Self-learning-based intrusion detection apparatus and method

A self-learning-based intrusion detection method, comprising:

• detecting an anomaly behavior in network traffic based on a first detection model;
• and
• as a self-learning event is published, generating a second detection model through self-learning in parallel with detecting the anomaly behavior,
• wherein detecting the anomaly behavior comprises:
• as the second detection model is generated, replacing the first detection model with the second detection model, and thereafter detecting the anomaly behavior in the network traffic.

A self-learning-based intrusion detection apparatus, comprising:

• an in-memory database (DB) including a function of a Publish/Subscribe (Pub/Sub) server of performing event channel subscribe and event publish messaging;
• a memory configured to store at least one program;
• and
• a processor configured to execute the program,
• wherein the program is configured to perform:
• in an anomaly behavior detection mode, converting network input data into NetFlow data;
• detecting a signature of the NetFlow data;
• extracting detection-purpose behavior feature data from the NetFlow data;
• and
• predicting whether a behavior in the extracted behavior feature data is anomalous, based on a first detection model,
• in a self-learning mode, as the self-learning mode starts, auto-labeling the NetFlow data as to whether the NetFlow data is normal or abnormal;
• generating learning-purpose behavior feature data of auto-labeled NetFlow data;
• and
• generating a second detection model by performing learning based on the learning-purpose behavior feature data,
• wherein the self-learning mode and the anomaly behavior detection mode are performed in parallel for interconnection with the Pub/Sub server,
• as the second detection model is generated, the first detection model is replaced with the second detection model.