# US 2023/0056749 A1 · Intrusion detection and prevention solution system in iot network using explainable ai > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2023/0056749 A1 - Document ID: US20230056749A1 - Status: Published application - Kind: A1 - Application number: 17/890,608 - Filed: 2022-08-18 - Published: 2023-02-23 - Earliest claimed: 2021-08-18 - Assignees: Korea University Research and Business Foundation - Applicants: Korea University Research and Business Foundation - Inventors: Huy Kang KIM; Hyunjae KANG; Jeong Do YOO; Young Hun LEE; Young-Ah CHOI; Yong Sik KIM - Web page: https://patentgrep.com/patent/US20230056749A1 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06N 3/0455: Auto-encoder networks; Encoder-decoder networks - G06N 3/049: Temporal neural networks, e.g. delay elements, oscillating neurons or pulsed inputs - G06N 3/088: Non-supervised learning, e.g. competitive learning - G06N 3/09: Supervised learning - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06N 3/084: Backpropagation, e.g. using gradient descent - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Disclosed is a method for preventing an attack on an IoT network. The method may further include: generating attack situation information of an attack on a network by inputting one or more packet data for the IoT network into an attack discrimination unit; generating, by an attack analysis unit, main feature information for the attack based on the attack situation information; and generating, by an attack prevention unit, attack prevention information based on the main feature information, in which the attack discrimination unit may be an artificial neural network model of a modified autoencoder structure including a softmax layer. ## Claims ### Claim 1 A method for preventing an attack on an IoT network, the method comprising: generating attack situation information of an attack on a network by inputting one or more packet data for the IoT network into an attack discrimination unit; generating, by an attack analysis unit, main feature information for the attack based on the attack situation information; and generating, by an attack prevention unit, attack prevention information based on the main feature information, wherein the attack discrimination unit is an artificial neural network model of a modified autoencoder structure including a softmax layer. ### Claim 2 (depends on 1) The method of claim 1, further comprising: generating feature packet data for a predetermined analysis time by inputting learning packet data into a preprocessing unit; generating, by a learning data generation unit, primary learning data and secondary learning data based on the feature packet data, and training the attack discrimination unit by using the primary learning data and the secondary learning data, wherein the feature packet data includes one or more features extracted from the learning packet data for the analysis time. ### Claim 3 (depends on 2) The method of claim 2, wherein the generating, by the learning data generation unit, of the primary learning data and the secondary learning data based on the feature packet data further includes generating the primary learning data related to one of a normal state or an attack based on the feature packet data, and generating the secondary learning data by labeling the feature packet data with at least one attack type. ### Claim 4 (depends on 2) The method of claim 2, wherein the training of the attack discrimination unit by using the primary learning data and the secondary learning data includes performing primary learning by inputting the primary learning data into a primary discrimination model constituted by an autoencoder, constituting the attack discrimination unit by adding the softmax layer to the primary discrimination model of which the primary learning is completed, and performing secondary learning by inputting the secondary learning data into the attack discrimination unit in order to generate the attack situation information including whether the attack occurs and the type of the attack. ### Claim 5 (depends on 1) The method of claim 1, wherein the generating of the attack situation information of the attack on the network by inputting one or more packet data for the IoT network into the attack discrimination unit includes calculating, by the attack discrimination unit, one or more loss values for the packet data, and calculating a mean loss value of the packet data, discriminating at least one of whether the attack occurs or the attack type based on the mean loss value, and generating the attack situation information including at least one of whether the attack occurs or the attack type discriminated. ### Claim 6 (depends on 5) The method of claim 5, wherein the discriminating of at least one of whether the attack occurs or the attack type based on the mean loss value includes at least one of discriminating whether the attack occurs by comparing the mean loss value with a predetermined loss threshold value, or discriminating, by the attack discrimination unit, the attack type by comparing the mean loss value with a reference mean loss value of each of the learned attack types. ### Claim 7 (depends on 1) The method of claim 1, wherein the generating, by the attack analysis unit, of the main feature information having a high relation to the attack based on the attack situation information includes when the attack analysis unit identifies that the attack occurs based on whether the attack is performed in the attack situation information, identifying, by the attack analysis unit, the attack type of the attack situation information, calculating, by the attack analysis unit, one or more Shapley values for features of the identified attack type, and determining, by the attack analysis unit, at least one of the features as a main feature based on the Shapley value and generating the main feature information including one or more main features. ### Claim 8 (depends on 7) The method of claim 7, wherein the generating, by the attack analysis unit, of the main feature information having the high relation to the attack based on the attack situation information further includes generating, by the attack analysis unit, visualization analysis information representing the Shapley value of each of the features. ### Claim 9 (depends on 1) The method of claim 1, wherein the attack prevention information includes conditional information for a main feature included in the main feature information, and behavior information for performing a network related control operation based on the conditional information. ### Claim 10 A computing device for preventing an attack on an IoT network, the computing device comprising: a processor; a memory; and a network unit, wherein the processor is configured to generate attack situation information of an attack on a network by inputting one or more packet data for the IoT network into an attack discrimination unit, generate, by an attack analysis unit, main feature information for the attack based on the attack situation information, and generate, by an attack prevention unit, attack prevention information based on the main feature information, and wherein the attack discrimination unit is an artificial neural network model of a modified autoencoder structure including a softmax layer.