METHOD AND APPARATUS FOR ADAPTIVE UNKNOWN ATTACK DETECTION SYSTEM USING SWARM INTELLIGENCE AND MACHINE LEARNING ALGORITHMS

摘要

An attack detection method according to an embodiment of the present invention includes the steps of: collecting sample network traffic; performing clustering on the sample network traffic included in predetermined similarity based on swarm intelligence and machine learning algorithms in a clustering engine as the sample network traffic is collected; learning clustering results according to the clustering of the sample network traffic in a detection engine, monitoring real network traffic and detecting an attack with the learned detection engine in real time; and sampling the traffic wrongly detected in the adaptive detection engine according to the attack detection, labeling the sampled traffic into an attack or normal traffic, and transmitting feedback to the clustering engine. Accordingly, the present invention can effectively detect an unknown attack.;COPYRIGHT KIPO 2017