TIIS (한국인터넷정보학회)
Current Result Document :
| 한글제목(Korean Title) |
Semi-supervised based Unknown Attack Detection in EDR Environment |
| 영문제목(English Title) |
Semi-supervised based Unknown Attack Detection in EDR Environment |
| 저자(Author) |
Chanwoong Hwang
Doyeon Kim
Taejin Lee
|
| 원문수록처(Citation) |
VOL 14 NO. 12 PP. 4909 ~ 4926 (2020. 12) |
한글내용
(Korean Abstract) |
|
영문내용
(English Abstract) |
Cyberattacks penetrate the server and perform various malicious acts such as stealing confidential information, destroying systems, and exposing personal information. To achieve this, attackers perform various malicious actions by infecting endpoints and accessing the internal network. However, the current countermeasures are only anti-viruses that operate in a signature or pattern manner, allowing initial unknown attacks. Endpoint Detection and Response (EDR) technology is focused on providing visibility, and strong countermeasures are lacking. If you fail to respond to the initial attack, it is difficult to respond additionally because malicious behavior like Advanced Persistent Threat (APT) attack does not occur immediately, but occurs over a long period of time. In this paper, we propose a technique that detects an unknown attack using an event log without prior knowledge, although the initial response failed with anti-virus. The proposed technology uses a combination of AutoEncoder and 1D CNN (1-Dimention Convolutional Neural Network) based on semi-supervised learning. The experiment trained a dataset collected over a month in a real-world commercial endpoint environment, and tested the data collected over the next month. As a result of the experiment, 37 unknown attacks were detected in the event log collected for one month in the actual commercial endpoint environment, and 26 of them were verified as malicious through VirusTotal (VT). In the future, it is expected that the proposed model will be applied to EDR technology to form a secure endpoint environment and reduce time and labor costs to effectively detect unknown attacks.
|
| 키워드(Keyword) |
Endpoint Security
EDR
Unknown Attack Detection
AutoEncoder
1D CNN
|
| 파일첨부 |
PDF 다운로드
|
