Method and apparatus for identifying the type of cyber-attack against IoT devices

1. A method for classifying a cyber-attack, the method being performed in a computing device having an artificial neural network, and comprising:

obtaining a plurality of features extracted from collected packets; and

inputting the plurality of features into the artificial neural network and using data output from the artificial neural network to determine a type of cyber-attack indicated by the collected packets,

wherein the artificial neural network comprises an input layer with a first dimension, an encoder layer with a second dimension smaller than the first dimension to receive a first output value from the input layer, a representation layer with a third dimension smaller than the second dimension to receive a second output value from the encoder layer, and a classifier layer to directly receive a third output value from the representation layer and to output a probability for each class, and

wherein the plurality of features comprise a count of destination IPs of packets transmitted from the same source IP during a reference time, a count of source IPs of packets transmitted to the same destination IP during the reference time, a count of source ports of packets with the same source IP and the same destination IP during the reference time, and a count of destination ports of packets with the same source IP and the same destination IP during the reference time.

2. The method of claim 1 , wherein the collected packets include packets transmitted by an IoT (Internet of Things) device and packets transmitted to the IoT device.

3. The method of claim 1 , wherein the plurality of features further comprise a count of packets transmitted from the same source IP during the reference time, a count of packets transmitted to the same destination IP during the reference time, a count of packets transmitted from the same source port of the same source IP during the reference time, and a count of packets transmitted from the same destination port of the same destination IP during the reference time.

4. The method of claim 3 , wherein the plurality of features further comprise a count of packets transmitted from the same source port of the same source IP during the reference time, and a count of packets transmitted from the same destination port of the same destination IP during the reference time.

5. The method of claim 1 , wherein the plurality of features further comprise a count of fragmented packets.

6. The method of claim 1 , wherein the plurality of features further comprise a TCP window size and a data length, wherein the TCP window size is set based on the plurality of features indicating a TCP protocol packet, and wherein the data length is set based on the plurality of features indicating a transport layer packet.

7. The method of claim 1 , wherein the plurality of features further comprise a data size transmitted from the same source IP during the reference time, and a data size transmitted to the same destination IP during the reference time.

8. The method of claim 1 , wherein the plurality of features further comprise a proportion of SYN packets with an SYN flag set.

9. The method of claim 8 , wherein the plurality of features further comprise a difference value between a count of the SYN packets and a count of ACK packets associated with the SYN packets.

10. The method of claim 1 , wherein the plurality of features further comprise an ICMP type and an ICMP code.

11. The method of claim 10 , wherein the ICMP type is represented by a 7-dimensional one-hot vector, and

wherein the ICMP code is represented by a 7-dimensional one-hot vector.

12. The method of claim 10 , wherein the plurality of features further comprise a proportion of ICMP packets from the same source IP during the reference time, and a proportion of ICMP packets from the same destination IP during the reference time.

13. The method of claim 1 , wherein the plurality of features further comprise an OP (Opcode) value of an ARP packet.

14. The method of claim 13 , wherein the OP (Opcode) value of the ARP packet is represented by a three-dimensional one-hot vector.

15. The method of claim 1 , wherein the collected packets include packets transmitted by an IoT (Internet of Things) device and packets transmitted to the IoT device,

wherein the classifier layer outputs a total of 10 class-specific probabilities including 9 IoT device target cyber-attack type classes and 1 normal class, and

wherein the 9 cyber-attack type classes comprise:

a Reconnaissance-Host Discovery class;

a Reconnaissance-Port Scanning class;

a Reconnaissance-OS and Service Detection class;

a MITM (Man In The Middle)-ARP Spoofing Attack class;

a DoS (Denial of Service)-SYN Flooding Attack class;

a Mirai Botnet-DDoS Attack-UDP Flooding Attack class;

a Mirai Botnet-DDoS Attack-HTTP Flooding Attack class;

a Mirai Botnet-DDoS Attack-ACK Flooding Attack class; and

a Mirai Botnet Propagation-Scan & Brute-force class.

16. The method of claim 1 , wherein the classifier layer includes nodes that output a probability for each class, wherein an output from each node is an output value from softmax function, and wherein a sum of the outputs from all nodes equal to 1,

wherein the artificial neural network further comprises an output layer, the output layer including one node that receives the probability for each class from the classifier layer and outputs a value indicating the type of cyber-attack.

17. The method of claim 1 , wherein the classifier layer outputs a total of 10 class-specific probabilities, including 9 cyber-attack type classes and 1 normal class, and

wherein the representation layer has a dimension of less than 10.

18. An apparatus for classifying a cyber-attack, comprising:

a feature extractor for extracting a plurality of features from collected packets;

an artificial neural network including an input layer with a first dimension, an encoder layer with a second dimension smaller than the first dimension to receive a first output value from the input layer, a representation layer with a third dimension smaller than the second dimension to receive a second output value from the encoder layer, and a classifier layer to directly receive a third output value from the representation layer and to output a probability for each class; and

a cyber-attack classification unit for inputting the plurality of features into the artificial neural network and for using data output from the artificial neural network to determine a type of cyber-attack indicated by the collected packets, and

wherein the plurality of features further comprise a count of destination IPs of packets transmitted from the same source IP during a reference time, a count of source IPs of packets transmitted to the same destination IP during the reference time, a count of source ports of packets with the same source IP and the same destination IP during the reference time, and a count of destination ports of packets with the same source IP and the same destination IP during the reference time.

19. A method for training a model to classify a cyber-attack against an IoT device, the method being performed in a computing device, and comprising:

obtaining a plurality of features extracted from collected packets;

inputting a learning data set comprising the plurality of features into an auto encoder artificial neural network and training the auto encoder artificial neural network in unsupervised learning;

constructing an artificial neural network for attack classification including an input layer, an encoder layer, and a representation layer of the learned auto encoder artificial neural network, and further including a classifier layer that directly receives an output value from the representation layer and outputs a probability for each class; and

training the artificial neural network for attack classification by supervised learning,

wherein the input layer has a first dimension, the encoder layer has a second dimension smaller than the first dimension, and the representation layer has a third dimension smaller than the second dimension.

20. The method of claim 19 , wherein the artificial neural network further includes an output layer having one node that receives the probability for each class from the classifier layer and outputs a value indicating a type of cyber-attack, and wherein back-propagation occurs no further than weights between the representation layer and the classifier layer in the training the auto encoder artificial neural network.