Lightweight artificial intelligence web application firewall detection system operable in client without GPU and lightweight artificial intelligence manufacturing method thereof

Abstract

An embodiment of the present invention comprises: a model generation member (100) for generating and distributing a lightweight artificial intelligence; and a client which is equipped with the lightweight artificial intelligence distributed from the model generation member (100) and detects risk.

Description

Lightweight AI Web Firewall Detection System Running on GPU-less Clients and Method for Creating the Lightweight AI

[0001] The present invention relates to a lightweight artificial intelligence web firewall detection system capable of operating on a client without a GPU, and a method for creating the lightweight artificial intelligence.

[0002] A Web Application Firewall (WAF) is a solution developed specifically for web application security, unlike a general network firewall.

[0003] The basic role of a web firewall is to detect and block web attacks such as SQL Injection and Cross-Site Scripting (XSS), and in addition to responding directly to web attacks, it can be utilized as a solution for preventing information leakage, preventing fraudulent logins, and preventing website tampering.

[0004] In other words, a web firewall provides web security functions while protecting against unexpected external attacks and internal risks that were not detected in advance.

[0005] Recently, Security Operations Centers (SOCs) are applying machine learning to security systems due to persistent technical personnel shortages and an increase in intrusion detection events caused by the growing number of security devices.

[0006] Conventional AI web firewalls of this type are equipped with high-performance systems featuring GPUs due to the need for large-scale computation. Consequently, it is difficult to implement such systems on low-spec client computers that lack GPUs.

[0007] The present invention aims to provide a method for creating a lightweight artificial intelligence and a lightweight artificial intelligence web firewall detection system capable of operating on a client computer without a GPU using the same, which can operate efficiently even on a client computer without a GPU through a lightweight model while maintaining the performance of a web firewall detection system.

[0008] An embodiment of the present invention provides a method for creating a lightweight artificial intelligence, characterized by comprising: a) a step in which a model generating member collects data including at least one of web log files, HTTP request and response data, and script files according to a set data source and data type; b) a step in which a model generating member removes duplicate data from raw data using a hash function or a database deduplication algorithm; c) a step in which a model generating member refines and normalizes the collected data, extracts a feature including at least one of a URL pattern, a request method, and a response code, and labels data points to include normal or malicious patterns to preprocess the data; d) a step in which a model generating member creates a training dataset as labeled data including normal and malicious patterns; e) a step in which a model generating member trains a student model through a teacher model trained on the training dataset; f) a step in which a model generating member lightweights the student model as a quantized model so that it can be installed and run on a client without a GPU; and g) a step of verifying the lightweight student model and distributing it to a client.

[0009] Additionally, step e) includes e-1) a step of selecting and creating a teacher model as a high-performance large deep learning model and training the created teacher model with a training dataset, e-2) a step of creating a soft target that defines the probability distribution predicted by the teacher model for each data point, e-3) a step of creating a student model using a neural network model, a lightweight RNN, or a CNN that is lighter than the teacher model and training the student model using the soft target and correct labels of the teacher model, and e-4) an optimization step of removing unnecessary parameters using deep learning pruning or knowledge distillation techniques.

[0010] Then, step f) converts the student model to TensorFlow Lite and optimizes it using TensorFlow Lite's optimization tool, and lightens the optimized student model by converting the weight values ​​of the optimized student model into 8-bit integers using TensorFlow Lite's quantization option.

[0011] In addition, in step d), the training dataset is split into a training dataset and a validation dataset with a ratio of 8:2.

[0012] And, step d) executes oversampling, undersampling, or SMOTE (Synthetic Minority Over-sampling Technique) techniques to prevent imbalance in the partitioned dataset.

[0013] As another embodiment, the present invention may include a model generation member that generates and distributes lightweight artificial intelligence, and a client that detects risks by equipping the lightweight artificial intelligence distributed by the model generation member. The model generation member may include a raw data collection unit that collects raw data, a duplicate data removal unit that removes duplicate data from the raw data, a data preprocessing unit that performs preprocessing including cleaning, feature extraction, and labeling of the raw data, a training dataset generation unit that generates a training dataset by dividing the preprocessed data into training and validation datasets at a set ratio, a teacher model, a lightweighting unit that generates a student model that is lighter than the teacher model and trains the teacher model through the training dataset to convert the student model into a lightweight model by quantizing the weight values ​​of the student model's data points and knowledge distillation unit, and a validation unit that validates and evaluates the lightweight student model using the validation dataset.

[0014] Here, the training dataset generation unit is characterized by splitting the training and validation datasets in an 8:2 ratio.

[0015] In addition, the knowledge distillation unit includes a teacher learning module that selects and trains a teacher model, a soft target generation module that inputs a training dataset into the teacher model to generate a soft target, a student learning module that generates a student model using a neural network model lighter than the teacher model, a lightweight RNN (Recurrent Neural Network) or CNN (Convolutional Neural Network), and trains the student model using a soft target and a correct label, and an optimization module that optimizes the student model by removing unnecessary parameters using deep learning pruning or knowledge distillation techniques.

[0016] Additionally, the lightweighting unit includes a lightweighting conversion module that converts a student model into TensorFlow Lite and optimizes it using the optimization tool of TensorFlow Lite, and a quantization generation module that lightweights the optimized student model by converting the weight values ​​of the optimized student model into 8-bit integers using the quantization option of TensorFlow Lite; and a web firewall detection system using lightweight artificial intelligence that operates on a client without a GPU.

[0017] The present invention can efficiently detect and block web attacks while maintaining the performance of a web firewall detection system on clients without GPUs, thereby reducing the costs associated with data transmission and storage and minimizing constraints on the installation environment.

[0018] FIG. 1 is a block diagram illustrating a lightweight artificial intelligence web firewall detection system that can operate on a client without a GPU according to the present invention.

[0019] FIG. 2 is a block diagram illustrating a model generation component.

[0020] Figures 3 and 4 illustrate examples of labeled datasets.

[0021] Figure 5 is a block diagram illustrating a knowledge distillation unit.

[0022] Figure 6 is a block diagram illustrating a lightweight section.

[0023] Figure 7 is a block diagram illustrating a client.

[0024] FIG. 8 is a flowchart illustrating a lightweight artificial intelligence manufacturing method according to the present invention.

[0025] Figure 9 is a flowchart illustrating step S500.

[0026] Although the present invention may be subject to various modifications and may have various embodiments, specific embodiments are to be described in detail by way of illustration in the drawings. This is not intended to limit the present invention to specific embodiments, and it should be understood that any modification, equivalent, or substitution falls within the spirit and scope of the present invention for connecting and / or fixing structures extending in different directions.

[0027] The terms used in this specification are used merely to describe specific embodiments and are not intended to limit the invention. The singular expression includes the plural expression unless the context clearly indicates otherwise.

[0028] In this specification, terms such as “comprising” or “having” are intended to specify the existence of the features, numbers, steps, actions, components, parts, or combinations thereof described in the specification, and should not be understood as precluding the existence or addition of one or more other features, numbers, steps, actions, components, parts, or combinations thereof.

[0029] Hereinafter, a preferred embodiment of a lightweight artificial intelligence web firewall detection system capable of operating on a client without a GPU according to the present invention will be described with reference to the attached drawings.

[0030] FIG. 1 is a block diagram illustrating a lightweight artificial intelligence web firewall detection system that can operate on a client without a GPU according to the present invention, and FIG. 2 is a block diagram illustrating a model generation member (100).

[0031] Referring to FIGS. 1 and 2, the present invention includes a model generating member (100) that generates a lightweight detection model, and a client (200) equipped with a detection model distributed from the model generating member (100).

[0032] The client (200) is a user's computer or mobile terminal without a GPU and is equipped with a detection model distributed from the model generation unit (100). Here, the detection model equipped on the client (200) detects risks by analyzing collected data in real time.

[0033] The model generation component (100) generates a lightweight detection model that can be run on a client (200) without a GPU and distributes it to the client (200). The detection model is optimized using the optimization tool of TensorFlow Lite, and lightweighting is applied as a quantization model before being distributed to the client (200). Here, the model generation component (100) is either a computing device capable of communicating with the client (200) or a computing device connected to a server or terminal capable of transmitting the detection model to the client (200).

[0034] More specifically, the model generation unit (100) includes a raw data collection unit (110), a duplicate data removal unit (120), a data preprocessing unit (130), a training dataset generation unit (140), a knowledge distillation unit (150), a lightweighting unit (160), a verification unit (170), and a distribution unit (180).

[0035] The raw data collection unit (110) collects raw data for training data of the detection model. The raw data sets the data source and data type, and collects data from various sources such as web log files, HTTP request and response data, and script files using a data collection tool (e.g., web server load analysis tool, packet capture tool, etc.).

[0036] Additionally, the raw data collection unit (110) installs an automated data collection agent on the contracted client (200) to monitor HTTP requests and responses in real time and generate logs. The raw data collection unit (110) identifies major web attack types specified in the OWASP Top 10, such as SQL injection, XSS, CSRF, authentication and session management vulnerabilities, and security misconfiguration, and stores them in a database.

[0037] The duplicate data removal unit (120) removes duplicate data from the collected raw data. At this time, the duplicate data removal unit (120) is equipped with a hash function or a database duplicate removal algorithm and removes duplicate data through this. This removal of duplicate data is intended to improve the quality of the training dataset and to optimize the performance of the model by preventing unnecessary duplication during the training process.

[0038] The data preprocessing unit (130) performs cleaning, feature extraction, and labeling of raw data. The data preprocessing unit (130) performs a cleaning process including missing value processing, outlier removal, and normalization.

[0039] The cleaning of the data preprocessing unit (130) removes missing values ​​and outliers from the collected data by applying a data cleansing algorithm, and performs data normalization through a normalization technique. Data normalization improves the quality of the data by converting data collected from various sources into a consistent format through a normalization technique.

[0040] The feature extraction of the data preprocessing unit (130) extracts useful features from web request logs by performing feature engineering. The extracted features include at least one of a URL pattern, a request method, and a response code.

[0041] The labeling (or labeling) of the data preprocessing unit (130) labels each data point as normal or malicious. The labeled data can be converted into a training dataset for learning patterns of normal and malicious data points.

[0042] The training dataset generation unit (140) incorporates training and unsupervised learning algorithms and divides the data preprocessed by the data preprocessing unit (130) into training and validation datasets (e.g., in a ratio of 8:2). Then, the training dataset generation unit (140) applies techniques such as oversampling, undersampling, or SMOTE (Synthetic Minority Over-sampling Technique) to maintain the ratio of the training and validation datasets or to prevent class imbalance.

[0043] The training dataset may be provided as a data sheet divided into multiple groups according to set user-defined rules. Examples of such user-defined rule groups are illustrated in FIGS. 3 and 4.

[0044] Figure 3 illustrates the types of groups classified according to user-defined rules, and Figure 4 illustrates an example of a more subdivided group.

[0045] First, referring to Fig. 3, labeling data can be classified into general data, method-enforcement, scanner-detection, protocol-enforcement, protocol-attack, and application-attack.

[0046] The Method-Enforcement group contains data regarding lockdown methods such as PUT and PATCH.

[0047] The Scanner-Detection group includes data regarding scanner ports and environmental protection.

[0048] The protocol-enforcement group contains data that protects protocol and encoding issues.

[0049] The protocol-attack group includes data for protection against header insertion, response splitting, and request smuggling.

[0050] Application attacks are further subdivided into the groups of Local File Infection (LFI), Remote File Infection (RFI), Remote Code Execution (RCE), PHP, Cross-Site Scripting (XSS), SQL, Session Fixation, and Session Java.

[0051] More specifically, the APPLICATION-ATTACK group is further subdivided into a group containing data for protection against file and path attacks, protection against remote file inclusion (RFI), protection against remote code execution attacks, protection against PHP-injection attacks, protection against cross-site scripting attacks, protection against SQL-injection attacks, protection against session-fixation attacks, and protection against JAVA attacks.

[0052] Each group classified according to such user-defined rules is divided into sub-data groups as shown in Fig. 4 using an ID (Rule ID), and each group is provided as a data sheet containing a patterned training dataset with different features.

[0053] The datasheet included here, containing multiple groups partitioned by user-defined rules, includes the CRS Rule ID datasheet from ModSecurity, an open-source tool used by the OWASP Foundation for web servers such as Apache or Nginx to protect web applications, which detects security vulnerabilities by monitoring and filtering HTTP and HTTPS traffic.

[0054] However, the datasheet containing a plurality of training data sets grouped by user-defined rules of the present invention is not limited to the CRS Rule ID datasheet of ModSecurity, and other open source data capable of detecting security vulnerabilities of HTTP and HTTPS may be applied.

[0055] In addition, as an embodiment of the present invention, a training dataset is constructed by separately extracting frequently occurring or identified web attacks through the above-mentioned datasheet. A training dataset composed of at least one configured web attack is applied to individual models that learn only specific attacks, thereby enabling greater lightweighting compared to existing methods.

[0056] The knowledge distillation unit (150) generates and optimizes teacher models and student models. A detailed description of such a knowledge distillation unit (150) is given with reference to FIG. 5.

[0057] Figure 5 is a block diagram illustrating a knowledge distillation unit.

[0058] Referring to FIG. 5, the knowledge distillation unit (150) includes a teacher learning module (151), a soft target generation module (152), a student learning module (153), a knowledge distillation module (154), and an optimization module.

[0059] The teacher learning module (151) selects and trains a teacher model. Here, the teacher model may be a high-performance, large deep learning model (e.g., BERT (Bidirectional Encoder Representations from Transformers), GPT). The teacher learning model (151) trains the selected teacher model using a patterned training dataset for each group having different features. Preferably, the teacher model has high accuracy and complexity.

[0060] The soft target generation module (152) generates a soft target that defines the probability distribution predicted by the teacher model for each data point. The soft target generation module (152) generates the soft target by inputting the training dataset into the teacher model.

[0061] The student learning module (153) creates a student model using a neural network model, a lightweight RNN, or a CNN that is lighter than the teacher model, and learns by receiving knowledge learned from the teacher model.

[0062] The knowledge distillation module (154) trains the student model as a soft target of the teacher model. Through this, the student model receives the learning from the teacher model.

[0063] Here, the student model is trained on an individual training dataset containing at least one web attack set as a frequently occurring / identified web attack, with a lightweighting method applied for the creation of individual models for frequently occurring / identified web attacks.

[0064] An individual training dataset is training data that can learn only SQL Injection, XSS, and DDoS attacks, for example, if the trend is that more than 90% of attacks are concentrated on SQL Injection, XSS, and DDoS-related attacks.

[0065] In this case, the student model can be trained using a separate training dataset for pattern-based detection to detect web attacks with low occurrence rates that are not included in the individual training dataset.

[0066] Alternatively, as another embodiment, the present invention may deploy a separate pattern-based detection algorithm to a client to detect web attacks with a low occurrence rate that are not included in individual training datasets.

[0067] Here, the loss function of the student learning module (153) includes the difference between the soft target and the original correct label. Training of the student model trains the student model and uses both the soft target and the hard target (correct label).

[0068] The optimization module (155) optimizes the student model to remove unnecessary parameters. To do this, the optimization module (155) performs the optimization process using techniques such as deep learning pruning or knowledge distillation.

[0069] The lightweighting unit (160) lightweights the model so that it can be installed on a client (200) that is not equipped with a GPU. Lightweighting of the model means converting a large-scale and complex artificial intelligence model into a small and lightweight form, so that it can be used even on low-spec hardware or in limited environments that are not equipped with a GPU. This is explained with reference to FIG. 5.

[0070] Figure 6 is a block diagram illustrating a lightweight section.

[0071] Referring to FIG. 6, the lightweighting unit (160) may include a lightweighting conversion module (161) and a quantization generation module (162).

[0072] The lightweight transformation module (161) transforms the trained student model into TensorFlow Lite and optimizes it using TensorFlow Lite's optimization tools. In this process, the lightweight transformation module (161) reduces the size of the model and enables it to run efficiently on mobile and embedded devices.

[0073] The quantization generation module (162) creates a quantized model by using the quantization options of TensorFlow Lite to quantize the weight values ​​of the student model from precise floating-point numbers into integers (e.g., converted into 8-bit integers). This process can reduce the size and computational cost of the model.

[0074] That is, the lightweighting unit (160) optimizes the learned student model using the optimization tool of TensorFlow Lite and converts the weight values ​​into 8-bit integers using the quantization option of TensorFlow Lite to convert them into a lightweight quantized model.

[0075] The verification unit (170) evaluates the model performance using an evaluation metric that includes at least one of accuracy, precision, recall, and F1 score, using a verification dataset to verify the performance of the lightweight student model (detection model).

[0076] Additionally, the verification unit (170) improves the performance of the model by performing additional optimization (e.g., optimization using Proning or TensorFlow optimization tools) based on the evaluation results.

[0077] The distribution unit (180) distributes the student model and / or pattern-based detection algorithm verified by the verification unit (170) to the client (200) in the form of wired or wireless communication, storage on a computing device, or storage on a recording medium readable by a computing device. To this end, the distribution unit (180) includes at least one of a communication module capable of wired or wireless communication, a recording device capable of recording the student model on a recording medium, and a storage.

[0078] Figure 7 is a simplified block diagram of a client's web firewall system.

[0079] Referring to FIG. 7, the client (200) includes a data collection unit that collects data, a data processing unit (220) that processes data in real time, a risk detection unit (230) that detects risks by analyzing processed data, a risk response unit (240) that warns and responds to detected risks, and an alarm unit (250) that issues an alarm.

[0080] The data collection unit (210) collects data received through a communication device and data extracted from content downloaded from the Internet, or data set in the client (200) (system configuration and logs), and API input / output data. To this end, the data collection unit (210) may include at least one of web crawlers, log collectors, and API integrations.

[0081] The data processing unit (220) may include a real-time processing module (e.g., ApacheKafka, ApacheFlink) capable of real-time distributed processing or stream processing of data collected from the data collection unit (210), and a data storage for storing event information.

[0082] The risk detection unit (230) detects risks by analyzing data processed by installing a detection model and / or a pattern-based detection algorithm distributed from the model generation unit (100).

[0083] In one embodiment, the detection model detects web attacks configured by training with individual training datasets and training data for pattern-based detection, as well as other attacks, based on patterns. That is, the detection model detects configured web attacks in real time, while detecting other web attacks by applying a pattern-based detection method.

[0084] In another embodiment, the detection model is trained solely on individual training datasets to detect only configured web attacks. In this case, the risk detection unit is equipped with a pattern-based detection algorithm for detecting the remaining web attacks not configured in the detection model.

[0085] In other words, the detection model detects risks in real-time based on only one or more configured attacks learned from individual training datasets, while the pattern-based detection algorithm detects risks based on patterns such as URL patterns, request methods, and response codes.

[0086] The risk response unit (240) responds to risks automatically or manually based on the risk detection results of the risk detection unit (230). For example, when a risk is detected, the risk detection unit (230) automatically blocks the IP, separates the target data, and / or alerts the administrator. Alternatively, the risk detection unit (230) outputs detection information so that the safety team or administrator can respond manually.

[0087] The alarm unit (250) issues an alarm based on the result of hazard detection. The alarm is issued as a dashboard, an audiovisual signal (text, light, alarm sound), and an alarm is issued that includes at least one of a report containing detection information and response results.

[0088] That is, compared to the existing client (200) which is equipped with a GPU and a large-capacity artificial intelligence model to build a web firewall system, the present invention can build a web firewall through a low-spec system without a GPU by equipping a lightweight model.

[0089] Additionally, as another embodiment, the present invention includes a method for creating a lightweight artificial intelligence for a lightweight artificial intelligence web firewall detection system that can operate on a client (200) without a GPU.

[0090] FIG. 8 is a flowchart illustrating a method for creating a lightweight artificial intelligence for a lightweight artificial intelligence web firewall detection system that can operate on a client without a GPU according to the present invention.

[0091] Referring to FIG. 8, the method for producing a lightweight artificial intelligence according to the present invention includes a step S100 of collecting raw data, a step S200 of removing duplicate data, a step S300 of preprocessing data, a step S400 of generating a training dataset, a step S500 of generating a teacher model and a student model to perform knowledge distillation, a step S600 of lightweighting the student model to generate a detection model, and a step S700 of verifying the lightweight detection model and distributing it to a client (200).

[0092] Step S100 is a step in which the raw data collection unit (110) collects data from various sources, such as web log files, HTTP request and response data, and script files, using a data collection tool according to the configured data source and data type. Here, the raw data collection unit (110) installs an automated data collection agent on a contracted web server or client (200) to monitor HTTP requests and responses in real time and generate logs.

[0093] Step S200 is a step in which the duplicate data removal unit (120) removes duplicate data from raw data using a hash function or a database duplicate removal algorithm.

[0094] Step S300 is a step in which the data preprocessing unit (130) performs cleaning, feature extraction, and labeling of raw data. Here, the data preprocessing unit (130) removes missing values ​​and outliers from the collected data by applying a data cleansing algorithm, and converts the data collected from various sources into a consistent format through a normalization technique.

[0095] Additionally, the data preprocessing unit (130) performs feature engineering to extract a feature from a web request log that includes at least one of a URL pattern, a request method, and a response code.

[0096] In addition, the data preprocessing unit (130) can label each data point as normal or malicious, and the labeled data can be converted into a training dataset.

[0097] Step S400 is a step in which the training dataset generation unit (140) generates a training dataset in which patterns of normal and malicious data points are learned. The training dataset generation unit generates training and validation datasets by dividing the data preprocessed by the data preprocessing unit (130) using training and unsupervised learning algorithms. At this time, the divided dataset is labeled data and has data points with normal or malicious patterns.

[0098] In addition, the training dataset generation unit (140) divides the training and validation datasets to have a ratio of 8:2 and performs oversampling, undersampling, or SMOTE (Synthetic Minority Over-sampling Technique) techniques to prevent imbalance in the divided datasets.

[0099] The training dataset can be classified into General, Method-Enforcement, Scanner-Detection, Protocol-Enforcement, Protocol-Attack, and Application-Attack based on configured user-defined rules.

[0100] Each group classified according to user-defined rules is divided into sub-data groups by ID (Rule ID), and each group has different features and includes patterns based on whether it is normal or malicious.

[0101] Additionally, the training dataset includes individual training datasets containing only at least one web attack configured as a frequently occurring and / or identified web attack.

[0102] Step S500 is a step in which the knowledge distillation unit (150) generates a teacher model and a student model, and transfers the knowledge learned from the teacher model to the student model. Specifically, Step S500 is explained with reference to FIG. 9.

[0103] Figure 9 is a flowchart illustrating step S500.

[0104] Referring to FIG. 9, step S500 includes step S510 for training a teacher model, step S520 for generating a soft target, step 530 for training a student model, and step S540 for performing model optimization.

[0105] Step S510 is a step in which the knowledge distillation unit (150) selects and creates a teacher model as a high-performance large deep learning model (e.g., BERT (Bidirectional Encoder Representations from Transformers), GPT) and trains the created teacher model with a training dataset.

[0106] Step S520 is the step of generating a soft target that defines the probability distribution predicted by the teacher model for each data point.

[0107] Step S530 is the step of generating a student model using a neural network model, a lightweight RNN, or a CNN that is lighter than the teacher model, and training the student model using the teacher model's soft target and ground truth labels. Here, the student model's loss function includes the difference between the soft target and the original ground truth labels.

[0108] Here, the student model is trained with individual training data capable of learning only one or more configured web attacks. Alternatively, the student model can learn pattern-based detection to detect the remaining unconfigured attacks along with the individual training dataset.

[0109] Step S540 is a step that executes an optimization process to remove unnecessary parameters using techniques such as deep learning pruning or knowledge distillation.

[0110] Step S600 is a step of lightweighting a student model using TensorFlow Lite's optimization tools and quantization options so that the lightweighting unit (160) can be installed on a client (200) that does not have a GPU.

[0111] Here, the lightweighting unit (160) converts the optimized student model into TensorFlow Lite, optimizes it using the optimization tool of TensorFlow Lite, and lightweights the weight values ​​of the optimized student model by converting them, for example, into 8-bit integers using the quantization option of TensorFlow Lite.

[0112] Step S700 is a step in which the verification unit (170) verifies the performance of a lightweight student model (detection model) using a verification dataset and distributes it to a client (200). Here, the verification unit (170) improves the performance of the model by evaluating the model performance using an evaluation metric that includes at least one of accuracy, precision, recall, and F1 score using the verification dataset.

[0113] The verified and / or improved student model (detection model) is distributed to the client (200) by the distribution unit (180) in the form of being stored on a wired or wireless communication or recording medium.

[0114]

[0115] Although the present invention has been described above with reference to limited embodiments and drawings, the invention is not limited thereto, and it is obvious that various modifications and variations are possible by those skilled in the art to which the invention pertains.

[0116]

[0117] Furthermore, those skilled in the art related to the embodiments described above will understand that they may be implemented in modified forms without departing from the essential characteristics of the description. Therefore, the disclosed methods should be considered in an illustrative rather than a limiting sense. The scope of the invention is defined by the claims, not by the foregoing description, and all variations within the scope of equivalence should be interpreted as being included in the invention.

Claims

1. a) A step of collecting data including at least one of web log files, HTTP request and response data, and script files, according to a data source and data type in which a model creation component is configured; b) A step in which a model generation unit and a duplicate data removal unit remove duplicate data from raw data using a hash function or a database duplicate removal algorithm; c) A step of preprocessing data by refining and normalizing collected data, extracting features including at least one of URL patterns, request methods, and response codes, and labeling data points to include normal or malicious patterns; d) A step of generating a training dataset as labeled data containing normal and malicious patterns, wherein the model generation component; e) A step in which a model generation component trains a student model using a teacher model trained on a training dataset; f) a step of lightweighting the student model as a quantization model so that the model generation component can be installed and run on a client without a GPU; and g) a step of verifying a lightweight student model and distributing it to a client; a method for creating a lightweight artificial intelligence characterized by including 2. In Claim 1, step e) is e-1) A step of selecting and generating a teacher model as a high-performance large-scale deep learning model, and training the generated teacher model with a training dataset; e-2) A step of generating a soft target that defines the probability distribution predicted by the teacher model for each data point; e-3) A step of creating a student model using a neural network model, a lightweight RNN, or a CNN that is lighter than the teacher model, and training the student model using the teacher model's soft target and correct label; and e-4) An optimization step of removing unnecessary parameters using deep learning pruning or knowledge distillation techniques; a method for creating a lightweight artificial intelligence that operates on a GPU-less client.

3. In Claim 1, step f) is A method for creating a lightweight artificial intelligence that operates on a GPU-less client, characterized by converting a student model to TensorFlow Lite, optimizing it using TensorFlow Lite's optimization tools, and lightweighting the optimized student model by converting the weight values ​​of the optimized student model into 8-bit integers using TensorFlow Lite's quantization options.

4. In Claim 1, the training dataset in step d) is A method for creating a lightweight artificial intelligence that operates on a GPU-less client, characterized by being split into training and validation datasets having a ratio of 8:

2.

5. In claim 4, step d) is A method for creating a lightweight artificial intelligence that operates on a GPU-less client, characterized by executing techniques of oversampling, undersampling, or SMOTE (Synthetic Minority Over-sampling Technique) to prevent imbalance in a partitioned dataset.

6. In Claim 1, the lightweight student model A method for creating a lightweight artificial intelligence that operates on a GPU-less client, characterized by being an individual model that has learned only at least one attack set as a frequently occurring or identified web attack.

7. A model generation component for generating and deploying lightweight artificial intelligence; and A client that detects risks by being equipped with lightweight artificial intelligence deployed from a model generation component; comprising, The absence of model creation is Raw data collection unit that collects raw data; Duplicate data removal unit that removes duplicate data from raw data; A data preprocessing unit that performs preprocessing including cleaning raw data, feature extraction, and labeling; A training dataset generation unit that generates a training dataset by dividing preprocessed data into training and validation datasets at a set ratio; Generate a teacher model and a student model that is lighter than the teacher model, and train the teacher model using a training dataset to provide a knowledge distillation unit to the student model; A lightweighting unit that quantizes the weight values ​​of data points of a student model and converts them into a lightweight model; and A web firewall detection system using lightweight artificial intelligence that operates on a GPU-less client, comprising a verification unit that verifies and evaluates a lightweight student model using a verification dataset.

8. In Claim 7, the training dataset generating unit A web firewall detection system using lightweight artificial intelligence operating on a GPU-less client, characterized by splitting the training and validation datasets in an 8:2 ratio.

9. In Claim 7, the knowledge distillation part The teacher learning module is a teacher learning module that selects and trains a teacher model; A soft target generation module that generates soft targets by inputting a training dataset into a teacher model; A student learning module that generates a student model using a neural network model lighter than the teacher model, a lightweight RNN (Recurrent Neural Network) or CNN (Convolutional Neural Network), and trains the student model using soft targets and correct labels; and A web firewall detection system using lightweight artificial intelligence that operates on a GPU-less client, comprising: an optimization module that optimizes a student model by removing unnecessary parameters using deep learning pruning or knowledge distillation techniques.

10. In Claim 7, the lightweighting part A lightweight transformation module that converts the student model to TensorFlow Lite and optimizes it using TensorFlow Lite's optimization tools; and A web firewall detection system using lightweight artificial intelligence operating on a GPU-less client, comprising: a quantization generation module that lightweights the weight values ​​of an optimized student model by converting them into 8-bit integers using the quantization option of TensorFlow Lite.

11. In claim 7 or claim 11, the lightweight student model A method for creating a lightweight artificial intelligence that operates on a GPU-less client, characterized by being an individual model that has learned only at least one attack set as a frequently occurring or identified web attack.

Images