公开(公告)号：US20220159021A1

公开(公告)日：2022-05-19

申请号：US17528203

申请日：2021-11-17

Applicant: FOUNDATION OF SOONGSIL UNIVERSITY-INDUSTRY COOPERATION

Inventor： Minhae KWON ,  Hyoseon KYE

IPC: H04L29/06

Abstract: An anomaly detection method includes searching for one principal component axis by analyzing a normal data set collected in time series from a plurality of IoT devices by using a principal component analysis technique, setting a center point of the principal component, receiving a currently measured measurement data set from the plurality of IoT devices, acquiring a linear transformation data set having a plurality of projection points as elements by projecting a plurality of measurement data which is each element in the measurement data set onto the principal component axis, calculating a Mahalanobis distance between the projection point and the central point, and detecting whether or not data of the IoT devices is abnormal by comparing the Mahalanobis distance calculated for each element with a threshold.

公开(公告)号：US20230351198A1

公开(公告)日：2023-11-02

申请号：US17979728

申请日：2022-11-02

Applicant: FOUNDATION OF SOONGSIL UNIVERSITY- INDUSTRY COOPERATION

Inventor： Minhae KWON ,  Hyoseon KYE ,  Miru KIM

IPC: G06N3/091 ,  H04L9/40 ,  G06N3/0455

CPC classification number: G06N3/091 ,  H04L63/1425 ,  G06N3/0455

Abstract: The present disclosure provides a hierarchical network intrusion detection method including preprocessing normal data for training, outputting reconstruction data by inputting the preprocessed normal data for training into an autoencoder, calculating a reconstruction error by using the preprocessed normal data for training and the reconstruction data, training the autoencoder to minimize a reconstruction error, extracting hierarchical information of the autoencoder, setting a threshold value by using latent vector for the normal data for training, the reconstruction data, and an output value of each of L hidden layers included in an encoder, calculating anomaly scores of the latent vector for the network data, the reconstruction data, and an output value of each of the L hidden layers in a state in which a target network data is input to the autoencoder, and determining whether an intrusion into the network data is detected by using the threshold value and the anomaly scores.