System and method for detecting network intrusion

• US 20070150954A1
• Filed: 11/27/2006
• Published: 06/28/2007
• Est. Priority Date: 12/27/2005
• Status: Abandoned Application

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: Shon, Tae-Shik
• Application Number:
  US11/604,229
• Publication Number:
  US 20070150954A1
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

In a system and method for detecting network intrusion, the system comprises: a packet capturer which captures at least one packet on a network; a preprocessor which provides feature values dependent on features of each packet captured by the packet capturer; and a learning engine for classifying patterns dependent on the feature values provided by the preprocessor into two different pattern sets, and for selecting one pattern set having more elements from the pattern sets as a reference set so as to detect network intrusion. The network intrusion detection system and method do not depend on historical data according to known attack patterns, and thus not only detect a changed attack pattern but also efficiently detect network intrusion.

Claims

1. A system for detecting network intrusion, comprising:

a packet capturer for capturing at least one packet on a network;

a preprocessor for providing feature values dependent on features of each said at least one packet captured by the packet capturer; and

a learning engine for classifying patterns, dependent on the feature values provided by the preprocessor, into two different pattern sets, and for selecting one pattern set having more elements from the pattern sets as a reference set so as to detect network intrusion.

2. The system of claim 1, wherein the preprocessor provides the feature values in correspondence to field values of the packet.

3. The system of claim 1, wherein the learning engine comprises:

a learning unit for generating a hyperplane classifying the patterns dependent on the feature values into the two different pattern sets, for converging a bias term of the hyperplane to an origin of a two-dimension plane so as to select the reference set, and for generating a reference profile dependent on patterns of the reference set; and

a detection unit for comparing a packet feature value on the network with the reference profile so as to detect network intrusion.

4. A system for detecting network intrusion, comprising:

a learning unit for classifying patterns dependent on at least one packet feature value on a network into two different pattern sets using a support vector machine (SVM) technique, for adjusting a position of a hyperplane classifying the pattern sets, and for generating a reference profile according to one reference set; and

a detection unit for comparing a packet feature value on the network with the reference profile so as to detect network intrusion.

5. The system of claim 4, wherein the learning unit classifies the patterns into the two pattern sets using the following formula:

$\underset{w,b,\mathrm{\Xi <br><br>}}{\mathrm{Minimize}<br><br>}<br><br><br><br>\mathrm{\Phi <br><br>}<br><br>\left(w,b,\mathrm{\Xi <br><br>}\right)=\frac{1}{2}<br><br>{<br><br>w<br><br>}^2+C<br><br>\underset{i=1}{\overset{l}{\sum <br><br>}}<br><br><br><br>{\mathrm{\xi <br><br>}}_i^k$ $\mathrm{Subject}<br><br><br><br>\mathrm{to}<br><br><br><br>y_i<br><br>\left({\mathrm{\omega <br><br>}}^T<br><br>\mathrm{\phi <br><br>}<br><br>\left(x_i\right)+b\right)\ge <br><br>1-{\mathrm{\xi <br><br>}}_i,{\mathrm{\xi <br><br>}}_i\ge <br><br>0,i=1,l$

where w is an adjustable weight vector variable, x_i is an input-pattern vector variable, b is a bias term variable, and ξ

is an error-correction variable.

6. The system of claim 5, wherein the learning unit converges a bias term of the hyperplane (ω

^Tx_i+b=0), classifying the patterns into the two pattern sets, to the origin of a two-dimension plane, and selects the reference set using the following formula;

soft margin SVM without a bias≅

one-class SVM

$\frac{1}{2}<br><br>{<br><br>w<br><br>}^2+C<br><br>\underset{i=1}{\overset{l}{\sum <br><br>}}<br><br><br><br>{\mathrm{\xi <br><br>}}_i^k\cong <br><br>\frac{1}{2}<br><br>{<br><br>w<br><br>}^2+\frac{1}{\mathrm{vl}}<br><br>\underset{i-1}{\overset{l}{\sum <br><br>}}<br><br><br><br>{\mathrm{\xi <br><br>}}_i^k-p$ $y_i<br><br>\left({\mathrm{\omega <br><br>}}^T<br><br>\mathrm{\phi <br><br>}<br><br>\left(x_i\right)\right)\ge <br><br>1-{\mathrm{\xi <br><br>}}_i,\cong <br><br>y_i<br><br>\left({\mathrm{\omega <br><br>}}^T<br><br>\mathrm{\phi <br><br>}<br><br>\left(x_i\right)\right)\ge <br><br>p-{\mathrm{\xi <br><br>}}_i,<br><br>0<<br><br>v<<br><br>1,1<<br><br>1,0\le <br><br>p$

where v is a variable representing a distance from the origin to the hyperplane, and l is a variable representing the maximum number of elements in a pattern set.

7. The system of claim 4, wherein the learning unit selects the reference set using the following formula:

$\mathrm{Minimize}<br><br>\frac{1}{2}<br><br>{<br><br>w<br><br>}^2+C<br><br>\underset{i=1}{\overset{l}{\sum <br><br>}}<br><br><br><br>{\mathrm{\xi <br><br>}}_i^k-E,0<<br><br>C<<br><br>1$ $\mathrm{Subject}<br><br><br><br>\mathrm{to}<br><br><br><br>y_i<br><br>\left({\mathrm{\omega <br><br>}}^T<br><br>\mathrm{\phi <br><br>}<br><br>\left(x_i\right)\right)\ge <br><br>E-\mathrm{\xi <br><br>},,0<<br><br>E<<br><br>1$

where w is an adjustable weight vector variable, xi is an input-pattern vector variable, b is a bias term variable, and ξ

is an error-correction variable.

8. The system of claim 4, wherein the learning unit generates the hyperplane classifying the respective patterns of each packet using a support vector machine (SVM) technique by mapping each pattern to a higher dimension plane, and processes patterns distributed at an origin after mapping the patterns as outliers to a two-dimension plane using a feature mapping function.

9. A method for detecting network intrusion, comprising the steps of:

capturing at least one packet on a network;

deriving feature values dependent on features of each said at least one captured on the network packet;

classifying the patterns dependent on the feature values into two different pattern sets;

selecting a pattern set having more elements from the two different pattern sets as a reference set so as to generate a reference profile; and

comparing a feature value of a packet with the reference profile so as to detect network intrusion.

10. The method of claim 9, wherein the step of deriving feature values comprises deriving a feature value corresponding to each field value of said at least one packet.

11. The method of claim 9, wherein the step of classifying the patterns comprises generating a hyperplane classifying respective patterns into the two different pattern sets.

12. The method of claim 9, wherein the step of selecting a pattern set to generate a reference profile comprises the steps of:

converging a bias term of a hyperplane classifying patterns to an origin of a two-dimension plane, and selecting the reference set; and

generating the reference profile dependent on patterns of the reference set.

13. A method for detecting network intrusion, comprising the steps of:

classifying patterns dependent on at least one packet feature value on a network into two different pattern sets using a support vector machine (SVM) technique;

adjusting a position of a hyperplane classifying the two different pattern sets so as to select one reference set;

generating a reference profile dependent on patterns of said one reference set; and

comparing a feature value of a packet with the reference profile so as to detect network intrusion.

14. The method of claim 13, wherein the step of classifying the patterns comprises classifying the patterns into the two pattern sets using the following formula:

$\underset{w,b,\mathrm{\Xi <br><br>}}{\mathrm{Minimize}}<br><br><br><br>\mathrm{\Phi <br><br>}<br><br>\left(w,b,\mathrm{\Xi <br><br>}\right)=\frac{1}{2}<br><br>{<br><br>w<br><br>}^2+C<br><br>\underset{i=1}{\overset{l}{\sum <br><br>}}<br><br><br><br>{\mathrm{\xi <br><br>}}_i^k$ $\mathrm{Subject}<br><br><br><br>\mathrm{to}<br><br><br><br>y_i<br><br>\left({\mathrm{\omega <br><br>}}^T<br><br>\mathrm{\phi <br><br>}<br><br>\left(x_i\right)+b\right)\ge <br><br>1-{\mathrm{\xi <br><br>}}_i,{\mathrm{\xi <br><br>}}_i\ge <br><br>0,i=1,l$

where w is an adjustable weight vector variable, x_i is an input-pattern vector variable, b is a bias term variable, and ξ

is an error-correction variable.

15. The method of claim 13, wherein the step of adjusting a position of the hyperplane classifying the two different pattern sets so as to select one reference set comprises converging a bias term of the hyperplane (ω

^Tx_i+b=0) classifying the patterns into the two pattern sets to an origin of a two-dimension plane, and processing a first pattern set as an outlier of a second pattern set using the following formula;

soft margin SVM without≅

bias one-class SVM

$\frac{1}{2}<br><br>{<br><br>w<br><br>}^2+C<br><br>\underset{i=1}{\overset{l}{\sum <br><br>}}<br><br><br><br>{\mathrm{\xi <br><br>}}_i^k\cong <br><br>\frac{1}{2}<br><br>{<br><br>w<br><br>}^2+\frac{1}{\mathrm{vl}}<br><br>\underset{i-1}{\overset{l}{\sum <br><br>}}<br><br><br><br>{\mathrm{\xi <br><br>}}_i^k-p$ $y_i<br><br>\left({\mathrm{\omega <br><br>}}^T<br><br>\mathrm{\phi <br><br>}<br><br>\left(x_i\right)\right)\ge <br><br>1-{\mathrm{\xi <br><br>}}_i,\cong <br><br>y_i<br><br>\left({\mathrm{\omega <br><br>}}^T<br><br>\mathrm{\phi <br><br>}<br><br>\left(x_i\right)\right)\ge <br><br>p-{\mathrm{\xi <br><br>}}_i,<br><br>0<<br><br>v<<br><br>1,1<<br><br>1,0\le <br><br>p$

where v is a variable representing a distance from an origin to the hyperplane, and l is a variable representing a maximum number of elements in a pattern set.

16. The method of claim 13, wherein the step of adjusting a position of a hyperplane classifying the two different pattern sets so as to select one reference set comprises selecting the reference set for the patterns using the following formula:

$\mathrm{Minimize}<br><br>\frac{1}{2}<br><br>{<br><br>w<br><br>}^2+C<br><br>\underset{i=1}{\overset{l}{\sum <br><br>}}<br><br><br><br>{\mathrm{\xi <br><br>}}_i^k-E,0<<br><br>C<<br><br>1$ $\mathrm{Subject}<br><br><br><br>\mathrm{to}<br><br><br><br>y_i<br><br>\left({\mathrm{\omega <br><br>}}^T<br><br>\mathrm{\phi <br><br>}<br><br>\left(x_i\right)\right)\ge <br><br>E-\mathrm{\xi <br><br>},,0<<br><br>E<<br><br>1$

where w is an adjustable weight vector variable, x_i is an input-pattern vector variable, b is a bias term variable, and ξ

is an error-correction variable.

17. The method of claim 13, wherein the step of classifying patterns comprises generating a hyperplane classifying patterns of each said at least one packet using a support vector machine (SVM) technique by mapping the patterns to a higher dimension plane, and mapping the patterns to a two-dimension plane using a feature mapping function.