A method for detecting abnormal activity by analyzing network activity on a terminal-by-terminal basis, and an electronic device for performing this.

Abstract

This invention provides a method and electronic device for performing this method, which can detect higher-level security threats by combining flows acquired through a network on a terminal-by-terminal basis. [Solution] A method for detecting abnormal activity by analyzing terminal-specific network activity using an electronic device according to one embodiment of this application is characterized by including the steps of: acquiring packets transmitted and received through a network to acquire a flow for a specific period of time; generating terminal-specific flow data for a plurality of terminals connected to the network; performing hybrid sampling on the generated terminal-specific flow data to train a neural network; and identifying an abnormal terminal among the plurality of terminals based on the trained neural network. According to one embodiment of the present invention, security threats can be detected at a higher level by combining the flows acquired through the network on a terminal-by-terminal basis.

Description

Technical Field

[0001] This application relates to a method for analyzing network behaviors for each terminal to detect abnormal behaviors and an electronic device for executing the same. Specifically, this application relates to a method for detecting a user's abnormal behavior by classifying flows transmitted and received through a network for each terminal, analyzing the network behaviors for each terminal, and detecting an abnormal terminal, and an electronic device for executing the same.

[0002] This application is a research result conducted with the support of the Institute of Information & Communication Technology Planning & Evaluation under the 2024 government (Ministry of Science and ICT) funding (No. RS-2024-00354169, Detection / Countermeasure of Network Abnormal Behavior Based on Threat Model / XAI Infrastructure and Development of Cyber Threat Prediction Technology)

[0003] This work was supported by the Institute of Information & Communication Technology Planning & Evaluation(IITP) grant funded by the Korea government(MSIT)(No.RS-2024-00354169 Detection / Countermeasure of Network Abnormal Behavior Based on Threat Model / XAI Infrastructure and Development of Cyber Threat Prediction Technology)

Background Art

[0004] Recently, with the rapid increase in the amount of traffic transmitted through the network, the importance of technologies for effectively detecting and responding to various security threats that can occur on the network has been increasing. Traditional security solutions analyze only a part of the traffic to detect abnormal behaviors, which has made it difficult to effectively respond in a complex network environment. In particular, there is a growing need for technologies that can combine multiple traffic flows to detect higher-level security threats.

[0005] Furthermore, in large-scale network environments, abnormal traffic data occurs relatively less frequently than normal traffic data, and this data imbalance can lead to a decrease in the performance of anomaly detection systems. Therefore, there is a growing need for technologies to resolve this data imbalance. [Prior art documents] [Patent Documents]

[0006] [Patent Document 1] Korean Registered Patent Publication No. 10-2032249 [Overview of the project] [Problems that the invention aims to solve]

[0007] One problem that this invention aims to solve is to provide a method and electronic device for performing a higher level of security threat by combining flows acquired through a network on a terminal-by-terminal basis.

[0008] One problem that the present invention aims to solve is to provide a method for reducing the dimensionality of a coupled flow so that the coupled flow is easier to use for machine learning, and an electronic device for performing this.

[0009] Furthermore, one problem that the present invention aims to solve is to provide a method for performing data hybrid sampling and an electronic device for performing it, in order to prevent a decrease in the performance of an abnormal behavior detection system due to an imbalance between normal and abnormal data.

[0010] The problems that this invention aims to solve are not limited to those described above, and any problems not mentioned should be clearly understood by a person with ordinary skill in the art to which this invention pertains from this specification and the accompanying drawings. [Means for solving the problem]

[0011] A method for detecting abnormal activity by analyzing terminal-specific network activity using an electronic device according to one embodiment of the present invention may include the steps of: acquiring packets transmitted and received through the network to acquire a flow for a specific period of time; generating terminal-specific flow data for a plurality of terminals connected to the network; performing hybrid sampling on the generated terminal-specific flow data to train a neural network; and identifying an abnormal terminal among the plurality of terminals based on the trained neural network.

[0012] An electronic device for detecting abnormal activity by analyzing terminal-specific network activity according to one embodiment of the present invention includes a communication unit for sending and receiving packets over a network, a memory, and a processor. The processor acquires packets sent and received over the network to acquire the flow over a specific period, generates terminal-specific flow data for a plurality of terminals connected to the network, performs hybrid sampling on the generated terminal-specific flow data to train a neural network, and can identify abnormal terminals among the plurality of terminals based on the trained neural network.

[0013] The means of solving the problems of the present invention are not limited to the means described above, and means of solving that are not mentioned should be clearly understood by a person with ordinary skill in the art to which the present invention pertains from this specification and the accompanying drawings. [Effects of the Invention]

[0014] According to one embodiment of the present invention, flows acquired through the network can be combined on a terminal-by-terminal basis to detect security threats at a higher level.

[0015] Furthermore, according to one embodiment of the present invention, the dimensionality of the combined flow can be reduced so that the combined flow is easier to machine learn.

[0016] Also, according to an embodiment of the present invention, data hybrid sampling can be performed to prevent performance degradation of an abnormal behavior detection system due to imbalance between normal data and abnormal data.

Brief Description of Drawings

[0017] [Figure 1] It is a system diagram of an abnormal behavior detection system according to an embodiment of the present application. [Figure 2] It is a block diagram briefly showing the configuration of an electronic device according to an embodiment of the present application. [Figure 3] It is a block diagram briefly showing the configuration of a processor according to an embodiment of the present application. [Figure 4] It is a diagram for explaining a method of generating learning data by performing hybrid sampling on per-terminal flow data according to an embodiment of the present application. [Figure 5] It is a flowchart for explaining a method of analyzing per-terminal network behavior and detecting abnormal behavior according to an embodiment of the present application. [Figure 6] It is a flowchart for explaining a method of generating per-terminal flow data according to an embodiment of the present application. [Figure 7] It is a flowchart for explaining a method of performing hybrid sampling on per-terminal flow data according to an embodiment of the present application.

Modes for Carrying Out the Invention

[0018] The above-mentioned objects, features, and advantages of the present application will become clearer through the following detailed description in connection with the accompanying drawings. However, the present application can be subjected to various modifications and can have various embodiments. Hereinafter, specific embodiments are illustrated in the drawings and will be described in detail.

[0019] Throughout the specification, the same reference numerals generally denote the same components. Also, components with the same functions within the scope of the same concept shown in the drawings of each embodiment are described using the same reference signs, and redundant explanations thereof are omitted.

[0020] If it is determined that a specific description of a known function or configuration related to the present application obscures the gist of the present application unnecessarily, the detailed description thereof is omitted. Also, the numbers used in the description process of this specification (for example, first, second, etc.) are merely identification symbols for distinguishing one component from other components.

[0021] Also, the suffixes "module" and "unit" for the components used in the following embodiments are given or mixed only in consideration of the ease of preparing the specification, and do not have a meaning or role that distinguishes them from each other as such.

[0022] In the following embodiments, the singular form includes the plural form unless the context clearly indicates a different meaning.

[0023] In the following embodiments, terms such as "comprising" or "having" mean that the features or components described in the specification exist, and do not preclude the possibility of adding one or more other features or components in advance.

[0024] In the drawings, the sizes of the components may be exaggerated or reduced for the convenience of explanation. For example, the sizes and thicknesses of each configuration shown in the drawings are arbitrarily shown for the convenience of explanation, and the present invention is not necessarily limited by the drawings shown.

[0025] [[ID={24}]]When a certain embodiment can be implemented separately, the order of a specific process may be different from the order described. For example, two processes described continuously may be performed substantially simultaneously, or may proceed in the order opposite to the described order.

[0026] [[ID=2{7}]] In the following embodiments, when we say that components are connected, this includes not only cases where components are directly connected, but also cases where components are indirectly connected through the interposition of components.

[0027] For example, when we refer to components being electrically connected in this specification, it includes not only cases where components are directly electrically connected, but also cases where components are interposed and the electrical connection is indirect.

[0028] On the other hand, in this specification, "flow" may mean the sequence through which data packets are transmitted. Specifically, a flow may be a bundle of packets sent and received between a terminal and a network. For example, a flow may include information such as source IP, destination IP, protocol, transmission speed, packet size, and flow duration.

[0029] The following describes a method for analyzing network activity on a terminal-by-terminal basis to detect abnormal activity, and an electronic device for performing this method, with reference to Figures 1 to 7.

[0030] Figure 1 is a system diagram of an abnormal behavior detection system according to one embodiment of the present application. Referring to Figure 1, multiple terminals 50-1, 50-2, ..., 50-N can send and receive data through the network 10. The electronic device 100 can collect packets sent and received by the multiple terminals 50-1, 50-2, ..., 50-N in real time. The packets collected by the electronic device 100 in real time are a mixture of packets sent and received by the multiple terminals 50-1, 50-2, ..., 50-N. Hereinafter, the multiple terminals 50-1, 50-2, ..., 50-N may refer to terminals connected to the network 10.

[0031] Figure 2 is a simplified block diagram showing the configuration of an electronic device according to one embodiment of the present application. Referring to Figure 2, the electronic device 100 may include a communication unit 110, a processor 120, and a memory 130.

[0032] The communication unit 110 can support the establishment of a direct (wired) communication channel or a wireless communication channel between the electronic device 100 and an external device (e.g., a server), and the execution of communication through the established communication channel. The communication unit 110 may operate independently of the processor 120 (e.g., an application processor) and may include one or more communication processors that support direct (e.g., wired) communication or wireless communication. According to one embodiment, the communication unit 110 may include a wireless communication module (e.g., a cellular communication module, a short-range wireless communication module, or a GNSS (global navigation satellite system) communication module) or a wired communication module (e.g., a LAN (local area network) communication module or a power line communication module).

[0033] The communication unit 110 can send and receive packets over the network. For example, when connecting to a website, the communication unit 110 can establish a session and send and receive packets.

[0034] The processor 120 can execute software to control at least one other component (e.g., hardware or software component) of the electronic device 100 connected to the processor 120, and can perform various data processing and calculations. According to one embodiment, as at least part of the data processing or calculation, the processor 120 can store instructions or data received from other components (e.g., communication unit 110) in volatile memory, process the instructions or data stored in volatile memory, and store the resulting data in non-volatile memory. According to one embodiment, the processor 120 may include a main processor (e.g., central processing unit or application processor) or auxiliary processors (e.g., graphics processing unit, neural network processing unit (NPU), image signal processor, sensor hub processor, or communication processor) that can operate independently or together with it.

[0035] According to one embodiment, the auxiliary processor (e.g., a neural network processing unit) may include hardware structures specialized for processing artificial intelligence models. The artificial intelligence model may be generated through machine learning. Such learning may be performed, for example, on the electronic device 100 on which the artificial intelligence is executed, or through a separate server. The learning algorithm may include, but is not limited to, supervised learning, unsupervised learning, semi-supervised learning, or reinforcement learning. The artificial intelligence model may include multiple artificial neural network layers. The artificial neural network may be a deep neural network (DNN), convolutional neural network (CNN), recurrent neural network (RNN), restricted Boltzmann machine (RBM), deep belief network (DBN), bidirectional recurrent deep neural network (BRDNN), deep Q-networks (DQN), or one of two or more combinations of the above, but is not limited to the examples above. Artificial intelligence models may include software structures in addition to or as an alternative to hardware structures.

[0036] The processor 120 can collect packets sent and received through the network to obtain a flow over a specific period of time. For example, the processor 120 can collect packets originating from the network layer and obtain a flow by utilizing sensors that collect multiple traffic flows on the network in real time. Here, the specific period can be set to a time sufficient to collect training data for determining normal user behavior. For example, the processor 120 can collect packets sent and received through company A's network and obtain a flow over a specific period (e.g., 90 days) sufficient to determine the normal behavior patterns of employees of company A.

[0037] The processor 120 can generate terminal-specific flow data for multiple terminals connected to the network. Specifically, the processor 120 can classify the acquired flows over a specific period into groups based on whether they share the same source IP address or the same destination IP address.

[0038] The processor 120 can generate multiple flow sets by combining flows classified under the same IP in chronological order at regular intervals. Since a flow set is a combination of multiple packets, it is necessary to compress the important features of the data to a low-dimensionality. Therefore, the processor 120 can generate terminal-specific flow data by reducing the dimensionality of multiple flow sets through an autoencoder.

[0039] The processor 120 may train a neural network by performing hybrid sampling on the generated terminal-specific flow data. Specifically, hybrid sampling may mean performing upsampling on some of the flow data and downsampling on other parts of the flow data.

[0040] For example, the processor 120 can classify flow data into normal data and abnormal data based on the terminal from which it was generated. The processor 120 can then perform downsampling on the normal data based on the KNN algorithm (K-Nearest Neighbor classification Algorithm). Specifically, the processor 120 can determine which normal data is similar to the abnormal data, and then perform downsampling on the normal data by deleting the normal data that is similar to the determined abnormal data.

[0041] Furthermore, the processor 120 can perform upsampling on anomalous data based on Borderline-SMOTE (Synthetic Minority Oversampling Technique). Specifically, the processor 120 can determine which anomalous data is at the boundary with normal data, and generate new anomalous data based on the determined anomalous data at the boundary with normal data, and then perform upsampling on the anomalous data.

[0042] The processor 120 can identify abnormal terminals among multiple terminals based on a trained neural network. Specifically, the processor 120 can collect packets acquired in real time and obtain flows. The processor 120 can then categorize the acquired flows by IP and combine the flows corresponding to each IP in chronological order to generate a flow set. The processor 120 can then reduce the dimensionality of the flow set generated through an autoencoder and input it into a trained neural network to identify abnormal terminals.

[0043] In one embodiment, the processor 120 can extract scenario data corresponding to each of multiple behavioral analysis scenarios from the terminal-specific flow data. The processor 120 can then input the extracted scenario data into a trained neural network, check the result value, and identify abnormal terminals based on the result value.

[0044] Specifically, the processor 120 can extract multiple features from each flow and classify and save flows by terminal. For example, the processor 120 can classify and save flows that have the same source IP or destination IP. In this case, multiple behavioral analysis scenarios are saved in advance, and the flow features necessary to determine abnormal behavior may differ for each behavioral analysis scenario.

[0045] For example, to determine abnormal behavior according to a first behavior analysis scenario, the processor 120 can generate a new first flow set by combining flows corresponding to the first behavior analysis scenario within flows classified by terminal. Then, the processor 120 can reduce the dimensionality of the generated first flow set to generate first flow data. Similarly, to determine abnormal behavior according to a second behavior analysis scenario, the processor 120 can generate a new second flow set by combining flows corresponding to the second behavior analysis scenario within flows classified by terminal. Then, the processor 120 can reduce the dimensionality of the generated second flow set to generate second flow data. In this way, the processor 120 can generate flow sets corresponding to multiple behavior analysis scenarios and generate flow data by reducing the dimensionality of the flow sets. The processor 120 can input the flow data into a pre-trained neural network and detect abnormal behavior (or abnormal terminals) through multi-faceted analysis based on multiple behavior analysis scenarios.

[0046] The memory 130 can store various types of data used by at least one component of the electronic device 100 (for example, the processor 120). The data may include, for example, software and input or output data for associated instructions. The memory 130 may include volatile memory or non-volatile memory.

[0047] Memory 130 can store all packet data collected through the NIC (network interface controller).

[0048] A display module (not shown) can visually provide information to an external party (e.g., a user) of the electronic device 100. The display module may include, for example, a display, a hologram device, or a projector, and a control circuit for controlling the device.

[0049] The display module can notify a specific terminal of the detected abnormal behavior.

[0050] Figure 3 is a simplified block diagram showing the configuration of a processor according to one embodiment of the present application. Figure 3 will be described in more detail with reference to Figure 4. Figure 4 is a diagram illustrating a method for generating training data by performing hybrid sampling on terminal-specific flow data according to one embodiment of the present application.

[0051] Referring to Figure 3, the processor 120 may include a flow data generation unit 121, a hybrid sampling unit 123, and an abnormal behavior determination unit 125.

[0052] The flow data generation unit 121 can generate terminal-specific flow data for each of the multiple terminals connected to the network. Specifically, the flow data generation unit 121 can classify flows over a specific period by IP address. Classifying by IP address can mean classifying flows with the same source IP address together or flows with the same destination IP address together. Since each terminal has a shared IP address, classifying flows by IP address can mean classifying flows by terminal.

[0053] The flow data generation unit 121 can analyze and combine the correlations of flows classified by terminal. Specifically, the flow data generation unit 121 can generate multiple flow sets by combining flows classified by terminal in chronological order and in fixed time units or sizes. Specifically, the flow data generation unit 121 can arrange multiple flows corresponding to each terminal in chronological order for multiple terminals and combine them in predetermined time units or by a predetermined number of flows. For example, let's assume that 100 flows corresponding to the first terminal have been acquired. The flow data generation unit 121 can generate 10 flow sets by combining flows in units of 10 starting from the earliest generated flows. Alternatively, the flow data generation unit 121 may generate flow sets by combining flows in 1-hour increments starting from the time the first flow occurred.

[0054] The flow data generation unit 121 can generate flow data for each terminal by reducing the dimensionality of multiple flow sets through an autoencoder (e.g., a stacked autoencoder). Combined flows (i.e., flow sets) may be higher-dimensional data than a single flow because they result in an increase in features. Therefore, the flow data generation unit 121 can generate flow data by converting high-dimensional flow sets to lower dimensions while maintaining the information contained in the flow sets through an autoencoder.

[0055] The hybrid sampling unit 123 can perform hybrid sampling on terminal-specific flow data. Flow data is information collected over a specific period and can be either normal data indicating normal user behavior or abnormal data indicating abnormal user behavior. Abnormal data may occur relatively less frequently than normal data. An imbalance between abnormal and normal data can induce a decrease in the performance of the neural network. To prevent this, the hybrid sampling unit 123 can perform upsampling on abnormal data and downsampling on normal data. As shown in Figure 3, a flow dataset can be constructed in which the imbalance is resolved by performing downsampling on normal data and upsampling on abnormal data within the flow dataset.

[0056] The hybrid sampling unit 123 can perform downsampling on normal data based on the KNN algorithm (K-Nearest Neighbor classification algorithm). Specifically, the hybrid sampling unit 123 can determine normal data that is similar to abnormal data within the normal data, and perform downsampling on the normal data by deleting the normal data that is similar to the determined abnormal data. While it has been explained that the hybrid sampling unit 123 performs downsampling on normal data based on the KNN algorithm, this is merely one example, and there are no restrictions on the downsampling method.

[0057] The hybrid sampling unit 123 can perform upsampling on anomalous data based on Borderline-SMOTE (Synthetic Minority Oversampling Technique). Specifically, the hybrid sampling unit 123 can determine anomalous data located at the boundary with normal data within the anomalous data, generate new anomalous data based on the determined anomalous data at the boundary with normal data, and perform upsampling on the anomalous data. By performing upsampling based on anomalous data located at the boundary with normal data, the data located at the boundary with normal data can be learned more accurately. While the hybrid sampling unit 123 has been described as performing downsampling on anomalous data based on Borderline-SMOTE, this is merely one example, and there are no restrictions on the upsampling method.

[0058] On the other hand, while it has been explained that the hybrid sampling unit 123 performs both downsampling for normal data and upsampling for abnormal data, the hybrid sampling unit 123 may perform only a part of the downsampling or upsampling.

[0059] The abnormal behavior detection unit 125 can train a neural network to identify abnormal terminals based on data upsampled and / or downsampled by the hybrid sampling unit 123. Specifically, the abnormal behavior detection unit 125 can train a neural network (e.g., a support vector machine, a random forest, etc.) to detect abnormal terminals using abnormal and normal data.

[0060] The abnormal behavior detection unit 125 can identify abnormal terminals among multiple terminals based on the trained neural network. Specifically, the abnormal behavior detection unit 125 collects packets acquired in real time to obtain flows and can categorize the acquired flows by IP address. The abnormal behavior detection unit 125 then combines the flows corresponding to each IP address in chronological order to generate flow sets, and can reduce the dimensionality of the flow sets through an autoencoder to generate flow data. The abnormal behavior detection unit 125 then inputs the flow data into the trained neural network to identify abnormal terminals. By categorizing and combining the flows collected through the network by terminal, it is possible to detect abnormal behavior by considering the correlation of flows corresponding to specific terminals. Therefore, the accuracy of detecting abnormal behavior is higher than when detecting abnormal behavior with a neural network trained on a single flow.

[0061] Figure 5 is a flowchart illustrating a method for detecting abnormal behavior by analyzing terminal-specific network behavior according to one embodiment of the present application. The operations in Figure 5 are not restricted in order, and other operations may be performed between two adjacent operations. Also, at least some of the operations in Figure 5 may be omitted. In the present invention, the expression that the electronic device 100 performs a specific operation can mean that the processor 120 of the electronic device 100 performs a specific operation, or that the processor 120 controls other hardware to perform a specific operation.

[0062] Figure 5 will be described in more detail with reference to Figures 6 and 7. Figure 6 is a flowchart illustrating a method for generating terminal-specific flow data according to one embodiment of the present application. Figure 7 is a flowchart illustrating a method for performing hybrid sampling on terminal-specific flow data according to one embodiment of the present application.

[0063] Referring to Figure 5, the electronic device 100 can acquire packets transmitted and received through the network and obtain the flow over a specific period of time (S1000). For example, the electronic device 100 can acquire the flow by collecting packets originating from the network layer using a sensor that collects multiple traffic flows on the network in real time.

[0064] The electronic device 100 can generate terminal-specific flow data for multiple terminals connected to the network (S2000). The flow acquired by the electronic device 100 consists of packets sent and received by multiple terminals, and is therefore not separated by terminal.

[0065] Referring to Figure 6, the electronic device 100 can classify flows acquired during a specific period based on the source IP or destination IP in order to classify flows by terminal (S2100). The electronic device 100 can then combine the flows classified by source IP or destination IP in fixed time units (S2200). The electronic device 100 can then reduce the dimensionality of the multiple flow sets generated through the autoencoder (S2300).

[0066] The electronic device 100 can train a neural network by performing hybrid sampling on the flow data for each generated terminal (S3000). The flow data may include normal data and abnormal data, and an imbalance may occur where there is less abnormal data than normal data.

[0067] Referring to Figure 7, the electronic device 100 can separate the generated terminal-specific flow data into normal data and abnormal data in order to resolve the imbalance between abnormal and normal data (S3100). The electronic device 100 can then perform downsampling on the normal data based on the KNN algorithm (S3200). The electronic device 100 can then perform upsampling on the abnormal data based on Borderline-SMOTE (S3300).

[0068] The electronic device 100 can use hybrid sampled data to train a neural network to detect abnormal terminals.

[0069] The electronic device 100 can identify abnormal terminals among multiple terminals based on a trained neural network (S4000). Specifically, the electronic device 100 can collect packets acquired in real time and obtain flows. The electronic device 100 can then categorize the acquired flows by IP and combine the flows corresponding to each IP in chronological order to generate a flow set. The processor 120 can then reduce the dimensionality of the flow set generated through the autoencoder and input it into the trained neural network to identify abnormal terminals.

[0070] In one embodiment, the electronic device 100 can detect abnormal data through various machine learning algorithms (e.g., support vector machines, random forests, etc.) and analyze abnormal traffic behavior arising from the generated terminal-specific flow data.

[0071] According to one embodiment of the present invention, a method for detecting abnormal behavior by analyzing network activity on a terminal-by-terminal basis, and an electronic device for performing the same, has the advantage of being able to detect abnormal behavior by combining flows acquired through the network on a terminal-by-terminal basis and considering the interrelationships of the flows.

[0072] The features, structures, and effects described above are included in at least one embodiment of the present invention and are not necessarily limited to just one embodiment. Furthermore, the features, structures, and effects exemplified in each embodiment can be combined or modified and implemented in other embodiments by a person with ordinary skill in the art to which the embodiment belongs. Therefore, such combinations and modifications should be interpreted as being included within the scope of the present invention.

[0073] Furthermore, although the above description has focused on embodiments, these are merely illustrative examples and do not limit the present invention. Anyone with ordinary skill in the art to which the present invention belongs will understand that various modifications and applications not exemplified above are possible, as long as they do not deviate from the essential characteristics of these embodiments. In other words, each component specifically shown in the embodiments can be modified and implemented. Such differences relating to modifications and applications should be interpreted as falling within the scope of the present invention as defined in the attached claims. [Explanation of Symbols]

[0074] 100:Electronic equipment 110: Communications Department 120: Processor 130: Memory

Claims

1. In a method in which an electronic device analyzes network activity on a terminal-by-terminal basis to detect abnormal activity, The stage of acquiring packets sent and received over a network and obtaining the flow over a specific period of time; A step of generating terminal-specific flow data for multiple terminals connected to the aforementioned network; The stage of training a neural network by performing hybrid sampling on the generated terminal-specific flow data; and A method for detecting abnormal behavior, characterized by including the step of identifying an abnormal terminal among the plurality of terminals based on a trained neural network.

2. The step of generating terminal-specific flow data for multiple terminals connected to the aforementioned network is as follows: The stage of classifying the flow during a specific period based on the source IP or destination IP; and The abnormal behavior detection method according to claim 1, characterized by comprising the step of generating a plurality of flow sets by combining flows classified for each source IP or destination IP in units of a certain period of time.

3. The step of generating terminal-specific flow data for multiple terminals connected to the aforementioned network is as follows: The abnormal behavior detection method according to claim 2, further comprising the step of reducing the dimensionality of a plurality of flow sets generated through an autoencoder to generate terminal-specific flow data.

4. The stage of training the neural network by performing hybrid sampling on the generated terminal-specific flow data is as follows: The abnormal behavior detection method according to claim 1, characterized by including the step of classifying the generated terminal-specific flow data into normal data and abnormal data.

5. The stage of training the neural network by performing hybrid sampling on the generated terminal-specific flow data is as follows: The abnormal behavior detection method according to claim 4, further comprising the step of performing downsampling on the normal data based on a KNN algorithm (K-Nearest Neighbor classification algorithm).

6. The step of performing downsampling on the normal data based on the KNN algorithm (K-Nearest Neighbor classification algorithm) is: The step of determining which normal data is similar to abnormal data among the normal data; and The abnormal behavior detection method according to claim 5, characterized by including the step of deleting normal data excluding normal data similar to the determined abnormal data.

7. The stage of training the neural network by performing hybrid sampling on the generated terminal-specific flow data is as follows: The abnormal behavior detection method according to claim 4, further comprising the step of performing upsampling on the abnormal data based on Borderline-SMOTE (Synthetic Minority Oversampling Technique).

8. The step of performing upsampling on the anomalous data based on Borderline-SMOTE (Synthetic Minority Oversampling Technique) is: The step of determining which abnormal data is at the boundary with normal data among the aforementioned abnormal data; and The abnormal behavior detection method according to claim 7, characterized by comprising the step of generating new abnormal data based on abnormal data that lies at the boundary with the determined normal data.

9. The step of identifying abnormal terminals among the multiple terminals based on the trained neural network is: The step of extracting scenario data corresponding to each of the multiple action analysis scenarios from the aforementioned terminal-specific flow data; and The step of inputting scenario data into the trained neural network and checking the resulting value; and The abnormal behavior detection method according to claim 1, characterized by including the step of confirming an abnormal terminal based on the result value.

10. A computer-readable recording medium having a program stored on it that causes a computer to execute the abnormal behavior detection method described in any one of claims 1 to 8.

11. In an electronic device that analyzes network activity on a terminal-by-terminal basis to detect abnormal activity, A communication unit that sends and receives packets over a network; memory; and Processor; including, The aforementioned processor, By acquiring packets sent and received over the network, we obtain the flow over a specific period of time. For multiple terminals connected to the aforementioned network, terminal-specific flow data is generated. Hybrid sampling is performed on the generated terminal-specific flow data to train the neural network. An electronic device characterized by identifying an abnormal terminal among the multiple terminals based on a trained neural network.

Images