Apparatus and method for detecting traffic flooding attack and conducting in-depth analysis using data mining

Patent metadata

Field	Value
Publication number	US-9230102-B2
Application number	US-201313869151-A
Country	US
Kind code	B2
Filing date	Apr 24, 2013
Priority date	Apr 26, 2012
Publication date	Jan 5, 2016
Grant date	Jan 5, 2016

Abstract

Provided is an apparatus and method for detecting a traffic flooding attack and conducting an in-depth analysis using data mining that may rapidly detect a distributed denial of service (DDoS) attack, for example, a traffic flooding attack, developed more variously and firmly from a denial of service (DoS) attack, perform an attack type classification, and conduct a semantic analysis with respect to the attack. The apparatus and method may support a system operation and provide a more stable service, by rapidly detecting a traffic flooding attack, classifying a type of the attack, and conducting a semantic analysis based on a prediction and analysis scheme of data mining.

First claim

What is claimed is:

1. An apparatus for detecting a traffic flooding attack and conducting an in-depth analysis using data mining, the apparatus comprising:
a generator that generates a management information base (MIB) based on network traffic data;
a sensor that determines, by collecting the MIB, a point in time at which a detection system is operated;
a storage that stores an MIB determined by the detection system analyzing the MIB;
an attack determiner that determines whether an attack is detected and a type of the attack, based on the determined MIB; and
an offline processor configured to both randomly generate various traffic attacks to execute a C4.5-based learning, and to conduct an in-depth semantic interpretation that extracts and analyzes data characteristics of data stored in the storage in a form of rule, the rule associated with the C4.5-based learning and the in-depth semantic interpretation comprising a selection and reduction processes using “IF-THEN” algorithm corresponding to types of traffic flooding attacks,
the selection and reduction being performed using association rule mining by calculating conditional probability of entropy between a target class and attributes comprising X and Y,
the calculation being performed based on determination whether or not the attribute Y being highly or repeatedly distributed, correlated, or occurred when the attribute X is given, wherein
a number of meaningless rules are generated according to the determination if attribute Y being rarely distributed, correlated, or occurred when the attribute X is given, and wherein
the offline processor is connected to one network and receives the monitoring network traffic data from the one network.

2. The apparatus of claim 1 , wherein the detection system generates various arbitrary traffic attacks and performs a decision tree based learning.

3. The apparatus of claim 1 , further comprising:
an association rule apparatus that conducts a semantic in-depth analysis for extracting and analyzing features of data stored in the storage in a form of a rule.

4. The apparatus of claim 3 , further comprising:
a managing apparatus that monitors detailed information regarding real-time attack detection and classification performed by the attack determiner, and to utilize semantic analysis information and rules provided by the association rule apparatus and the detection system for policy establishment of an intrusion detection and response system.

5. The apparatus of claim 1 , wherein the attack determiner reports an intrusion to the managing apparatus in real time when attack traffic is detected.

6. The apparatus of claim 1 , wherein the attack determiner classifies attack traffic into a transmission control protocol-synchronize sequence numbers (TCP-SYN) flooding attack, a user datagram protocol (UDP) flooding attack, and an Internet control message protocol (ICMP) flooding attack, and provides additional information on a type of a corresponding attack.

7. A method of detecting a traffic flooding attack detection and conducting an in-depth analysis using data mining, the method comprising:
generating a management information base (MIB) based on network traffic data;
determining, by collecting the MIB, a point in time at which a detection system is operated;
storing an MIB determined by the detection system analyzing the MIB;
determining whether an attack is detected and a type of the attack, based on the determined MIB;
both randomly generating various traffic attacks to execute a C4.5-based learning, and conducting an in-depth semantic interpretation that extracts and analyzes data characteristics of data stored in the storage in a form of rule, the rule associated with the C4.5-based learning comprising a selection and reduction processes using “IF-THEN” algorithm corresponding to types of traffic flooding attacks,
the selection and reduction being performed using association rule mining by calculating conditional probability of entropy between a target class and attributes comprising X and Y, and
the calculation being performed based on determination whether or not the attribute Y being highly or repeatedly distributed, correlated, or occurred when the attribute X is given; and
generating a number of meaningless rules according to the determination if attribute Y being rarely distributed, correlated, or occurred when the attribute X is given.

8. The method of claim 7 , further comprising:
generating various arbitrary traffic attacks and performing a decision tree based learning.

9. The method of claim 7 , further comprising:
conducting a semantic in-depth analysis for extracting and analyzing features of the stored MIB in a form of a rule.

10. The method of claim 9 , further comprising:
monitoring detailed information regarding real-time attack detection and classification with respect to the determining of whether an attack is detected and a type of the attack, and utilizing semantic analysis information and rules provided by the conducting of the semantic in-depth analysis and the detection system for policy establishment of an intrusion detection and response system.

11. The method of claim 7 , the determining of whether an attack is detected and a type of the attack comprises reporting an intrusion in real time when attack traffic is detected.

12. The method of claim 7 , wherein the determining of whether an attack is detected and a type of the attack comprises classifying attack traffic into a transmission control protocol-synchronize sequence numbers (TCP-SYN) flooding attack, a user datagram protocol (UDP) flooding attack, and an Internet control message protocol (ICMP) flooding attack, and providing additional information on a type of a corresponding attack.

Assignees

• Korea Electronics Telecomm

Inventors

• Yu Jae Hak
• Lee Byung Bog
• Bang Hyo Chan

Classifications

• G06F21/55 Primary

  Detecting local intrusion or implementing counter-measures · CPC title

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/1458

  Denial of Service · CPC title

• G06F11/30

  Monitoring · CPC title

• G06F17/00

  Digital computing or data processing equipment or methods, specially adapted for specific functions (information retrieval, database structures or file system structures therefor G06F16/00) · CPC title