Packet Anomaly Detection with BERT Attention-Based Pseudo-Abnormal Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing abnormality detection systems face challenges in setting an appropriate threshold value for detecting abnormal packets due to the difficulty in preparing actual cyber attack data, leading to inaccurate detection.
Innovation Solution
An abnormality detection device generates pseudo-abnormal packets by rewriting important byte portions of normal packets using a BERT model's Attention mechanism and determines a threshold value based on the abnormality degrees of these pseudo-abnormal and normal packet groups.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If a predetermined value is added to the average value of abnormality degrees of normal data to set the threshold, then the threshold can be determined without actual cyber attack data, but the threshold does not adequately separate the degree of anomaly between normal and abnormal data
Solution Approach 1:
The patent applies preliminary action by generating pseudo-abnormal packets in advance before actual threshold determination. These synthetic packets simulate abnormal characteristics without requiring real attack data. The threshold is then determined based on the abnormality degrees of both normal packets and these pre-generated pseudo-abnormal packets, enabling accurate threshold setting while avoiding the need to collect actual cyber attack data.
2Measurement precision
If actual cyber attack data is collected to determine the threshold, then the threshold can adequately separate normal and abnormal data, but it is difficult to obtain sufficient abnormal data
Solution Approach 1:
The patent applies copying by creating pseudo-abnormal packets that replicate the characteristics of actual abnormal packets without needing real attack data. These synthetic packets are generated by modifying normal packets to exhibit abnormal features, thereby providing sufficient training data for threshold determination while avoiding the difficulty of collecting actual cyber attack data.
3Reliability
If the threshold is set too low to detect all abnormal packets, then detection coverage increases, but false positives increase and normal packets may be misidentified
Solution Approach 1:
The patent applies feedback by using the abnormality degrees calculated from both normal packets and pseudo-abnormal packets to determine an optimal threshold. This threshold is specifically calibrated to achieve F1 optimization, balancing detection coverage and false positive rate. The feedback loop ensures that the threshold is neither too low (causing false positives) nor too high (missing abnormalities), but optimally positioned to distinguish normal from abnormal packets accurately.
Data Source
AI summary
An abnormality detection device includes processing circuitry configured to input a normal packet to a Bidirectional Encoder Representations from Transformers (BERT) model learned using the normal packet, and acquire a size of Attention for each byte portion when encoding of the normal packet is performed, sample an important byte portion of the normal packet based on the size of the Attention of each byte portion of the normal packet acquired, and rewrite the sampled important byte portion to a random byte to generate a pseudo-abnormal packet, and determine a threshold value of an abnormality degree for detecting an abnormal packet based on the abnormality degree of the generated pseudo-abnormal packet group and normal packet group.