APPARATUS AND METHOD FOR DETECTING ANOMALOUS TRAFFIC

• US 20090138590A1
• Filed: 04/15/2008
• Published: 05/28/2009
• Est. Priority Date: 11/26/2007
• Status: Active Grant

• Current Assignee: IZEX Co., Ltd., Mobileconvergence Co., Ltd.
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: LEE, Eun Young, SOHN, Ki Wook, PARK, In Sung, YUN, Joo Beom, PAEK, Seung Hyun
• Granted Patent: US 7,716,329 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

An apparatus and method for detecting anomalous traffic are provided. More particularly, an apparatus and method for detecting anomalous traffic based on entropy of network traffic are provided. The apparatus of detecting anomalous traffic includes: an entropy extraction module for extracting entropy from network traffic; a visualization module for generating an entropy graph based on the entropy; a graph model experience module for updating a graph model for each network attack based on the entropy graph; and an anomalous traffic detection module for detecting anomalous traffic based on the entropy graph and the graph model for each network attack and outputting the detection results to a user. In the apparatus and method, anomalous traffic is detected based on network entropy rather than simple statistics based on the amount of traffic, so that a false alarm rate of the apparatus for detecting anomalous traffic can be reduced.

Claims

1. An apparatus for detecting anomalous traffic, comprising:

an entropy extraction module for extracting entropy from network traffic;

a visualization module for generating an entropy graph based on the entropy;

a graph model experience module for updating a graph model for each network attack based on the entropy graph; and

an anomalous traffic detection module for detecting anomalous traffic based on the entropy graph and the graph model for each network attack and outputting the detection results to a user.

2. The apparatus of claim 1, wherein the entropy comprises source IP address entropy, source port entropy, destination IP address entropy, and destination port entropy.

3. The apparatus of claim 2, wherein the entropy graph is a radial graph that represents the source IP address entropy, the source port entropy, the destination IP address entropy, and the destination port entropy.

4. The apparatus of claim 1, wherein the graph model experience module calculates a degree of threat for each network attack based on the entropy graph, and determines whether a graph model for each network attack is to be updated or not based on the degree of threat.

5. The apparatus of claim 1, wherein the graph model experience module comprises one or more 4-dimensional vector clusters corresponding to each network attack, and the graph model corresponds to centroid vectors of the one of more 4-dimensional vector clusters corresponding to each network attack.

6. The apparatus of claim 5, wherein the graph model experience module performs clustering on the 4-dimensional vector clusters corresponding to each network attack using the entropy graph generated by the visualization module.

7. A method of detecting anomalous traffic, comprising:

extracting entropy from network traffic;

generating an entropy graph based on the entropy;

updating a graph model for each network attack based on the entropy graph;

detecting anomalous traffic based on the entropy graph and the graph model for each network attack; and

outputting the detection results to a user.

8. The method of claim 7, wherein the entropy comprises source IP address entropy, source port entropy, destination IP address entropy, and destination port entropy.

9. The method of claim 8, wherein the entropy graph is a radial graph that represents the source IP address entropy, the source port entropy, the destination IP address entropy, and the destination port entropy.

10. The method of claim 7, wherein the updating the graph model for each network attack comprises:

calculating a degree of threat for each network attack based on the entropy graph;

determining whether the graph model for each network attack is to be updated or not based on the degree of threat; and

updating the graph model for each network attack according to the determination.

11. The method of claim 7, wherein the updating the graph model for each network attack comprises performing clustering on 4-dimensional vector clusters corresponding to each network attack using the entropy graph.