APPARATUS AND METHOD FOR DETECTING ANOMALY OF NETWORK

• US 20150304346A1
• Filed: 08/17/2012
• Published: 10/22/2015
• Est. Priority Date: 08/19/2011
• Status: Abandoned Application

• Current Assignee: Korea University Research and Business Foundation
• Original Assignee: Korea University Research and Business Foundation
• Inventors: KIM, Huy Kang
• Application Number:
  US14/239,733
• Publication Number:
  US 20150304346A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Disclosed are an apparatus and method for detecting an anomaly of a network and a recording medium on which the method is recorded. The method for detecting an anomaly in a network measures self-similarity from at least one attribute information representing a traffic state of the network in a normal state in advance to set a critical value for the self-similarity, measures self-similarity in real time from the at least one attribute information in the network, and determines an anomaly of the network by comparing the measured real-time self-similarity value with the set critical value.

Claims

1. A method for detecting an anomaly in a network according to a predetermined standard by using a detection device having at least one processor in the network, the method comprising:

measuring self-similarity from at least one attribute information representing a traffic state of the network in a normal state in advance and setting a critical value for the self-similarity;

measuring self-similarity in real time from the at least one attribute information in the network; and

determining an anomaly of the network by comparing the measured real-time self-similarity value with the set critical value.

2. The method according to claim 1, wherein said setting of a critical value for the self-similarity includes:

measuring at least one attribute information representing a traffic state of the network at regular time intervals in the normal state;

calculating a sample mean and dispersion from the measured attribute information;

calculating a parameter for durability of a statistical phenomenon of the network traffic by using the calculated dispersion and the time interval; and

setting a predetermined magnification of the calculated parameter as a critical value for the self-similarity.

3. The method according to claim 2,

wherein the parameter is a Hurst parameter, and

wherein the Hurst parameter conforms to a log value of the calculated dispersion and a slope value of a regression line by a regression analysis of a log value of the time interval.

4. The method according to claim 1,

wherein the attribute information is at least one of packet information of the network, attribute information about a security state of a system in the network, and a function value representing states of the network and the system.

5. The method according to claim 4, wherein the attribute information for a security state of the system includes at least one of:

inherent identifier (security ID, SID) information endowed to a user or a work group which accesses the system; and

security event information (Event ID) of the system.

6. The method according to claim 4, wherein the function value representing a state of the system includes at least one of:

a function value representing an occurrence number of inherent identifier information endowed to a user or a work group which accesses the system and an occurrence number of security event information of the system; and

a snapshot vector in which all objects of a function value representing the occurrence number are grouped.

7. The method according to claim 1,

wherein the attribute information is obtained from at least one of a packet in network and an event log of a system in the network.

8. The method according to claim 1, wherein said determining of an anomaly of the network includes:

comparing the measured real-time self-similarity value with the set critical value; and

determining that the network has an anomaly when the measured real-time self-similarity value is lower than the set critical value as a result of the comparison.

9. The method according to claim 1,

wherein network traffics of the normal state have self-similarity in which a plurality of network traffics having different scales with respect to time vary have similarity.

10. The method according to claim 1,

wherein the predetermined standard is a supervisory control and data acquisition (SCADA) system having a constant and repeated network pattern with self-similarity.

11. A computer-readable recording medium, on which a program for executing the method defined in claim 1 in a computer is recorded.

12. An apparatus for detecting an anomaly of a network in a predetermined standard having a constant and repeated network pattern with self-similarity, the apparatus comprising:

a storage unit for storing a critical value set by measuring self-similarity from at least one attribute information representing a traffic state of the network in a normal state in advance;

a measuring unit for measuring self-similarity in real time from the at least one attribute information in the network; and

a determining unit for determining an anomaly of the network by comparing the measured real-time self-similarity value with the set critical value.

13. The apparatus according to claim 12,

wherein at least one attribute information representing a traffic state of the network is measured at regular time intervals in the normal state,

a sample mean and dispersion is calculated from the measured attribute information,

a parameter for durability of a statistical phenomenon of the network traffic is calculated by using the calculated dispersion and the time interval, and

a predetermined magnification of the calculated parameter is set as a critical value for the self-similarity and stored in the storage unit.