on the packet information. Specifically, the processor 120 can classify the information contained in the packet information for a predetermined period and generate statistical information by calculating statistics for the classified information. For example, the statistical information may include information on the number of packets generated by a specific origin IP during a predetermined period (e.g., one day), the number of packets generated by target IPs that communicated with a specific origin IP, the number of target IPs that communicated with a specific origin IP, the number of uploads (or downloads) generated by a specific origin IP, and the number of times an email was received (or sent) by a specific origin IP.
[0038] The processor 120 can extract scenario data corresponding to each of multiple behavioral analysis scenarios from packet information and statistical information. For example, multiple behavioral analysis scenarios may include an overall behavioral analysis scenario, an application-specific behavioral analysis scenario, an attachment-specific behavioral analysis scenario, and an email-specific behavioral analysis scenario. As an example, the processor 120 can extract information from packet information and statistical information regarding the date, IP address, the number of packets generated at the relevant IP address, and the application number generated at the relevant IP address to extract scenario data for the overall behavioral analysis scenario.
[0039] The processor 120 can input scenario data into a pre-trained neural network and check the resulting values. Here, the scenario data can include some information from packet information and statistical information. The processor 120 can then input the scenario data extracted by each action analysis scenario into the neural network. The neural network is trained using an autoencoder composed of a recurrent neural network (RNN), and when scenario data is input into the pre-trained neural network, a loss value can be output as the final result.
[0040] The processor 120 can determine abnormal behavior by the user based on the output values of the neural network. For example, the processor 120 can calculate a loss value by comparing the output values of the neural network with the input values. Here, the input values may be values obtained by vectorizing scenario data extracted from packet information and statistical information, and the result values may be the output values of the RNN Autoencoder. The processor 120 can then determine that abnormal behavior has occurred if any of the individual loss values exceed a critical value. Alternatively, the processor 120 may determine that abnormal behavior has occurred if the sum of the individual loss values exceeds a critical value.
[0041] The processor 120 can train a neural network by extracting training data corresponding to each of multiple behavioral analysis scenarios from the packet information and statistical information of packets sent and received during a specific period. Specifically, the processor 120 can train a neural network by extracting first training data, which is a part of the packet information and statistical information. Then, the processor 120 can train a neural network by extracting second training data from the same packet information and statistical information. For example, to train a neural network corresponding to an overall behavioral analysis scenario, the processor 120 can extract information such as the date, IP address, the number of packets generated at the IP address, and the number of applications generated at the IP address from the packet information and statistical information on a date-by-date basis and use it as training data. For example, to train a neural network corresponding to an application-specific behavioral analysis scenario, the processor 120 can extract information such as the date, IP address, the number of packets generated at the IP address, and the application number generated at the IP address from the packet information and statistical information on a date-by-date basis and use it as training data. In other words, by extracting information corresponding to each scenario from packet information and statistical information transmitted and received over a specific period and training the neural network, it is possible to train a neural network for multiple behavioral analysis scenarios without having to perform data collection and data preprocessing for each behavioral analysis scenario. On the other hand, although it has been explained as training a single neural network for convenience, it is obvious that it is possible to train multiple neural networks corresponding to each of the multiple behavioral analysis scenarios.
[0042] The memory 130 can store various types of data used by at least one component of the electronic device 100 (e.g., the processor 120). This data may include, for example, software and input or output data for associated instructions. The memory 130 may include volatile or non-volatile memory.
[0043] Memory 130 can store all packet data collected through the NIC (network interface controller).
[0044] Memory 130 can store packet information and statistical data generated based on that packet information.
[0045] Figure 2 is a simplified block diagram illustrating the configuration of a processor according to one embodiment of this application. Figure 2 will be described in more detail with reference to Figures 3 to 6. Figure 3 is a diagram illustrating a method for generating packet information according to one embodiment of this application. Figure 4 is a diagram illustrating a method for generating statistical information according to one embodiment of this application. Figure 5 is a diagram illustrating a method for training a neural network corresponding to each of multiple behavior analysis scenarios according to one embodiment of this application. Figure 6 is a diagram illustrating a method for detecting abnormal behavior in packets according to one embodiment of this application.
[0046] Referring to Figure 2, the processor 120 may include a packet information generation unit 121, a statistical information generation unit 123, and an abnormal behavior determination unit 125.
[0047] The packet information generation unit 121 can generate packet information for packets transmitted and received over the network. Specifically, as shown in Figure 3, a packet sensor can collect packet data through a network interface controller (NIC) and save it to disk. The packet information generation unit 121 can read the saved packets using a first parser (e.g., a packet parser), parse them, and generate packet information such as IP information, port information, application information, and packet size information. Then, the packet information generation unit 121 can use a second parser (e.g., a contents parser) to combine the remaining information, excluding the information analyzed by the first parser, with the data contained within the packets to generate packet information such as uploaded files and email attachments. On the other hand, packet information can be stored as a constant value for vectorization.
[0048] The statistical information generation unit 123 can generate statistical information for a predetermined period based on packet information. Specifically, the statistical information generation unit can generate statistical information by calculating user activity statistics for each IP address of the acquired packets and for each predetermined period. For example, the statistical information may include information such as the number of packets generated on 1.1.1.1 IP address on 2024.1.1, the number of uploads (or downloads), the number of emails received (or sent), and the type or number of applications generated. The statistical information may be generated by a predetermined period (for example, by date if the predetermined period is 1 day) and by IP address. For example, as shown in Figure 4, the statistical information generation unit 123 can analyze packet information, calculate statistics, and generate statistical information (for example, daily statistical data). On the other hand, the statistical information may be stored as a constant value for vectorization, and Table 1 below shows examples of packet information and statistical information.
[0049] [Table 1]
[0050] The abnormal behavior determination unit 125 can extract scenario data corresponding to each of multiple behavior analysis scenarios from packet information and statistical information. The abnormal behavior determination unit 125 can then input the scenario data into a pre-trained neural network and check the result value. The abnormal behavior determination unit 125 then compares the result value with the input value to calculate a loss value and uses the loss value to determine abnormal behavior.
[0051] Specifically, the abnormal behavior determination unit 125 extracts scenario data corresponding to each of multiple behavior analysis scenarios from packet information and statistical information, and inputs the extracted scenario data into a neural network to confirm the result value. For example, as shown in Figure 4, the abnormal behavior determination unit 125 can extract scenario data for overall behavior analysis, scenario data for application-specific behavior analysis, scenario data for attachment behavior analysis, and scenario data for email-specific behavior analysis. The scenario data extracted for each behavior analysis scenario may be as shown in Table 2 below.
[0052] [Table 2]
[0053] At this time, the neural network can be composed of an RNN Autoencoder, and the abnormal behavior determination unit 125 can vectorize the scenario data extracted for each behavior analysis scenario and input it into the RNN Autoencoder to obtain result values. The abnormal behavior determination unit 125 can then input the input values and the obtained result values into a loss function to calculate the loss value. As shown in Figure 5, the abnormal behavior determination unit 125 can calculate the loss value for each of the multiple behavior analysis scenarios.
[0054] The abnormal behavior determination unit 125 can then determine the user's abnormal behavior based on the loss values corresponding to each behavior analysis scenario. For example, as shown in Figure 6, the abnormal behavior determination unit 125 can determine that the user has engaged in abnormal behavior if the loss values exceed a critical value. In this case, the loss values exceeding the critical value may mean that there are loss values among the loss values that exceed the critical value, or that the sum of the loss values exceeds the critical value.
[0055] Figure 7 is a flowchart illustrating a method for detecting abnormal behavior by multifaceted analysis of network activity according to one embodiment of this application. The order of operations in Figure 7 is not restricted, and other operations may be performed between two adjacent operations. Also, at least some of the operations in Figure 7 may be omitted. In this invention, the expression that the electronic device 100 performs a specific operation may mean that the processor 120 of the electronic device 100 performs a specific operation, or that the processor 120 controls other hardware to perform a specific operation.
[0056] Referring to Figure 7, the electronic device 100 can acquire the transmitted and received packets (S1000). Specifically, the electronic device 100 can use a packet sensor to collect all packet data through the NIC and save it to disk.
[0057] The electronic device 100 can analyze the acquired packets and generate packet information (S2000). The electronic device 100 can parse the acquired packets using a first parser (e.g., packet parser). Then, the electronic device 100 can generate packet information, which is information about packets that can be temporarily extracted by parsing the acquired packets. The electronic device 100 can use a second parser (e.g., contents parser) to generate packet information by combining the remaining information after removing the information analyzed using the first parser.
[0058] The electronic device 100 can generate statistical information for a predetermined period based on packet information (S3000). Specifically, the electronic device 100 can classify the information contained in the packet information during the predetermined period and generate statistical information by calculating statistics for the classified information. For example, the electronic device 100 can generate statistical information by calculating statistics on user activity by date and IP address.
[0059] The electronic device 100 can extract scenario data corresponding to each of multiple behavioral analysis scenarios from packet information and statistical information (S4000). Specifically, the electronic device 100 can extract scenario data from packet information and statistical information according to each behavioral analysis scenario.
[0060] The electronic device 100 can input scenario data into a pre-trained neural network and check the resulting value (S5000). The neural network is trained using an autoencoder composed of a recurrent neural network (RNN), and when scenario data is input into the pre-trained neural network, a loss value can ultimately be output.
[0061] The electronic device 100 can determine abnormal user behavior based on the result values (S5000). For example, the electronic device 100 can calculate a loss value by comparing the result values output by the neural network with the input values. Here, the input values may be values obtained by vectorizing scenario data extracted from packet information and statistical information, and the result values may be the output values of the RNN Autoencoder. The electronic device 100 can then determine that abnormal user behavior has occurred if any of the individual loss values exceed a critical value. Alternatively, the electronic device 100 may determine that abnormal user behavior has occurred if the sum of the individual loss values exceeds a critical value.
[0062] Consequently, by extracting and analyzing scenario data for multiple behavioral analysis scenarios using the same pre-processed data, it becomes possible to perform a multifaceted analysis of user behavior and identify abnormal behavior.
[0063] The features, structures, and effects described in the embodiments above are included in at least one embodiment of the present invention and are not necessarily limited to just one embodiment. Furthermore, the features, structures, and effects exemplified in each embodiment can be combined or modified and implemented in other embodiments by a person with ordinary skill in the art to which the embodiment belongs. Therefore, it should be interpreted that such combinations and modifications are included within the scope of the present invention.
[0064] Furthermore, although the above description has focused on embodiments, these are merely illustrative examples and do not limit the present invention. Those with ordinary skill in the art to which the present invention belongs will understand that various modifications and applications not exemplified above are possible without departing from the essential characteristics of these embodiments. In other words, each component specifically shown in the embodiments can be modified and implemented. And any differences related to such modifications and applications should be interpreted as being included within the scope of the present invention as defined in the appended claims. [Explanation of symbols]
[0065] 100:Electronic equipment 110: Communications Department 120: Processor 130: Memory
Claims
1. In a method in which an electronic device analyzes network behavior from multiple perspectives to detect abnormal behavior, The stage of acquiring packets that are being sent or received; The stage of analyzing acquired packets and generating packet information; The stage of generating statistical information for a predetermined period based on the generated packet information; The step of extracting scenario data corresponding to each of the multiple behavioral analysis scenarios from the aforementioned packet information and statistical information; The step of inputting the scenario data into a pre-trained neural network and checking the resulting values; A multifaceted analytical method for detecting abnormal behavior, including the step of determining the user's abnormal behavior based on the aforementioned result values.
2. The step of analyzing the acquired packets and generating packet information is: The multifaceted analysis-based anomaly detection method according to claim 1, comprising parsing the acquired packets to generate IP information, port information, application information, and packet size information for the packets.
3. The step of generating statistical information for a predetermined period based on the generated packet information is: The multifaceted analysis-based abnormal behavior detection method according to claim 2, comprising classifying the information contained in the packet information during the predetermined period, and generating statistical information by deriving statistics from the classified information.
4. The multifaceted analysis-based anomaly detection method according to claim 1, further comprising the step of training the neural network based on a portion of the packet information and statistical information of packets transmitted and received during a specific period.
5. The step of training the aforementioned neural network is as follows: The step of extracting learning data corresponding to each of the multiple behavioral analysis scenarios from the aforementioned packet information and statistical information; and The multifaceted analysis-based anomaly detection method according to claim 4, comprising the step of training the neural network based on the training data.
6. The step of training the aforementioned neural network is as follows: A multifaceted analysis-based abnormal behavior detection method according to claim 5, which utilizes an autoencoder composed of a recurrent neural network (RNN).
7. The step of determining abnormal behavior by the user based on the aforementioned result values is: The multifaceted analysis-based abnormal behavior detection method according to claim 1, wherein if there is a value that exceeds a critical value among the loss values for the input and result values of the scenario data corresponding to each of the multiple behavior analysis scenarios, it is detected as abnormal behavior.
8. The multifaceted analysis-based abnormal behavior detection method according to claim 1, wherein the plurality of behavior analysis scenarios include an overall behavior analysis scenario, an application-specific behavior analysis scenario, an attachment-specific behavior analysis scenario, and an email-specific behavior analysis scenario.
9. A computer-readable recording medium having a program stored on it that causes a computer to perform the method described in any one of claims 1 to 8.
10. In an electronic device that detects abnormal behavior by analyzing network activity from multiple perspectives, A communication unit that sends and receives packets over a network; memory; and Processor; including, The aforementioned processor, Capture the packets being sent and received, The acquired packets are analyzed to generate packet information, Based on the generated packet information, statistical information for a predetermined period is generated. Using the packet information and statistical information, scenario data corresponding to each of the multiple behavioral analysis scenarios is extracted. The scenario data is input into a pre-trained neural network, and the resulting values are checked. An electronic device that determines abnormal behavior of the packet based on the aforementioned result value.