Soongsil University Research Team Develops Network Intrusion Detection Technology Based on Traffic Data

A schematic diagram of the hierarchical anomaly detection method developed by the Soongsil University research team. Provided by Soongsil University

[Asia Economy Reporter Byungdon Yoo] A research team led by Professor Minhye Kwon of the Department of Electronic Information Engineering at Soongsil University has developed a network intrusion detection technology capable of stepwise detection according to the degree of anomalies based on network traffic data.

Using this technology, when the degree of anomaly is high, it can be detected more quickly than existing methods through a preemptive detection process, and through a reexamination detection process, abnormal traffic that could not be detected by existing methods can also be precisely detected.

The research team proposed a hierarchical anomaly detection method utilizing the hidden layers of an autoencoder and an anomaly score measurement method specialized for each detection stage to immediately detect abnormal data according to the degree of anomaly in network traffic and improve detection performance.

Sungkyul University Gye Hyo-seon, Kim Mir Master’s Program, Professor Kwon Min-hye. / Photo by Sungkyul University Jae-gong

The anomaly status of network traffic data is detected through three major detection processes: the output of the encoder (preemptive detection process), the output of the decoder, and the output of each encoder hidden layer for the restored data re-input to the encoder (reexamination detection process). In the reexamination detection process, the restoration error of the restored data is amplified through the encoder's hidden layers, and detection performance for abnormal data was improved using the newly proposed anomaly score measurement method.

Existing autoencoder-based anomaly detection technologies use only the decoder's output, but the proposed technology adds preemptive detection and reexamination detection processes, enabling fast and precise detection without any changes to the previously trained autoencoder model.

Student Hyoseon Gye explained, "While conducting this research, I was able to extensively consider ways to utilize the latent information contained in the model's hidden layers. I hope this technology will be applied to many more anomaly detection systems."

Meanwhile, the research was published in the 'IEEE Signal Processing Letters' on the 31st of last month, and a patent application has been completed in the Republic of Korea. Currently, a U.S. patent application is also underway.

This content was produced with the assistance of AI translation services.