METHOD AND APPARATUS FOR GENERATING ADAPTIVE SECURITY MODEL

• US 20120159622A1
• Filed: 12/12/2011
• Published: 06/21/2012
• Est. Priority Date: 12/21/2010
• Status: Abandoned Application

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: LEE, Seungmin
• Application Number:
  US13/323,263
• Publication Number:
  US 20120159622A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures

Abstract

A method for generating an adaptive security model includes: generating an initial security model with respect to data input via an Internet during a learning process; and continuously updating the initial security model by applying characteristics of the input data during an online process. Said generating an initial security model includes: matching the input data with a unit having a weight vector with distance closest to the input data using a first unsupervised algorithm; generating a map composed of weight vectors of units; and performing a second unsupervised algorithm using the weight vectors forming the map as input values to partition an attack cluster.

Claims

1. A method for generating an adaptive security model, the method comprising:

generating an initial security model with respect to data input via an Internet during a learning process; and

continuously updating the initial security model by applying characteristics of input data during an online process.

2. The method of claim 1, wherein said generating the initial security model includes:

matching input data with units having weight vectors with distances closest to the input data by using a first unsupervised algorithm;

performing a second unsupervised algorithm using the weight vectors forming a map as input values to partition an attack cluster.

3. The method of claim 1, wherein said updating the initial security model includes:

checking the distances between the input data and the weight vectors of the units matching with the input data;

adding a new unit when each of the distances is more than a preset threshold value, and then determining whether input data related to the distance is normal data or attack data; and

updating weight vector related to the distance when the distance is less than a preset threshold value.

4. The method of claim 3, further comprising, after said updating the weight vector:

checking an accumulated change value of weight vectors of units belonging to an attack cluster of the input data; and

updating a centroid of the attack cluster when the accumulated change value of the weight vectors is more than a preset threshold value.

5. The method of claim 4, wherein the centroid is measured by calculating an average value of the units belonging to the attack cluster.

6. The method of claim 4, further comprising, after said updating a centroid:

checking a degree of change in a normal cluster of the input data; and

partitioning a new attack cluster from a normal cluster when the degree of change of the normal cluster exceeds a preset threshold value.

7. The method of claim 2, wherein the first unsupervised algorithm is a self organizing map (SOM) algorithm.

8. The method of claim 2, wherein the second unsupervised algorithm is a K-means algorithm.

9. An apparatus for generating an adaptive security model, the apparatus comprising:

an adaptive learning unit for matching input data with a map of units forming a low-dimensional space; and

a dynamic clustering unit for partitioning a cluster, wherein the adaptive learning unit and the dynamic clustering unit are used in a learning and an on-line processes.

10. The apparatus of claim 9, wherein the adaptive learning unit matches the input data with units having weight vectors with distances closest to the input data by using a first unsupervised algorithm.

11. The apparatus of claim 10, wherein the adaptive learning unit adds a new unit when each of the distances is more than a preset threshold value, and then determines whether input data related to the distance is normal data or attack data.

12. The apparatus of claim 10, wherein when each of the distances is less than the preset threshold value, the adaptive learning unit updates a weight vector related to the distance.

13. The apparatus of claim 10, wherein the dynamic clustering unit performs a second unsupervised algorithm using weight vectors of the units forming the map as input values to partition an attack cluster.

14. The apparatus of claim 12, wherein, after updating the weight vector, the dynamic clustering unit updates a centroid of the attack cluster when an accumulated change value of the weight vectors of the units belonging to an attack cluster of the input data is more than a preset threshold value.

15. The apparatus of claim 14, wherein the centroid is measured by calculating an average value of the units belonging to the attack cluster.

16. The apparatus of claim 14, wherein, after updating the centroid, the dynamic clustering unit partitions a new attack cluster from a normal cluster when a degree of change in a normal cluster of the input data exceeds a preset threshold value.

17. The apparatus of claim 10, wherein the first unsupervised algorithm is a self organizing map (SOM) algorithm.

18. The apparatus of claim 13, wherein the second unsupervised algorithm is a K-means algorithm.