Method for classifying network traffic and apparatus thereof

Abstract

A method for classifying network traffic is provided according to an embodiment of the present application. The method may include the steps of: extracting a feature vector relating to at least one feature from network traffic; normalizing the feature vector according to the feature; calculating a non-linear similarity between the normalized feature vector and a predetermined boundary vector; calculating a traffic state value by combining the non-linear similarities; and determining the class of the network traffic as one of a normal class and a malicious class based on the traffic state value.

Description

Technology Field

[0001] The present application relates to a method and apparatus for classifying network traffic. Background Technology

[0002] With the advancement of Internet of Things (IoT) technology and the introduction of Software-Defined Networking (SDN), network environments are becoming increasingly complex, leading to a rapid increase in both the volume and variety of network traffic. In such an environment, maintaining network stability and security requires technology capable of rapidly and accurately classifying and responding to legitimate traffic as well as malicious traffic, such as Distributed Denial of Service (DDoS) attacks.

[0003] Conventional network traffic classification technologies primarily rely on analyzing packet header information or detecting specific patterns. However, these methods have limitations in classifying encrypted traffic or new types of attack traffic.

[0004] Recently, attempts have been made to classify traffic using machine learning. However, network traffic data is characterized by high feature dimensions, and there is a problem of scale imbalance where the scale and distribution of data vary for each flow. Furthermore, noise caused by unnecessary or redundant features degrades the classification accuracy of machine learning models and causes processing delays. Therefore, simply applying machine learning models alone makes it difficult to simultaneously satisfy the real-time performance and accuracy required in actual SDN environments. The problem to be solved

[0005] The present application aims to provide a method and apparatus for classifying network traffic. means of solving the problem

[0006] A method for classifying network traffic is provided according to an embodiment of the present application. The method may include the steps of: extracting a feature vector relating to at least one feature from network traffic; normalizing the feature vector according to the feature; calculating a non-linear similarity between the normalized feature vector and a predetermined boundary vector; calculating a traffic state value by combining the non-linear similarities; and determining the class of the network traffic as one of a normal class and a malicious class based on the traffic state value.

[0007] In addition, the normalization step described above can be performed using the mean and standard deviation calculated in advance for each feature from a plurality of network flows included in a training dataset containing normal and malicious classes.

[0008] Additionally, the step of calculating the non-linear similarity may include the step of calculating the distance between the normalized feature vector and the boundary vector, and the step of generating similarity by mapping the distance into a non-linear space.

[0009] In addition, the boundary vector includes a support vector that defines a decision boundary that maximizes the margin between the normal class and the malicious class, and the support vector can be trained in advance using a training dataset.

[0010] Additionally, the method may further include a step of selecting a combination of features to be used for classifying network traffic, and a step of extracting a feature vector based on the selected combination of features may be performed.

[0011] Additionally, the step of selecting the above feature combination may include the step of generating a first feature combination composed of a plurality of features extractable from network traffic, and the step of selecting a second feature combination based on a first correlation between each feature included in the first feature combination and the class and a second correlation between the features.

[0012] Additionally, the step of selecting the second feature combination may be performed based on the correlation-variance contribution calculated to be proportional to the first correlation and inversely proportional to the second correlation.

[0013] Additionally, the step of selecting the above feature combination further includes the step of selecting a third feature combination based on the precision and recall rate of the above second feature combination, and the feature may include the above third feature combination.

[0014] In addition, it may further include a step of executing a policy to set or block the path of the network traffic according to the determined class.

[0015] Additionally, the step of executing the above policy may include the step of transmitting a flow rule for routing the traffic to the data plane when the network traffic is determined to be of a normal class, and the step of transmitting a drop rule for blocking the traffic to the data plane when the network traffic is determined to be of a malicious class.

[0016] A computer program is provided according to an embodiment of the present application. The program may be stored on a recording medium to execute a method according to an embodiment of the present application.

[0017] According to an embodiment of the present application, a network traffic classification device is provided. The device may include a memory in which a program for classifying network traffic is stored, and a processor that, by executing the program, extracts a feature vector relating to at least one feature from the network traffic, normalizes the feature vector according to the feature, calculates a non-linear similarity between the normalized feature vector and a predetermined boundary vector, calculates a traffic status value by combining the non-linear similarities, and determines the class of the network traffic as one of a normal class and a malicious class based on the traffic status value. Effects of the invention

[0018] According to an embodiment of the present application, by comprehensively considering the correlation with the class of network traffic and the mutual redundancy between features to extract an optimal feature vector and analyzing it non-linearly, the classification accuracy of network traffic can be increased and the time required for judgment can be reduced.

[0019] In addition, according to an embodiment of the present application, by normalizing feature vectors by reflecting the statistical characteristics of each flow and calculating non-linear similarity, the impact of scale imbalance or noise between flows on classification performance can be minimized, and more robust and consistent classification results can be provided.

[0020] In addition, according to an embodiment of the present application, by directly linking the classification results with the policy enforcement of the SDN controller to block malicious traffic in real time and rapidly set the path for normal traffic, the security and quality of service (QoS) of the entire network can be improved.

[0021] The effects obtainable from the embodiments of the present application are not limited to those mentioned above, and other unmentioned effects will be clearly understood by those skilled in the art to which the present application pertains from the description below. Brief explanation of the drawing

[0022] A brief description of each drawing is provided to help to better understand the drawings cited in this application. FIG. 1 is a flowchart of a method for classifying network traffic according to an embodiment of the present application. FIG. 2 is a block diagram of a network traffic classification device according to an embodiment of the present application. Specific details for implementing the invention

[0023] The technical concept of the present application is subject to various modifications and may have various embodiments, and specific embodiments are illustrated in the drawings and described in detail. However, this is not intended to limit the technical concept of the present application to specific embodiments, and it should be understood that it includes all modifications, equivalents, and substitutions that fall within the scope of the technical concept of the present application.

[0024] In explaining the technical concept of the present application, detailed descriptions of related prior art are omitted if it is determined that such descriptions may unnecessarily obscure the essence of the present application.

[0025] The terms used herein are for describing embodiments and are not intended to limit or / or restrict the present application. Singular expressions include plural expressions unless the context clearly indicates otherwise. Additionally, numbers used herein (e.g., First, Second, etc.) are merely identifiers to distinguish one component from another.

[0026] In this specification, when it is stated that a part is connected to another part, this includes not only cases where they are directly connected, but also cases where they are indirectly connected with other components in between. Furthermore, when it is stated that a part includes a certain component, this means that, unless specifically stated otherwise, it does not exclude other components but may include additional components.

[0027] Furthermore, in this application, the term "or" is intended to mean an implicit "or" rather than an exclusive "or." That is, unless otherwise specified or evident from the context, "X uses A or B" is intended to mean one of the natural implicit substitutions. In other words, if X uses A; if X uses B; or if X uses both A and B, "X uses A or B" may apply to any of these cases. Additionally, the term "and / or" as used herein should be understood to refer to and include all possible combinations of one or more of the enumerated related configurations.

[0028] In addition, terms such as “~part,” “~device,” “~device,” and “~module” described in this application refer to a unit that processes at least one function or operation, and this can be implemented as hardware or software or a combination of hardware and software, such as a processor, microprocessor, microcontroller, CPU (Central Processing Unit), GPU (Graphics Processing Unit), APU (Accelerated Processing Unit), DSP (Digital Signal Processor), ASIC (Application Specific Integrated Circuit), FPGA (Field Programmable Gate Array), etc.

[0029] Furthermore, it is intended to clarify that the classification of the components in this application is merely based on the primary function each component is responsible for. That is, two or more components described below may be combined into a single component, or a single component may be divided into two or more components based on more subdivided functions. Additionally, each component described below may additionally perform some or all of the functions performed by other components in addition to its own primary function, and it is obvious that some of the primary functions performed by each component may be exclusively performed by other components.

[0031] In this specification, the term "artificial intelligence learning model" may be used interchangeably with "artificial intelligence model," "computational model," "machine learning model," etc. An artificial intelligence learning model may be trained by various algorithms, such as, for example, decision tree, random forest, Gaussian naive bayes, k-nearest neighbor, Ada Boost, support vector machine, voting, bagging, neural network, and deep learning. However, it is not limited thereto.

[0032] An artificial intelligence learning model can be trained using at least one of supervised learning, unsupervised learning, semi-supervised learning, or reinforcement learning. The training of an artificial intelligence learning model may be a process of applying knowledge to the model to perform a specific action.

[0033] When algorithms such as neural networks or deep learning are applied to an artificial intelligence learning model, the artificial intelligence learning model may be referred to as a network function. The term "network function" can be used interchangeably with "neural network." A neural network can generally be composed of a set of interconnected computational units referred to as nodes. These nodes may also be referred to as neurons. A neural network is composed of at least one node, and the nodes may be interconnected by one or more links.

[0034] Neural networks may include Deep Neural Networks (DNNs). Deep Neural Networks may include Convolutional Neural Networks (CNNs), Recurrent Neural Networks (RNNs), Long Short-Term Memory (LSTMs), Gated Recurrent Units (GRUs), autoencoders, Restricted Boltzmann Machines (RBMs), Deep Belief Networks (DBNs), Q networks, U networks, Siamese networks, Generative Adversarial Networks (GANs), Transformer models (encoder models, decoder models, encoder-decoder models), etc. However, they are not limited thereto.

[0035] In this specification, a generative model refers to a model that automatically discovers and learns regularities and patterns in training data to generate new samples similar to the probability distribution of the training data. A generative model can generate similar data that follows the distribution of given training data.

[0036] In this specification, a language model (or large-scale language model) refers to an artificial intelligence model designed to process text data. For example, the language model can perform text understanding, text conversion, text generation, etc.

[0037] In this specification, a non-verbal model refers to an artificial intelligence model designed to process non-verbal data such as images, voice, and video. For example, a Vision Transformer is an encoder model that processes images and can perform image classification, object detection, etc. For example, a Speech Transformer can perform speech recognition (ASR), text-to-speech conversion (TTS), etc.

[0038] In this specification, a multimodal generative model refers to an artificial intelligence model designed to process information of various modalities (data types), such as text, images, audio, and video. For example, a multimodal generative model may receive text as input and generate images or audio from the text.

[0040] Hereinafter, embodiments of the present application will be described in detail in turn.

[0042] Software-Defined Networking (SDN) can provide a flexible structure that separates the control unit and the data delivery unit, enabling the entire network to be efficiently managed and programmed from a central location. The network traffic classification technology according to the embodiments of the present application utilizes the advantages of such an SDN environment to analyze large-scale heterogeneous traffic generated from IoT devices in real time. However, it is not limited thereto.

[0044] FIG. 1 is a flowchart of a method for classifying network traffic according to an embodiment of the present application.

[0045] In step S110, a feature vector relating to at least one feature can be extracted from network traffic. Here, network traffic refers to a flow of data packets transmitted through a network, and such traffic may include at least one flow. A flow may be a basic unit of communication, meaning a series of packets that share common identification information such as a source IP address, a destination IP address, a port number, and a protocol. In step S110, a feature vector can be extracted for each of these flows.

[0046] For example, features extractable from network traffic may include packet count, byte count, flow duration, transmitted bytes, received bytes, etc. A feature vector may include at least one of the above features. For example, the feature vector may relate to 'packet count', 'flow duration', and 'transmitted bytes' among the above features. However, it is not limited thereto.

[0047] In step S120, the feature vector can be normalized. Step S120 is intended to correct scale imbalance and noise between flows, and normalization can be performed for each feature constituting the feature vector.

[0048] Here, normalization refers to a data preprocessing step that places features with different units and ranges on the same scale. For example, the byte count of a large file transfer flow can be significantly larger than that of a web surfing flow, and this scale imbalance can degrade the performance of classification models. Normalization prevents the absolute size of specific features from having an excessive impact on the classification model and allows for the balanced handling of the relative importance of each feature.

[0049] In the embodiment, the normalization of step S120 can be performed using the mean and standard deviation calculated in advance for each feature from a plurality of network flows included in a training dataset containing normal and malicious classes.

[0050] For example, normalization in step S120 can be performed by Z-score normalization, which transforms each feature value into a standard normal distribution with a mean of 0 and a standard deviation of 1. However, it is not limited to this.

[0051] In step S130, non-linear similarity between a normalized feature vector and a predetermined boundary vector can be calculated. This is intended to effectively classify complex data patterns that are difficult to distinguish linearly by mapping the normalized feature vector to a high-dimensional feature space.

[0052] Specifically, step S130 may include a step of calculating the distance between a normalized feature vector and a boundary vector; and a step of generating similarity by mapping the calculated distance into a non-linear space. For example, the Euclidean distance may be converted into a non-linear similarity using a Radial Basis Function (RBF) kernel, or similarity may be generated by applying other non-linear functions such as an exponential function or a sigmoid function. However, it is not limited thereto.

[0053] In the embodiments, the boundary vector may refer to a vector derived based on training data that serves as a criterion for distinguishing between a normal class and a malicious class. For example, the boundary vector may be intended to define a decision boundary in a multidimensional space that maximizes the margin between the two classes. The boundary vector may include support vectors, which are data samples located closest to the boundary. The boundary vector may be generated during the process of pre-training a machine learning model, such as a Support Vector Machine (SVM), using a training dataset containing normal and malicious traffic samples.

[0054] In the embodiments, the generation or correction of boundary vectors can be performed periodically or non-periodically. That is, boundary vectors are not limited to being generated during initial training, but can be generated or corrected periodically or non-periodically to respond to changes in new network traffic patterns. Through this, the classification model can continuously maintain or improve classification accuracy by reflecting the latest traffic trends.

[0055] In the example, non-linear similarity can be calculated by Equation 1.

[0056] [Equation 1]

[0057]

[0058] In Equation 1, E i represents the feature vector, and E j can represent a boundary vector. In addition, M can represent the mean vector of all feature vectors included in the training dataset, SD can represent the standard deviation vector, and σ can represent a parameter that controls the width of similarity.

[0059] That is, according to Equation 1, each feature vector is normalized by its mean and standard deviation and reflected in the distance calculation, thereby minimizing distortion caused by outliers or scale differences in a specific flow and producing a more stable similarity.

[0060] In addition, M and SD can be calculated by Equation 2 and Equation 3, respectively.

[0061] [Equation 2]

[0062]

[0063] [Equation 3]

[0064]

[0065] In Equations 2 and 3, N represents the total number of samples used for training, and E ij can represent the i-th feature value of the j-th training sample. That is, M i is the mean value of the i-th feature for all training samples, and SD i can represent the standard deviation of the i-th feature for all training samples.

[0066] For all features included in the feature vector, M i and SD i M and SD of Equation 1 can be generated by calculating.

[0067] In step S140, the traffic status value can be calculated by combining the non-linear similarities derived in step S130. Here, the traffic status value refers to a quantitative score indicating the probability or confidence that network traffic (specifically, a particular flow) belongs to a specific class. In other words, the traffic status value is a measure indicating how far the feature vector of the traffic is from the decision boundary distinguishing classes; it is not a value that directly designates a class, but rather a value that serves as the basis for class determination.

[0068] Specifically, step S140 may generate a traffic status value by summing or averaging multiple non-linear similarities calculated in step S130. Additionally, in step S140, the traffic status value may be generated by weighted summing or weighted averaging by assigning corresponding identical or different weights to the non-linear similarities. In this case, the weights may be determined according to the importance of each boundary vector, but are not limited thereto.

[0069] In step S150, the class of network traffic (specifically, a particular flow) can be determined as either a normal class or a malicious class based on the traffic status value. For example, if the traffic status value is above a preset threshold (e.g., a value of '0'), it can be determined as a normal class, and if it is below the threshold, it can be determined as a malicious class. The normal class refers to traffic generated by normal user activities and means communication that should be allowed, whereas the malicious class may refer to abnormal traffic that threatens the network system or interferes with intended services, such as distributed denial of service (DDoS) attacks, scanning, worms, etc.

[0070] In an embodiment, the method (100) may further include a step of executing a policy to set or block the path of network traffic (in particular, a specific flow) according to the class determined in step S150. The step may be performed, for example, by an SDN controller controlling network equipment (e.g., a switch) located in the data plane.

[0071] Specifically, in the above step, if network traffic is determined to be of a normal class, a path setting flow rule for normal communication of the traffic can be transmitted to the data plane. Conversely, if network traffic is determined to be of a malicious class, a drop rule for blocking the traffic can be transmitted to the data plane to protect the network.

[0072] In an embodiment, the method (100) may further include the step of selecting a combination of features to be used for network traffic classification from among the features extracted from network traffic. Step S110 may be performed for the selected combination of features.

[0073] The above steps may include generating a first feature combination composed of a plurality of features extractable from network traffic; and selecting a second feature combination based on a first correlation between each feature included in the first feature combination and a class of traffic (e.g., normal or malicious) and a second correlation between the features.

[0074] For example, multiple first feature combinations may be selected, and one or more second feature combinations may be selected based on the correlation derived from each first feature combination.

[0075] In the embodiment, the second feature combination may be selected based on the correlation-variance contribution. Here, the correlation-variance contribution is an indicator that considers the correlation between the feature combination and the class and the variance among features within the feature combination; specifically, it may be calculated to be proportional to the first correlation and inversely proportional to the second correlation. That is, the second feature combination may be composed of features that have high discriminative power for class classification while having low redundancy among features.

[0076] In the example, the contribution can be calculated by Equation 4.

[0077] [Equation 4]

[0078]

[0079] In Equation 4, n represents the total number of features included in the corresponding feature combination, and X ij represents the i-th feature value of the j-th training sample, and β i can represent a weight indicating how valid the i-th feature is. Also, Cor[MFC ] represents the mean correlation (first correlation) between feature combinations and class labels, and a higher value may indicate better discriminative power for the classes. In addition, Cor[A FF ] represents the average cross-correlation (second correlation) among features belonging to a feature combination, and a lower value may indicate lower information redundancy between features.

[0080] In other words, contribution can be used as a criterion for selecting the optimal feature combination by assigning high scores to feature combinations that have high relevance to the class and low redundancy between features.

[0081] In the examples, the first correlation and the second correlation used in Equation 4 can be calculated by Equation 5 and Equation 6, respectively.

[0082] [Equation 5]

[0083]

[0084] In Equation 5, n represents the total number of features included in the corresponding feature combination, and Cor[M FC ] are individual features (F) included in the feature combination i It refers to the average of the correlation coefficients between ) and the class label (C). That is, Cor[M FC ] can indicate how well the features belonging to a feature combination explain the class on average.

[0085] [Equation 6]

[0086]

[0087] In Equation 6, n represents the total number of features included in the corresponding feature combination, and Cor(F i , F j ) refers to two different features (F) within a feature combination i ,F j It refers to the correlation coefficient between ). That is, Cor[A FF] represents the average cross-correlation between all pairs of features included in a feature combination and can be used as a measure of information redundancy between features.

[0088] In an embodiment, the step may further include selecting a third feature combination based on the precision and recall of the second feature combination.

[0089] In the embodiment, the classification performance based on precision and recall of the third feature combination can be selected through the F1-score (F1-Measure). The F1-score is the harmonic mean of precision and recall, and has the characteristic of showing a high value when the two indicators are in balance. The F1-score can be calculated by Equation 7 below.

[0090] [Equation 7]

[0091]

[0092] In Equation 7, Precision represents the proportion of traffic that is actually malicious among traffic predicted as a malicious class, and this is related to minimizing cases where normal traffic is incorrectly identified as malicious (False Positive). Recall represents the proportion of traffic that the model accurately detects as malicious among actual malicious traffic, and this is related to minimizing cases where malicious traffic is missed as normal (False Negative). In other words, selecting feature combinations based on the F1-score means ultimately selecting the feature combination that exhibits the most stable and reliable classification performance by minimizing both false positives and false negatives.

[0093] In the embodiments, the step of selecting feature combinations is not performed only during the initial system setup, but can be repeated periodically or non-periodically to respond to changes in the network environment or the emergence of new attack patterns. Through this, the performance of the classification model can be kept up to date by dynamically maintaining the most effective feature combinations in accordance with changing traffic characteristics.

[0094] FIG. 1 is exemplary, and various configurations may be applied according to embodiments of the present application.

[0096] FIG. 2 is a block diagram of a network traffic classification device according to an embodiment of the present application.

[0097] The classification device (200) is for performing the method (100) of FIG. 1, etc., and specifically may include a communication unit (210), an input unit (220), a memory (230), and a processor (240).

[0098] The communication unit (210) can receive or transmit data from inside or outside. The communication unit (210) may include a wired or wireless communication unit. If the communication unit (210) includes a wired communication unit, the communication unit (210) may include one or more components that enable communication through a Local Area Network (LAN), a Wide Area Network (WAN), a Value Added Network (VAN), a mobile radio communication network, a satellite communication network, and combinations thereof. Additionally, if the communication unit (210) includes a wireless communication unit, the communication unit (210) may transmit or receive data or signals wirelessly using cellular communication, a wireless LAN (e.g., Wi-Fi), etc. In an embodiment, the communication unit (210) may transmit or receive data or signals to and from an external device or an external server under the control of a processor (240).

[0099] The input unit (220) can receive various user commands through external operation. To this end, the input unit (220) may include or be connected to one or more input devices. For example, the input unit (220) may receive user commands by being connected to an interface for various inputs, such as a keypad or a mouse. To this end, the input unit (220) may include an interface such as a USB port as well as a Thunderbolt. Additionally, the input unit (220) may receive external user commands by including or being combined with various input devices such as a touchscreen or a button.

[0100] The memory (230) can store programs and / or program instructions for the operation of the processor (240) and can temporarily or permanently store input / output data. Specifically, the memory (230) can store various data, programs (one or more instructions), applications, software, instructions, code, etc. for driving and controlling the processor (240). For example, the memory (230) may include at least one type of storage medium among flash memory type, hard disk type, multimedia card micro type, card type memory (e.g., SD or XD memory, etc.), RAM, SRAM, ROM, EEPROM, PROM, magnetic memory, magnetic disk, and optical disk.

[0101] The processor (240) can control the overall operation of the device (200). The processor (240) can execute one or more programs or software stored in memory (230). For example, the processor (240) may mean a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), or a dedicated processor (240) on which the methods according to the embodiments of the present application are performed.

[0102] In an embodiment, the processor (240) extracts a feature vector regarding at least one feature from network traffic, normalizes the feature vector by feature, calculates a non-linear similarity between the normalized feature vector and a predetermined boundary vector, calculates a traffic status value by combining the non-linear similarities, and can determine the class of network traffic as one of a normal class and a malicious class based on the traffic status value.

[0103] In an embodiment, the processor (240) can perform normalization using the mean and standard deviation calculated in advance for each feature from a plurality of network flows included in a training dataset containing normal classes and malicious classes.

[0104] In an embodiment, the processor (240) can calculate a distance between a normalized feature vector and a boundary vector, and generate a non-linear similarity by mapping the calculated distance to a non-linear space to generate a similarity.

[0105] In the embodiment, the boundary vector may include a support vector that defines a decision boundary that maximizes the margin between the normal class and the malicious class, and the support vector may be trained in advance using a training dataset.

[0106] In an embodiment, the processor (240) can select a combination of features to be used for classifying network traffic and extract a feature vector based on the selected combination of features.

[0107] In an embodiment, the processor (240) generates a first feature combination consisting of a plurality of features extractable from network traffic, and can select a second feature combination based on a first correlation between each feature included in the first feature combination and a class and a second correlation between features.

[0108] In an embodiment, the processor (240) can select a second feature combination based on a correlation-variance contribution calculated to be proportional to the first correlation and inversely proportional to the second correlation.

[0109] In an embodiment, the processor (240) may select a third feature combination based on the precision and recall rate of the second feature combination, and the features of the extracted feature vector may include the third feature combination.

[0110] In an embodiment, the processor (240) can execute a policy to set or block the path of network traffic according to the determined class.

[0111] In an embodiment, the processor (240) may transmit a flow rule for routing the traffic to the data plane when the network traffic is determined to be of a normal class, and transmit a drop rule for blocking the traffic to the data plane when the network traffic is determined to be of a malicious class.

[0112] FIG. 2 is exemplary, and various configurations may be applied according to embodiments of the present application.

[0114] Below, the performance between the embodiments and comparative examples according to the present application was compared.

[0116] Examples and Comparative Examples

[0117] The embodiment implements a method for classifying network traffic according to the embodiment of the present application, Comparative Example 1 is a conventional traffic classification technology focused on intelligent SDN monitoring functions (Castillo Edwin F., et al., "IPro: An Approach for Intelligent SDN Monitoring", 2020), Comparative Example 2 is a routing technology using a Random Forest algorithm aimed at guaranteeing Quality of Service (QoS) (Sun Weifeng, et al., "A QoS-guaranteed intelligent routing mechanism in software-defined networks", 2020), and Comparative Example 3 is a deep learning-based technology that learns and classifies traffic features using a Convolutional Neural Network (CNN) model (Said ElSayed Mahmoud, et al., "A novel hybrid model for intrusion detection systems in SDNs based on CNN and a new regularization technique", 2021).

[0119] Experimental Example

[0120] Performance evaluation was performed using the public SDN traffic dataset (Mendeley Data, DOI: 10.17632 / jxpfjc64kr.1). The dataset includes normal (TCP, UDP, ICMP) and malicious traffic, and each traffic consists of 23 features including Protocol, Source Switch ID, Destination Switch ID, Source IP, Destination IP, Port Number, Packet Count, Byte Count, Duration sec, Duration nsec, Total Duration, tx_bytes, rx_bytes, datetime, Flows, Packets per Flow, Bytes per Flow, Packet Rate, Packet_ins messages, Total Flow Entries, tx_kbps, rx_kbps, and Port Bandwidth. All experiments were conducted using Python on a system equipped with an Intel Core i5 processor and 8GB of RAM.

[0122] Performance evaluation was conducted based on latency, classification accuracy, precision, recall, error rate, and F1 score. Here, latency refers to the time required for traffic classification and judgment, with lower values ​​indicating better performance; classification accuracy represents the proportion of correctly classified traffic out of the total traffic. Precision refers to the ratio of actual malicious cases among those predicted as malicious, and recall represents the ratio of actual malicious traffic detected as malicious. The error rate indicates the ratio of misclassified traffic out of the total traffic, with lower values ​​indicating better performance; finally, the F1 score is the harmonic mean of precision and recall, representing the overall reliability of the classification model.

[0124] To evaluate the overall performance of the examples and comparative examples, experiments were repeatedly performed by gradually changing the number of network traffic samples from 500 to 5,000, and the experimental results are shown in Table 1.

[0126] Latency (ms) Classification accuracy (%) Precision (%) Recall rate (%) Error rate (%) F1 Score (%) Examples 975.01 96.11 94.71 93.46 3.89 94.06 Comparative Example 1 1159.63 94.09 92.84 90.40 5.90 91.58 Comparative Example 2 1433.63 92.25 90.60 88.87 7.74 89.71 Comparative Example 3 1547.49 94.66 93.31 91.87 5.33 92.57

[0128] As a result of the experiment, the example recorded the lowest latency of 975.01 ms, confirming that the processing speed was significantly superior compared to the comparative examples. In addition, the error rate was also found to be the lowest at 3.89%. This means that the present invention optimizes the dimension of the feature vector by selecting only the essential features for classification, thereby reducing computational complexity and enabling rapid judgment.

[0130] Furthermore, it was confirmed that the example recorded the highest figures in all categories, including classification accuracy (96.11%), precision (94.71%), and recall (93.46%). This was analyzed to be due to the normalization process, which reflects statistical characteristics between flows, effectively suppressing data imbalance and noise, and the non-linear similarity calculation step precisely distinguishing even complex traffic patterns.

[0132] In addition, the example achieved 94.06% in the F1 score, which considers both precision and recall, proving that it has the best overall classification performance and reliability compared to the comparative examples.

[0134] As such, it was confirmed that the embodiment can provide significantly improved performance in both processing speed and accuracy compared to existing technologies by organically combining optimal feature extraction, effective noise correction, and sophisticated non-linear classification.

[0136] The method according to an embodiment of the present application may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc., either alone or in combination. The program instructions recorded on the medium may be those specifically designed and configured for the present application or may be those known and available to those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes; optical recording media such as CD-ROMs and DVDs; magneto-optical media such as floptical disks; and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, and flash memory. Examples of program instructions include machine code, such as that generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc.

[0137] Additionally, the method according to the disclosed embodiments may be provided by being included in a computer program product. The computer program product may be traded between a seller and a buyer as a product.

[0138] A computer program product may include a software program and a computer-readable storage medium on which the software program is stored. For example, a computer program product may include a product in the form of a software program (e.g., a downloadable app) that is distributed electronically through a manufacturer of an electronic device or an electronic market (e.g., Google Play Store, App Store). For electronic distribution, at least a portion of the software program may be stored on a storage medium or temporarily created. In this case, the storage medium may be a server of the manufacturer, a server of the electronic market, or a storage medium of a relay server that temporarily stores the software program.

[0139] A computer program product may include a storage medium of a server or a storage medium of a client device in a system composed of a server and a client device. Alternatively, if there is a third device (e.g., a smartphone) that communicates with the server or the client device, the computer program product may include a storage medium of the third device. Alternatively, the computer program product may include the SW program itself that is transmitted from the server to the client device or the third device, or transmitted from the third device to the client device.

[0140] In this case, one of the server, the client device, and the third device may execute the computer program product to perform the method according to the disclosed embodiments. Alternatively, two or more of the server, the client device, and the third device may execute the computer program product to perform the method according to the disclosed embodiments in a distributed manner.

[0141] For example, a server (e.g., a cloud server or an artificial intelligence server, etc.) can execute a computer program product stored on the server to control a client device connected to the server in communication to perform the method according to the disclosed embodiments.

[0143] Although the embodiments have been described in detail above, the scope of the present application is not limited thereto, and various modifications and improvements by those skilled in the art using the basic concept of the present application as defined in the following claims also fall within the scope of the present application.

Claims

Claim 1 A method for classifying network traffic comprises: a step of extracting a feature vector relating to at least one feature from the network traffic; a step of normalizing the feature vector according to the feature; a step of calculating a non-linear similarity between the normalized feature vector and a predetermined boundary vector; a step of calculating a traffic state value by combining the non-linear similarities; and a step of determining the class of the network traffic as one of a normal class and a malicious class based on the traffic state value, wherein the method further comprises a step of selecting a feature combination to be used for classifying the network traffic, wherein a step of extracting the feature vector based on the selected feature combination is performed, and the step of selecting the feature combination includes a step of generating a first feature combination composed of a plurality of features extractable from the network traffic; and a step of selecting a second feature combination based on a first correlation between each feature included in the first feature combination and the class and a second correlation between the features, wherein the step of selecting the second feature combination is performed based on a correlation-variance contribution calculated to be proportional to the first correlation and inversely proportional to the second correlation. Claim 2 A method according to claim 1, wherein the normalization step is performed using a mean and standard deviation calculated in advance for each feature from a plurality of network flows included in a training dataset including a normal class and a malicious class. Claim 3 In paragraph 2, the step of calculating the non-linear similarity comprises: a step of calculating the distance between the normalized feature vector and the boundary vector; and a step of generating similarity by mapping the distance into a non-linear space. Claim 4 In paragraph 3, the boundary vector includes a support vector that defines a decision boundary that maximizes the margin between a normal class and a malicious class, and the support vector is pre-trained using a training dataset. Claim 5 In claim 4, the step of generating similarity by mapping the distance into a non-linear space is performed by applying an exponential function to a value obtained by scaling the square of the distance between the normalized feature vector and the boundary vector by a predetermined width parameter. Claim 6 A method according to claim 1, wherein the step of selecting the feature combination further includes the step of selecting a third feature combination based on the precision and recall rate of the second feature combination, and the feature includes the third feature combination. Claim 7 In claim 6, the step of selecting the third feature combination is performed based on the harmonic mean of the precision and the recall rate calculated from the second feature combination. Claim 8 A method according to claim 1, wherein the step of calculating the traffic status value is performed by weighted summing by assigning weights determined according to the importance of the corresponding boundary vector to each of the plurality of non-linear similarities. Claim 9 A method according to claim 1, further comprising the step of executing a policy to set or block the path of the network traffic according to the determined class. Claim 10 In claim 9, the step of executing the policy comprises: a step of transmitting a flow rule for routing the traffic to the data plane when the network traffic is determined to be of a normal class; and a step of transmitting a drop rule for blocking the traffic to the data plane when the network traffic is determined to be of a malicious class. Claim 11 A computer program stored on a recording medium to execute a method according to any one of paragraphs 1 through 10. Claim 12 A device for classifying network traffic, comprising: a memory in which a program for classifying network traffic is stored; and a processor that, by executing the program, extracts a feature vector relating to at least one feature from the network traffic, normalizes the feature vector for each feature, calculates a non-linear similarity between the normalized feature vector and a predetermined boundary vector, calculates a traffic state value by combining the non-linear similarities, and determines the class of the network traffic as one of a normal class and a malicious class based on the traffic state value, wherein the processor selects a feature combination to be used for classifying network traffic and extracts the feature vector based on the selected feature combination, and wherein the processor generates a first feature combination composed of a plurality of features extractable from the network traffic, and selects a second feature combination based on a first correlation between each feature included in the first feature combination and the class and a second correlation between the features, wherein the second feature combination is selected based on a correlation-variance contribution calculated to be proportional to the first correlation and inversely proportional to the second correlation. Claim 13 In paragraph 12, the processor is a device that executes a policy to set or block the path of the network traffic according to the determined class. Claim 14 A device according to claim 13, wherein the processor transmits a flow rule for routing the traffic to the data plane when the network traffic is determined to be of a normal class, and transmits a drop rule for blocking the traffic to the data plane when the network traffic is determined to be of a malicious class.

Images