侵入検知システムのためのグラフ構造に基づいた機械学習および可視化 / Graph Based Machine Learning and Visualization for Intrusion Detection System

3 3 9 2 0 4 -78 -78 8 1

എܠ ໨త ఏҊख๏ ࣮ݧ݁Ռ τϥϑΟοΫσʔλͷάϥϑԽ ఏҊख๏ᶃɿڭࢣͳֶ͠शܕ
ఏҊख๏ᶄɿڭࢣ͋Γֶशܕ ·ͱΊ

ਤ μʔΫωοτʹ͓͚Δ೥ؒ૯؍ଌύέοτ਺ ԯԯԯ ԯ ԯ ԯ ԯ ԯ
ԯ ԯ ԯ ਤ Πϯλʔωοτʹ઀ଓ͕Մೳͳػثٴͼηϯαʔ ωοτϫʔΫͷ຤୺ͱͯ͠࢖ΘΕΔ୺຤ͷ୆਺ ૯຿ল৘ใ௨৴നॻɿIUUQXXXTPVNVHPKQNFOV@TFJTBLVIBLVTZPJOEFYIUNM /*$5&3؍ଌϨϙʔτɿ IUUQTXXXOJDUHPKQDZCFSSFQPSU/*$5&3@SFQPSU@QEG զʑ͕ීஈར༻͢ΔΠϯλʔωοτ͸ɼεϚϗ΍*P5σόΠεͷٸ଎ͳීٴ ʹ൐͍ɼࠓ΍͔ܽ͢͜ͱ͕Ͱ͖ͳ͍ࣾձج൫ͱͳ͍ͬͯΔɽͱ͜Ζ͕ɼαΠό ʔ߈ܸͷڴҖ΋೥ʑ૿Ճ͍ͯ͠ΔɽͦͷͨΊɼαΠόʔ߈ܸରࡦͷඞཁੑ͕ߴ ·͖͍ͬͯͯΔɽ

α Π ό ʔ ߈ ܸ ର ࡦ
ͷ ̍ ͭ ͱ ͠ ͯ ɼ ෆ ਖ਼ ͳ ௨ ৴ Λ ݕ ஌ ͢ Δ ৵ೖݕ஌γεςϜ *%4 *OUSVTJPO %FUFDUJPO 4ZTUFN ͕ଘࡏ͢Δɽ ಛʹ࠷ۙͰ͸ɼػցֶशܕ*%4ͷݚڀ͕੝ΜʹߦΘΕ͍ͯΔɽ ͦΕͧΕҟͳΔར఺Λ༗͍ͯ͠Δ ڭࢣ͋Γֶशܕ ϥϕϧͷ͍ͭͨڭࢣσʔλΛֶश͢ Δख๏ • Lۙ๣๏ • χϡʔϥϧωοτϫʔΫ ͳͲ ਖ਼ৗσʔλ ҟৗσʔλ ֶश Ϟσϧ ৽نσʔλ Ϟσϧ ط஌ͷ߈ܸʹ༗ޮ σʔλͷେଟ਺͸ਖ਼ৗͰ͋ΔͱԾఆͯ͠ɼ ਖ਼ৗσʔλͷΈΛֶश͢Δख๏ • LNFBOT๏ • 0OFDMBTT47. ͳͲ ڭࢣͳֶ͠शܕ ະ஌ͷ߈ܸʹ༗ޮ ֶश ৽نσʔλ ਖ਼ৗσʔλ ਖ਼ৗϞσϧ ਖ਼ৗϞσϧ

ҟৗݕ஌ τϥϑΟοΫ ݕূ ରॲ ͲΜͳҟৗʁ ຊ౰ʹҟৗʁ ਖ਼ৗҟৗ
ҟৗͷछྨ ख๏ ༧ଌਫ਼౓ ֶशର৅ จݙ χϡʔϥϧωοτϫʔΫ ਖ਼ৗҟৗ αϙʔτϕΫλʔϚγϯ ਖ਼ৗҟৗ -45. ҟৗͷछྨʢछʣ ϕΠδΞϯωοτϫʔΫ ҟৗͷछྨʢछʣ ද ػցֶशܕ*%4ͷઌߦݚڀͷྫ ͢Ͱʹߴ͍༧ଌਫ਼౓͕ใࠂ͕ଘࡏ ଟ͘ͷ࣌ؒΛඅ΍͢ 4.VLLBNBMB FUBM 5SBJOJOH +,JNFUBM ``JO1SPD*OU$POG1MBUGPSN5FDIOPM4FSWJDF r 4$IFCSPMV FUBM $PNQVUFST4FDVSJUZ ݕূʹଟ͘ͷ࣌ؒΛඅ΍͢͜ͱΛආ͚ΔͨΊɼݕূͷॿ͚ʹͳΔ൑அࡐྉͷఏ ڙ͕ඞཁͰ͋Δɽ

ը૾ॲཧͷ෼໺Ͱ͸ɼೖྗը૾ͷͲͷ෦෼͕ॏཁͰ͋Δ͔Λఆྔత਺஋͓Αͼ ͦΕʹج͍ͮͨՄࢹԽʹΑͬͯ൑ఆ݁ՌΛઆ໌͢Δख๏͕͢ͰʹఏҊ͞Ε͍ͯΔ ਤ ൑ఆ݁ՌͷՄࢹԽʹΑΔઆ໌ΛՄೳʹͨ͠ઌߦݚڀ .3JCFJSP 44JOHIBOE$(VFTUSJO *O1SPDFFEJOHTPGUIFOE"$.4*(,%%*OUFS
OBUJPOBM$POGFSFODFPO,OPXMFEHF%JTDPWFSZBOE %BUB.JOJOH ,%% 3'POH "7FEBMEJ *O1SPDFFEJOHTPG1SPDFFEJOHTPGUIF*&&&*OUFSOBUJPOBM$POGFSFODFPO$PNQVUFS7JTJPO *$$7 ਤ ൑ఆ݁ՌͷՄࢹԽʹΑΔઆ໌ΛՄೳʹͨ͠ઌߦݚڀ

ը૾ॲཧͷ෼໺Ͱ͸ɼೖྗը૾ͷͲͷ෦෼͕ॏཁͰ͋Δ͔Λఆྔత਺஋͓Αͼ ͦΕʹج͍ͮͨՄࢹԽʹΑͬͯ൑ఆ݁ՌΛઆ໌͢Δख๏͕͢ͰʹఏҊ͞Ε͍ͯΔ ਤ ൑ఆ݁ՌͷՄࢹԽʹΑΔઆ໌ΛՄೳʹͨ͠ઌߦݚڀ .3JCFJSP 44JOHIBOE$(VFTUSJO *O1SPDFFEJOHTPGUIFOE"$.4*(,%%*OUFS
OBUJPOBM$POGFSFODFPO,OPXMFEHF %JTDPWFSZBOE%BUB.JOJOH ,%% 3'POH "7FEBMEJ *O1SPDFFEJOHTPG1SPDFFEJOHTPGUIF*&&&*OUFSOBUJPOBM$POGFSFODFPO$PNQVUFS7JTJPO *$$7 ਤ ൑ఆ݁ՌͷՄࢹԽʹΑΔઆ໌ΛՄೳʹͨ͠ઌߦݚڀ *%4ʹ͓͍ͯ΋ɼ τϥϑΟοΫͷͲͷཁૉ͕ݕ஌݁Ռʹରͯ͠Өڹ͍͔ͯͨ͠ Λ ఆྔత਺஋ʹج͍ͮͨՄࢹԽʹΑͬͯઆ໌ Ͱ͖Ε͹ɼݕূͷॿ͚ͱͳΔ

DARPA 1998 Dataset
*1 5$1 )551 4:/ "$, ྫʣ ֤ϑΟʔϧυ৘ใ͸ɼϓϩτίϧʹैͬͨ࣌ܥྻతڍಈΛࣔ͢ɽ 4ZO 4ZO "DL "DL ྫ ΢ΣΠϋϯυγΣΠΫ τϥϑΟοΫσʔλΛෳ਺ͷཁૉͱͦΕΒͷؔ܎ੑΛ௚ײతʹཧղͰ͖Δ άϥϑߏ଄Ͱදݱ͢Δ͜ͱʹண໨ͨ͠ɽ ҎԼͷఆٛʹΑΓɼτϥϑΟοΫΛάϥϑߏ଄Խ͢Δɽ ϊʔυɿϑΟʔϧυ৘ใ ΤοδɿϑΟʔϧυ৘ใͷ࣌ܥྻతڍಈͷ૬ؔ άϥϑߏ଄Խ

*1
5$1 )551 4:/ "$, 4ZO 4ZO "DL "DL 4ZO 4ZO "DL *1 5$1 )551 4:/ "$, ૬ؔؔ܎ͷ่Ε ڭࢣͳֶ͠श ˠ ҟৗ ˠ ਖ਼ৗ άϥϑߏ଄Խ ྫʣ ϥϕϧͷ෇༩ ڭࢣ͋Γֶश τϥϑΟοΫͷάϥϑߏ଄ԽΛར༻͠ɼఆྔత਺஋ʹج͍ͮͨՄࢹԽʹΑ ͬͯݕ஌݁Ռʢҟৗʣͷઆ໌͕Ͱ͖Δػցֶशܕ*%4ͷ࣮ݱΛ໨తͱ͢Δɽ छྨͷػցֶशख๏ ՄࢹԽͷྫʣ ϊʔυ ෦෼άϥϑ

ఏҊख๏ᶄ ڭࢣ͋Γֶशܕ %"31" ෳ਺ͷ࣌ܥྻಛ௃ྔΛநग़ ର਺ࠩ෼ܥྻσʔλ΁ͷม׵ ඪ४Խ ૄߏ଄ֶशʢ(SBQIJDBM-BTTPʣ
άϥϑͷ่Ε άϥϑ৞ΈࠐΈ // ఏҊख๏ᶃ ڭࢣͳֶ͠शܕ άϥϑߏ଄Խͨ͠τϥϑΟοΫσʔλʹج͍ͮͨ̎छྨͷػցֶशख๏Λ ར༻ͨ͠*%4ΛఏҊ͢Δɽ લॲཧ σʔληοτ άϥϑߏ଄Խ ఏҊख๏ᶃɼᶄ

ि ༵೔ ߈໊ܸ ࣌ؒ ݄ GPSNBU
݄ GGC Ր MPBENPEVMF ʜ ʜ ʜ ʜ ۚ OFQUVOF ۚ TNVSG ۚ OFQUVOF ۚ CBDL ද %"31"%BUBTFUͷ߈ܸ৘ใ ఏҊख๏Ͱ͸ɼϥϕϧ͕෇༩͞ΕͨύέοτΩϟϓνϟܕͷτϥϑΟοΫ͕ ඞཁͰ͋ΔͨΊɼ%"31"Λ࢖༻ͨ͠ɽຊσʔληοτ͸ɼԾ૝తʹߏங ͨ͠ωοτϫʔΫ΁ͷ߈ܸΛ૝ఆͨ͠ͱ͖ͷ5DQEVNQσʔλ͓Αͼ߈ܸ৘ใΛ ఏڙ͍ͯ͠Δɽ 4:/GMPPE 4NVSG %"31"σʔληοτ dि ͷ͏ͪɼ ि໨ͷ༵ۚ೔ͷσʔλΛ࢖༻ͨ͠ 4ZO 4ZO "DL QJOH

ఏҊख๏ᶃ ڭࢣͳֶ͠शܕ छྨͷ࣌ܥྻಛ௃ྔʹ෼ղ ର਺ࠩ෼ ෼ࠩ෼ %"31" ෳ਺ͷ࣌ܥྻಛ௃ྔΛநग़
ର਺ࠩ෼ܥྻσʔλ΁ͷม׵ ඪ४Խ ૄߏ଄ֶशʢ(SBQIJDBM-BTTPʣ άϥϑͷ่Ε άϥϑ৞ΈࠐΈ // ఏҊख๏ᶄ ڭࢣ͋Γֶशܕ

ʜ ʜ %"31" ෳ਺ͷ࣌ܥྻಛ௃ྔΛநग़ ର਺ࠩ෼ܥྻσʔλ΁ͷม׵ ඪ४Խ ૄߏ଄ֶशʢ(SBQIJDBM-BTTPʣ ΢Οϯυ΢αΠζ෼
ຊݚڀͰ͸ɼ-੍໿෇͖ͷૄߏ଄ֶशख ๏Ͱ͋Δ(SBQIJDBM-BTTPΛར༻͠ɼ෼ͷ ΢Οϯυ΢αΠζͰάϥϑߏ଄Խͨ͠ɽ ఏҊख๏ᶃ ڭࢣͳֶ͠शܕ άϥϑͷ่Ε άϥϑ৞ΈࠐΈ // ఏҊख๏ᶄ ڭࢣ͋Γֶशܕ

ʜ ʜ ૄߏ଄ֶशʢ(SBQIJDBM-BTTPʣ άϥϑͷ่Ε ఏҊख๏ᶃ ڭࢣͳֶ͠शܕ ਖ਼ৗάϥϑ άϥϑO άϥϑN
ҟৗ౓ɿਖ਼ৗͳ૬ؔάϥϑ͕ͲΕ่͚ͩΕ͔ͨ ʜ ʜ ΢Οϯυ΢αΠζ෼ %"31" ෳ਺ͷ࣌ܥྻಛ௃ྔΛநग़ ର਺ࠩ෼ܥྻσʔλ΁ͷม׵ ඪ४Խ άϥϑ৞ΈࠐΈ // ఏҊख๏ᶄ ڭࢣ͋Γֶशܕ 5*EF "$-P[BOP /"CFBOE:-JV1SPYJNJUZ CBTFE"OPNBMZ%FUFDUJPOVTJOH4QBSTF4USVDUVSF-FBSO JOH *O1SPDFFEJOHTPG *&&&*OUFSOBUJPOBM$PO GFSFODF PO"DPVTUJDT 4QFFDIBOE4JHOBM1SPDFTTJOH *$"441 ˞άϥϑߏ଄ͷఆٛ෦෼ʹಠࣗੑ͸͋Δ͕ɼάϥ ϑߏ଄ͷ่ΕʹΑΔҟৗݕ஌͸ɼҪखΒ ͕ఏҊ ͨ͠ख๏Λར༻͍ͯ͠Δɽ

ʜ ʜ ΢Οϯυ΢αΠζ෼ ఏҊख๏ᶄ ڭࢣ͋Γֶशܕ
ग़ྗ: ʢਖ਼ৗҟৗʣ ෼ྨ 1PPMJOH 'JOHFSQSJOU 1PPMJOH 'JOHFSQSJOU ̍ۙ๣ ۙ๣ ʜ ʜ // ˎ 8 ˎ 8 ˎ 8 $POW૚ $POW૚ ˎ 8 ˎ 8 ˎ 8 ೖྗ ૄߏ଄ֶशʢ(SBQIJDBM-BTTPʣ άϥϑ৞ΈࠐΈ // %"31" ෳ਺ͷ࣌ܥྻಛ௃ྔΛநग़ ର਺ࠩ෼ܥྻσʔλ΁ͷม׵ ඪ४Խ ఏҊख๏ᶃ ڭࢣͳֶ͠शܕ άϥϑͷ่Ε άϥϑ৞ΈࠐΈχϡʔϥϧωοτϫʔΫ 'JOHFSQSJOU௕ɿ ࠷େۙ๣਺ɿ ӅΕ૚αΠζɿ όοναΠζɿ ΤϙοΫ਺ɿ σʔλͷׂ߹ʢ܇࿅ɿݕূʣɿ70:30 ($//ͷֶशύϥϝʔλ

άϥϑ৞ΈࠐΈχϡʔϥϧωοτϫʔΫʢ($//ʣ IUUQTMJCSBSZOBJTUKQNZMJNFEJPEMMJNFEJPTIPXQEGDHJ%-1%'3@1 $//ͷ৔߹ ($//ͷ৔߹ $//ͷ৔߹ɼݩը૾ͱϑΟϧλʔͱͷ৞ΈࠐΈԋࢉʹΑΓɼಛఆըૉͱपΓ ͷըૉͱͷؔ܎ੑʢಛ௃ʣΛ࣍ͷ૚΁ͱ౉͢ɽ($//͸ɼϊʔυʹΑͬͯۙ઀ϊ ʔυͷ਺͸ҟͳΔ͕ɼ$//ͱಉ༷ʹ஫໨ϊʔυͱͦͷपΓͷϊʔυͱͷؔ܎ੑΛ ৞ΈࠐΈԋࢉʹΑΓ࣍ͷ૚΁ͱ౉͢ɽ
ਤ άϥϑ৞ΈࠐΈχϡʔϥϧωοτϫʔΫͷུ֓ਤ͓Αͼάϥϑදݱ ਤ ৞ΈࠐΈԋࢉͷྫ͓Αͼάϥϑදݱ ग़ྗ: ʢਖ਼ৗҟৗʣ ෼ྨ 1PPMJOH 'JOHFSQSJOU 1PPMJOH 'JOHFSQSJOU ̍ۙ๣ ۙ๣ ʜ ʜ // ˎ 8 ˎ 8 ˎ 8 $POW૚ $POW૚ ˎ 8 ˎ 8 ˎ 8 ೖྗ ݩը૾ ϑΟϧλʔ I I I I

άϥϑ৞ΈࠐΈχϡʔϥϧωοτϫʔΫʢ($//ʣ %BWJE%VWFOBVE FUBM *OUIF1SPD/*14 .POUSFBM $BOBEB %FDFNFCFS
ຊݚڀͰ͸ɼ($//ͷதͰ΋/'1 /FVSBM 'JOHFS 1SJOUΛར༻͢Δɽઌߦݚڀ Ͱ͸ɼಟੑͳͲͷߴਫ਼౓ͳ༧ଌʹ੒ޭ͠ɼ'JOHFS 1SJOUͷੜ੒ʹ੒ޭͨ͠ɽ 'JOHFS 1SJOU͸ɼೖྗͨ͠άϥϑߏ଄Λ࣍ݩϕΫτϧͰදݱͨ͠΋ͷͰ͋Δɽ ֤Ϗοτ͕෦෼άϥϑʹ૬౰͠ɼ஋͕݁Ռʢಟੑʣʹର͢ΔӨڹ౓ ʹ૬౰͢Δɽ ਤ ಟੑΛ༧ଌ͢ΔͨΊʹ࠷దԽ͞Εͨ'JOHFS1SJOUͷՄࢹԽ ग़ྗ: ʢਖ਼ৗҟৗʣ ෼ྨ 1PPMJOH 'JOHFSQSJOU 1PPMJOH 'JOHFSQSJOU ̍ۙ๣ ۙ๣ ʜ ʜ // ˎ 8 ˎ 8 ˎ 8 $POW૚ $POW૚ ˎ 8 ˎ 8 ˎ 8 ೖྗ ಟ ੑ ʜ ˞ਖ਼֬ʹ͸ɼͰ͸ͳ͘d·Ͱͷ஋ 'JOHFS1SJOU ਤ /'1ͷωοτϫʔΫུ֓ਤ

άϥϑ৞ΈࠐΈχϡʔϥϧωοτϫʔΫʢ($//ʣ %BWJE%VWFOBVE FUBM *OUIF1SPD/*14 .POUSFBM $BOBEB %FDFNFCFS
ຊݚڀͰ͸ɼ($//ͷதͰ΋/'1 /FVSBM 'JOHFS 1SJOUΛར༻͢Δɽઌߦݚڀ Ͱ͸ɼಟੑͳͲͷߴਫ਼౓ͳ༧ଌʹ੒ޭ͠ɼ'JOHFS 1SJOUͷੜ੒ʹ੒ޭͨ͠ɽ 'JOHFS 1SJOU͸ɼೖྗͨ͠άϥϑߏ଄Λ࣍ݩϕΫτϧͰදݱͨ͠΋ͷͰ͋Δɽ ֤Ϗοτ͕෦෼άϥϑʹ૬౰͠ɼ஋͕݁Ռʢಟੑʣʹର͢ΔӨڹ౓ ʹ૬౰͢Δɽ ਤ ಟੑΛ༧ଌ͢ΔͨΊʹ࠷దԽ͞Εͨ'JOHFS1SJOUͷՄࢹԽ ग़ྗ: ʢਖ਼ৗҟৗʣ ෼ྨ 1PPMJOH 'JOHFSQSJOU 1PPMJOH 'JOHFSQSJOU ̍ۙ๣ ۙ๣ ʜ ʜ // ˎ 8 ˎ 8 ˎ 8 $POW૚ $POW૚ ˎ 8 ˎ 8 ˎ 8 ೖྗ ಟ ੑ ʜ ˞ਖ਼֬ʹ͸ɼͰ͸ͳ͘d·Ͱͷ஋ 'JOHFS1SJOU ਤ /'1ͷωοτϫʔΫུ֓ਤ άϥϑԽͨ͠τϥϑΟοΫσʔλΛ($//Ͱֶश͢Δ͜ͱʹΑΓɼ ݕ஌݁ՌʢҟৗʣΛઆ໌Ͱ͖Δ෦෼άϥϑͷՄࢹԽ͕Ͱ͖Δͱߟ͑ΒΕΔɽ

τϥϑΟοΫσʔλͷάϥϑԽ छྨͷ࣌ܥྻಛ௃ྔʹ- ੍໿෇͖ͷૄߏ଄ֶशख๏(SBQIJDBM -BTTPΛద ༻ͨ݁͠Ռɼૄͳ૬ؔؔ܎ͷάϥϑߏ଄͕ಘΒΕΔ͜ͱΛ֬ೝͨ͠ɽ ૄͳάϥϑߏ଄ʹ͢Δ͜ͱʹΑΓɼ৘ใྔͷѹॖ΍ϊΠζ΁ͷؤڧੑʹ༗ޮͰ ͋Δͱߟ͑ΒΕΔɽ (SBQIJDBM-BTTP ਤ
τϥϑΟοΫσʔλ͔Β࡞੒ͨ͠άϥϑߏ଄(SBQIJDBM-BTTPͷద༻લ͓Αͼ ద༻ޙ

ਖ਼ৗঢ়ଶͷάϥϑߏ଄ άϥϑͷ࣌ܥྻ ҟৗ౓ɿਖ਼ৗͳ૬͕ؔͲͷఔ౓่Ε͔ͨ ਖ਼ৗঢ়ଶͱԾఆͨ͠୯Ұͷάϥϑߏ଄ͱάϥϑͷ࣌ܥྻσʔλͱͷҧ͍Λҟ ৗ౓ͱ͠ɼΧϧόοΫɾϥΠϒϥʔڑ཭ʹΑͬͯܭࢉΛߦͬͨ ࣌ؒU
࣌ؒU ҟৗ౓ E 4SD*1 5$1

ਤ %"31"ͷਖ਼ղσʔλ͓Αͼ֤࣌ܥྻಛ௃ྔ ͱఏҊख๏ ʹΑͬͯݕ஌ͨ͠ҟৗͷՄࢹԽ݁Ռ ҟৗɿ 5$1
)551ɼ4:/ɼ ൪ϙʔτʹର͢Δ4:/qPPE߈ܸ ҟৗ̎ɿ 4SD*1 *$.1ɼ ෳ਺ૹ৴ݩ*1͔Β ͭͷૹ৴ઌ*1ʹ ରͯ͠ߦΘΕͨ4NVSG߈ܸ ҟৗ̎ ҟৗ̍ 4ZO 4ZO "DL QJOH

ਖ਼ղσʔλ ༧ଌ݁Ռ άϥϑߏ଄Խͨ͠τϥϑΟοΫσʔλΛ($//Ͱֶशͨ݁͠Ռɼ༧ଌਫ਼౓͕ ͱͳͬͨɽ͜ͷ஋͸ઌߦݚڀͰใࠂ͞Ε͍ͯΔ஋ͱಉఔ౓ʹߴ͍஋Ͱ͋Δɽ ਤ ਖ਼ղσʔλ͓ΑͼֶशϞσϧʹΑΔ༧ଌ݁Ռ
ख๏ ༧ଌਫ਼౓ จݙ χϡʔϥϧωοτϫʔΫ αϙʔτϕΫλʔϚγϯ -45. ϕΠδΞϯωοτϫʔΫ ද ػցֶशܕ*%4ͷઌߦݚڀͷྫ 4.VLLBNBMB FUBM 5SBJOJOH +,JNFUBM ``JO1SPD*OU$POG1MBUGPSN5FDIOPM4FSWJDF r 4$IFCSPMV FUBM $PNQVUFST4FDVSJUZ

($//Ͱֶशͨ͠ϞσϧΛར༻͠ɼ'JOHFS 1SJOUͷऔಘʹ੒ޭͨ͠ɽ 4:/GMPPE߈ܸ࣌ɼҟৗ͕ݕ஌͞Εɼ'JOHFS 1SJOU಺Ͱߴ͍Өڹ౓Λࣔ͢෦ ෼άϥϑ͸ɼ)551ͱ4:/ͷ૬ؔؔ܎ʹؔ࿈͢Δ΋ͷͰ͋ͬͨɽ (a)
(b) ਤ 'JOHFSQSJOU͓ΑͼҟৗͷཁҼͱͳͬͨ෦෼άϥϑͷҰྫ4:/GMPPE߈ܸ ෦෼άϥϑ 'JOHFS1SJOU Өڹ౓

4NVSG߈ܸ࣌ɼ'JOHFS1SJOU಺ͷӨڹ౓ͷߴ͍෦෼άϥϑ͸ɼૹ৴ݩ*1͓Αͼ *$.1ͷ૬ؔؔ܎ʹؔ࿈͢Δ΋ͷͰ͋ͬͨɽ ఏҊख๏ᶄͰ͸ϊʔυؒͷ૬ؔؔ܎ʢ෦෼άϥϑʣͷՄࢹԽͰ͖ΔͨΊɼϊ ʔυͷՄࢹԽͷΈͰ͋ͬͨఏҊख๏ᶃΑΓ΋۩ମతͳઆ໌ੑ͕ظ଴Ͱ͖Δɽ (b) ਤ
'JOHFSQSJOU͓ΑͼҟৗͷཁҼͱͳͬͨ෦෼άϥϑͷҰྫ4:/GMPPE߈ܸ ෦෼άϥϑ 'JOHFS1SJOU Өڹ౓

ग़ྗ: ʢਖ਼ৗҟৗʣ ෼ྨ 1PPMJOH 'JOHFSQSJOU 1PPMJOH 'JOHFSQSJOU ̍ۙ๣ ۙ๣ ʜ ʜ // ˎ 8 ˎ 8 ˎ 8 $POW૚ $POW૚ ˎ 8 ˎ 8 ˎ 8 ೖྗ ఏҊख๏ᶄͰ͸ɼ ਖ਼ৗঢ়ଶ͓Αͼҟৗঢ়ଶΛ෦෼άϥϑ୯ҐͰֶश͢ΔͨΊɼෳ਺ͷਖ਼ৗঢ় ଶ͕ଘࡏ͢Δ৔߹ʹ΋ؤڧͳݕ஌͕ظ଴Ͱ͖Δɽ ਤ /'1ͷωοτϫʔΫུ֓ਤ ఏҊख๏ᶃͷ՝୊ ୯Ұͷਖ਼ৗঢ়ଶΛԾఆ͍ͯ͠ΔͨΊɼෳ਺ͷਖ਼ৗঢ়ଶʢ࣌ؒґଘ΍؀ڥґଘͳ Ͳʣ͕ଘࡏ͢Δ৔߹ʹޡݕ஌͢Δ৔߹͕༧૝͞ΕΔɽ

ఏҊख๏ᶄڭࢣ͋Γֶशܕ ·ͱΊ

·ͱΊ • τϥϑΟοΫσʔλͷάϥϑߏ଄Խʹ੒ޭͨ͠ɽ • άϥϑߏ଄ʹج͍ͮͨ̎छྨͷػցֶशख๏ ʢڭࢣͳֶ͠शܕ͓Αͼڭࢣ͋ΓֶशܕʣΛఏ Ҋͨ͠ɽ •
ҟৗݕ஌ͷΈͳΒͣɼݕ஌݁ՌΛఆྔతͳ਺஋ ʹج͍ͮͨϊʔυ΍෦෼άϥϑͷՄࢹԽʹΑͬ ͯઆ໌Ͱ͖Δ*%4࣮ݱͷՄೳੑΛࣔͨ͠ɽ ࠓޙͷ՝୊ • ࠷৽σʔληοτͰͷ༗ޮੑݕূ • ϊʔυͷछྨͷ࠶ݕ౼ • ڭࢣ͋Γͳ͠ͷ૊Έ߹ΘͤʹΑΔઆ໌ੑͷ޲্ ఏҊख๏ᶄ ڭࢣ͋Γֶशܕ %"31" ෳ਺ͷ࣌ܥྻಛ௃ྔΛநग़ ର਺ࠩ෼ܥྻσʔλ΁ͷม׵ ඪ४Խ ૄߏ଄ֶशʢ(SBQIJDBM-BTTPʣ άϥϑͷ่Ε άϥϑ৞ΈࠐΈ // ఏҊख๏ᶃ ڭࢣͳֶ͠शܕ ͝ਗ਼ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠

侵入検知システムのためのグラフ構造に基づいた機械学習および可視化 / Graph Based Machine Learning and Visualization for Intrusion Detection System

侵入検知システムのためのグラフ構造に基づいた機械学習および可視化 / Graph Based Machine Learning and Visualization for Intrusion Detection System

kumagallium

More Decks by kumagallium

Other Decks in Research

Featured

Transcript

3 3 9 2 0 4 -78 -78 8 1

എܠ ໨త ఏҊख๏ ࣮ݧ݁Ռ τϥϑΟοΫσʔλͷάϥϑԽ ఏҊख๏ᶃɿڭࢣͳֶ͠शܕ

എܠ ໨త ఏҊख๏ ࣮ݧ݁Ռ τϥϑΟοΫσʔλͷάϥϑԽ ఏҊख๏ᶃɿڭࢣͳֶ͠शܕ

ਤ μʔΫωοτʹ͓͚Δ೥ؒ૯؍ଌύέοτ਺ ԯԯԯ ԯ ԯ ԯ ԯ ԯ

α Π ό ʔ ߈ ܸ ର ࡦ

ҟৗݕ஌ τϥϑΟοΫ ݕূ ରॲ ͲΜͳҟৗʁ ຊ౰ʹҟৗʁ ਖ਼ৗҟৗ

ը૾ॲཧͷ෼໺Ͱ͸ɼೖྗը૾ͷͲͷ෦෼͕ॏཁͰ͋Δ͔Λఆྔత਺஋͓Αͼ ͦΕʹج͍ͮͨՄࢹԽʹΑͬͯ൑ఆ݁ՌΛઆ໌͢Δख๏͕͢ͰʹఏҊ͞Ε͍ͯΔ ਤ ൑ఆ݁ՌͷՄࢹԽʹΑΔઆ໌ΛՄೳʹͨ͠ઌߦݚڀ .3JCFJSP 44JOHIBOE$(VFTUSJO O1SPDFFEJOHTPGUIFOE"$.4(,%%*OUFS

ը૾ॲཧͷ෼໺Ͱ͸ɼೖྗը૾ͷͲͷ෦෼͕ॏཁͰ͋Δ͔Λఆྔత਺஋͓Αͼ ͦΕʹج͍ͮͨՄࢹԽʹΑͬͯ൑ఆ݁ՌΛઆ໌͢Δख๏͕͢ͰʹఏҊ͞Ε͍ͯΔ ਤ ൑ఆ݁ՌͷՄࢹԽʹΑΔઆ໌ΛՄೳʹͨ͠ઌߦݚڀ .3JCFJSP 44JOHIBOE$(VFTUSJO O1SPDFFEJOHTPGUIFOE"$.4(,%%*OUFS

DARPA 1998 Dataset

*1

എܠ ໨త ఏҊख๏ ࣮ݧ݁Ռ τϥϑΟοΫσʔλͷάϥϑԽ ఏҊख๏ᶃɿڭࢣͳֶ͠शܕ

ఏҊख๏ᶄ ڭࢣ͋Γֶशܕ %"31" ෳ਺ͷ࣌ܥྻಛ௃ྔΛநग़ ର਺ࠩ෼ܥྻσʔλ΁ͷม׵ ඪ४Խ ૄߏ଄ֶशʢ(SBQIJDBM-BTTPʣ

ि ༵೔ ߈໊ܸ ࣌ؒ ݄ GPSNBU

ఏҊख๏ᶃ ڭࢣͳֶ͠शܕ छྨͷ࣌ܥྻಛ௃ྔʹ෼ղ ର਺ࠩ෼ ෼ࠩ෼ %"31" ෳ਺ͷ࣌ܥྻಛ௃ྔΛநग़

ʜ ʜ %"31" ෳ਺ͷ࣌ܥྻಛ௃ྔΛநग़ ର਺ࠩ෼ܥྻσʔλ΁ͷม׵ ඪ४Խ ૄߏ଄ֶशʢ(SBQIJDBM-BTTPʣ ΢Οϯυ΢αΠζ෼

ʜ ʜ ૄߏ଄ֶशʢ(SBQIJDBM-BTTPʣ άϥϑͷ่Ε ఏҊख๏ᶃ ڭࢣͳֶ͠शܕ ਖ਼ৗάϥϑ άϥϑO άϥϑN

ʜ ʜ ΢Οϯυ΢αΠζ෼ ఏҊख๏ᶄ ڭࢣ͋Γֶशܕ

άϥϑ৞ΈࠐΈχϡʔϥϧωοτϫʔΫʢ($//ʣ %BWJE%VWFOBVE FUBM OUIF1SPD/14 .POUSFBM $BOBEB %FDFNFCFS

άϥϑ৞ΈࠐΈχϡʔϥϧωοτϫʔΫʢ($//ʣ %BWJE%VWFOBVE FUBM OUIF1SPD/14 .POUSFBM $BOBEB %FDFNFCFS

എܠ ໨త ఏҊख๏ ࣮ݧ݁Ռ τϥϑΟοΫσʔλͷάϥϑԽ ఏҊख๏ᶃɿڭࢣͳֶ͠शܕ

τϥϑΟοΫσʔλͷάϥϑԽ छྨͷ࣌ܥྻಛ௃ྔʹ- ੍໿෇͖ͷૄߏ଄ֶशख๏(SBQIJDBM -BTTPΛద ༻ͨ݁͠Ռɼૄͳ૬ؔؔ܎ͷάϥϑߏ଄͕ಘΒΕΔ͜ͱΛ֬ೝͨ͠ɽ ૄͳάϥϑߏ଄ʹ͢Δ͜ͱʹΑΓɼ৘ใྔͷѹॖ΍ϊΠζ΁ͷؤڧੑʹ༗ޮͰ ͋Δͱߟ͑ΒΕΔɽ (SBQIJDBM-BTTP ਤ

എܠ ໨త ఏҊख๏ ࣮ݧ݁Ռ τϥϑΟοΫσʔλͷάϥϑԽ ఏҊख๏ᶃɿڭࢣͳֶ͠शܕ

ਖ਼ৗঢ়ଶͷάϥϑߏ଄ άϥϑͷ࣌ܥྻ ҟৗ౓ɿਖ਼ৗͳ૬͕ؔͲͷఔ౓่Ε͔ͨ ਖ਼ৗঢ়ଶͱԾఆͨ͠୯Ұͷάϥϑߏ଄ͱάϥϑͷ࣌ܥྻσʔλͱͷҧ͍Λҟ ৗ౓ͱ͠ɼΧϧόοΫɾϥΠϒϥʔڑ཭ʹΑͬͯܭࢉΛߦͬͨ ࣌ؒU

ਤ %"31"ͷਖ਼ղσʔλ͓Αͼ֤࣌ܥྻಛ௃ྔ ͱఏҊख๏ ʹΑͬͯݕ஌ͨ͠ҟৗͷՄࢹԽ݁Ռ ҟৗɿ 5$1

എܠ ໨త ఏҊख๏ ࣮ݧ݁Ռ τϥϑΟοΫσʔλͷάϥϑԽ ఏҊख๏ᶃɿڭࢣͳֶ͠शܕ

ਖ਼ղσʔλ ༧ଌ݁Ռ άϥϑߏ଄Խͨ͠τϥϑΟοΫσʔλΛ($//Ͱֶशͨ݁͠Ռɼ༧ଌਫ਼౓͕ ͱͳͬͨɽ͜ͷ஋͸ઌߦݚڀͰใࠂ͞Ε͍ͯΔ஋ͱಉఔ౓ʹߴ͍஋Ͱ͋Δɽ ਤ ਖ਼ղσʔλ͓ΑͼֶशϞσϧʹΑΔ༧ଌ݁Ռ

($//Ͱֶशͨ͠ϞσϧΛར༻͠ɼ'JOHFS 1SJOUͷऔಘʹ੒ޭͨ͠ɽ 4:/GMPPE߈ܸ࣌ɼҟৗ͕ݕ஌͞Εɼ'JOHFS 1SJOU಺Ͱߴ͍Өڹ౓Λࣔ͢෦ ෼άϥϑ͸ɼ)551ͱ4:/ͷ૬ؔؔ܎ʹؔ࿈͢Δ΋ͷͰ͋ͬͨɽ (a)

4NVSG߈ܸ࣌ɼ'JOHFS1SJOU಺ͷӨڹ౓ͷߴ͍෦෼άϥϑ͸ɼૹ৴ݩ1͓Αͼ $.1ͷ૬ؔؔ܎ʹؔ࿈͢Δ΋ͷͰ͋ͬͨɽ ఏҊख๏ᶄͰ͸ϊʔυؒͷ૬ؔؔ܎ʢ෦෼άϥϑʣͷՄࢹԽͰ͖ΔͨΊɼϊ ʔυͷՄࢹԽͷΈͰ͋ͬͨఏҊख๏ᶃΑΓ΋۩ମతͳઆ໌ੑ͕ظ଴Ͱ͖Δɽ (b) ਤ

എܠ ໨త ఏҊख๏ ࣮ݧ݁Ռ τϥϑΟοΫσʔλͷάϥϑԽ ఏҊख๏ᶃɿڭࢣͳֶ͠शܕ

·ͱΊ • τϥϑΟοΫσʔλͷάϥϑߏ଄Խʹ੒ޭͨ͠ɽ • άϥϑߏ଄ʹج͍ͮͨ̎छྨͷػցֶशख๏ ʢڭࢣͳֶ͠शܕ͓Αͼڭࢣ͋ΓֶशܕʣΛఏ Ҋͨ͠ɽ •