합성곱신경망을 이용한 KDD Cup 1999 데이터분석 = Analysis for the KDD Cup 1999 Data Using the Convolutional Neural Network

다국어 초록 (Multilingual Abstract)

KDD Cup 1999 data has been used for the network intrusion detection studies. This data is analyzed using the convolutional neural networks in this paper. Many researchers have analyzed this data using the aritificial intelligence techniques such as TAVSM, decision tree algorithm and random forest algorithm etc. Although multilayer neural networks also have been used in these analysis, convolutional neural networks models have not been used. LeNet-5 among the various convolutional neural networks models is used with Keras for this analysis. At the first method, the 10% training set of the KDD Cup 1999 dividing into training set and testing set is used. At the second method, the 10% training set is used for train and testing set is used for test. The results are compared with the result of analysis using the mutlilayer neural networks uploaded in Kaggle web site. Because attacks are classified into 4 types in KDD Cup 1999 data, the performance measures are calculated by each attack types. LeNet-5 shows the better perfomance than the multilayer neural networks uploaded to Kaggle web site at both methods in all performance measures.

국문 초록 (Abstract)

KDD Cup 1999 데이터는 네트워크침입탐지 연구에 많이 이용된 데이터셋이다. 본 연구에서는 합성곱신경망을 이용해서 이 데이터를 분석하였다. 그 동안 이 데이터에 대한 TASVM, 의사결정트리 알고리즘, 랜덤포레스트알고리즘 등의 인공지능기법을 이용한 많은 분석이 이루어졌다. 그리고 다층신경망을 통한 분석도 이루어져왔지만 합성곱신경망을 이용한 접근은 거의 없었다. 합성곱신경망중 LeNet-5를 이용하여 Keras를 사용해서 분석을 하였다. 첫 번째 방법에서는 KDD Cup 1999의 10%훈련셋을 훈련셋과 테스트셋으로 나누어 분석하였다. 그리고 두 번째 방법에서는 10%훈련셋으로는 훈련하고 테스트는 테스트셋을 사용하여 분석하였다. 그리고 이 두 가지 방법의 결과를 캐글 웹사이트에 올려진 다층신경망과 비교하였다. KDD Cup 1999 데이터에는 침입유형을 크게 4가지로 분류하는데 각 유형별로 성능척도를 계산하였다. 그 결과 2가지 방법 모두에서 LeNet-5가 캐글에 올려진 다층신경망보다 우수한 성능을 나타냈다.

참고문헌 (Reference)

• 1 알리타 알폰소나 럭바훈가, "네트워크침입탐지에의 랜덤포레스트알고리즘 적용" 차세대컨버전스정보서비스학회 8 (8): 187-202, 2019
• 2 E. Fix, "k-nearest neighbors algorithm"
• 3 E. Fix, "k-means clustering"
• 4 V. Vapnik, "Support-vector machine"
• 5 R. Saravanan, "State of Art Techniques on Machine Learning Algorithms: A Perspective of Supervised Learning Approaches in Data Classification" 945-949, 2018
• 6 B. Shah, "Reducing Features of KDD CUP 1999 Dataset for Anomaly Detection Using Back Propagation Neural Network" 247-251, 2015
• 7 S. Devaraju, "Performance analysis of intrusion detection system using various neural network classifiers" 1033-1038, 2011
• 8 M. Tavallaee, "NSL-KDD dataset"
• 9 A. Goldbloom, "Kaggle"
• 10 D. Dheeru, "KDD Cup 1999 Data Data Set"
• 11 Y. Byun, "Intrusion Detection System-accuracy"
• 12 Y. Lecun, "Gradient-based learning applied to document recognition" 86 (86): 2278-2324, 1998
• 13 I. Goodfellow, "Generative adversarial network"
• 14 S. Fook, "GAN for anomaly detection"
• 15 P. Tang, "Feature Selection and Design of Intrusion Detection System Based on k-Means and Triangle Area Support Vector Machine" 144-148, 2010
• 16 S. Behera, "Deep Neural Network Architecture for Anomaly Based Intrusion Detection System" 270-274, 2018
• 17 R. Quinlan, "Decision tree"
• 18 W. McCulloch, "Artificial neural network"
• 19 M. Li, "Application of CART decision tree combined with PCA algorithm in intrusion detection" 38-41, 2017
• 20 H. Shi, "An enhanced GHSOM for the intrusion detection" 1-5, 2015
• 21 F. Chollet, "About Keras"
• 22 T. Roempluk, "A Machine Learning Approach for Detecting Distributed Denial of Service Attacks" 146-149, 2019