# US 2024/0205241 A1 · Self-learning-based intrusion detection apparatus and method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2024/0205241 A1 - Document ID: US20240205241A1 - Status: Published application - Kind: A1 - Application number: 18/453,703 - Filed: 2023-08-22 - Published: 2024-06-20 - Earliest claimed: 2022-12-20 - Assignees: Electronics and Telecommunications Research Institute - Applicants: Electronics and Telecommunications Research Institute - Inventors: Byung-Ho CHUNG; Hyeok-Chan KWON - Web page: https://patentgrep.com/patent/US20240205241A1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Disclosed herein are self-learning-based intrusion detection apparatus and method. The self-learning-based intrusion detection apparatus includes memory configured to store at least one program, and a processor configured to execute the program, wherein the program is configured to perform detecting an anomaly behavior in network traffic based on a first detection model, and as a self-learning event is published, generating a second detection model through self-learning in parallel with detecting the anomaly behavior, and wherein the program is configured to perform, as the second detection model is generated, in detecting the anomaly behavior, replacing the first detection model with the second detection model, and thereafter detecting the anomaly behavior in the network traffic. ## Claims ### Claim 1 A self-learning-based intrusion detection apparatus, comprising: a memory configured to store at least one program; and a processor configured to execute the program, wherein the program is configured to perform: detecting an anomaly behavior in network traffic based on a first detection model; and as a self-learning event is published, generating a second detection model through self-learning in parallel with detecting the anomaly behavior, and wherein the program is configured to perform, as the second detection model is generated, in detecting the anomaly behavior, replacing the first detection model with the second detection model, and thereafter detecting the anomaly behavior in the network traffic. ### Claim 2 (depends on 1) The self-learning-based intrusion detection apparatus of claim 1, further comprising: an in-memory database (DB) including a function of a Publish/Subscribe (Pub/Sub) server of performing event channel subscribe and event publish messaging, wherein a first process subscribes to a certain event channel in the Pub/Sub server and thereafter waits in a queue of the event channel, and wherein a second process transmits event data to the queue of the corresponding event channel as a certain event is published. ### Claim 3 (depends on 2) The self-learning-based intrusion detection apparatus of claim 2, wherein the program is configured to further perform: in detecting the anomaly behavior, converting network input data into NetFlow data; extracting detection-purpose behavior feature data from the NetFlow data; and predicting whether a behavior in the extracted behavior feature data is anomalous, based on the first detection model. ### Claim 4 (depends on 3) The self-learning-based intrusion detection apparatus of claim of claim 3, wherein the program is configured to further perform: in detecting the anomaly behavior, detecting a signature in the NetFlow data. ### Claim 5 (depends on 4) The self-learning-based intrusion detection apparatus of claim 4, wherein the program is configured to further perform: in generating the second detection model, auto-labeling the NetFlow data as to whether the NetFlow data is normal or abnormal as a self-learning mode starts; generating learning-purpose behavior feature data of auto-labeled NetFlow data; and generating the second detection model by performing learning based on the learning-purpose behavior feature data. ### Claim 6 (depends on 5) The self-learning-based intrusion detection apparatus of claim 5, wherein the program is configured to further perform: in auto-labeling the NetFlow data, subscribing to a self-learning mode channel in the Pub/Sub server and waiting in a queue; when a self-learning mode event is published, obtaining input data from the queue; generating auto-labeled learning data using the NetFlow data, retrieved from the in-memory DB based on the input data, and a signature detection log; storing the auto-labeled learning data in the in-memory DB, and assigning a storage position and search information thereof to output data; and publishing a self-learning feature generation event including the output data. ### Claim 7 (depends on 6) The self-learning-based intrusion detection apparatus of claim 6, wherein the input data is defined as variables including information of whether an operating state of the self-learning mode starts or stops, a volume of learning data, and a collection period of learning data. ### Claim 8 (depends on 5) The self-learning-based intrusion detection apparatus of claim 5, wherein the program is configured to further perform: in generating the learning-purpose behavior feature data, subscribing to a self-learning feature generation channel and waiting in a queue; when a self-learning feature generation event is published, obtaining input data from the queue; generating a behavior feature dataset from auto-labeled learning data retrieved from the in-memory database based on the input data; storing the generated behavior feature dataset in the in-memory database, and assigning a storage position and search information thereof as output data; and publishing a model generation event including the output data. ### Claim 9 (depends on 5) The self-learning-based intrusion detection apparatus of claim 5, wherein the program is configured to further perform: in generating the second detection model, subscribing to a model generation channel and waiting in a queue; as a model generation event is published, obtaining data input to the queue; generating self-learning input data by preprocessing a learning-purpose behavior feature dataset retrieved from the in-memory database based on the input data, and generating a new second detection model using a learning algorithm; storing the generated second detection model and allocating a storage position thereof and parameter information required for use of the model to output data; and publishing a model change event including output data. ### Claim 10 (depends on 6) The self-learning-based intrusion detection apparatus of claim 6, wherein the program is configured to further perform: in predicting whether the behavior is anomalous, measuring a self-learning score based on at least one of accuracy of a detection result based on the first detection model or a false positive rate, or a combination thereof; and when the self-learning score is greater than a preset threshold value, publishing a learning mode event. ### Claim 11 (depends on 6) The self-learning-based intrusion detection apparatus of claim 6, wherein the self-learning mode event is published from an external control/log analysis system. ### Claim 12 (depends on 9) The self-learning-based intrusion detection apparatus of claim 9, wherein the program is configured to further perform: in predicting whether the behavior is anomalous, subscribing to a model change channel and waiting in a queue; as a model change event is published, obtaining data input to the queue; extracting the second detection model using information included in the input data, and replacing the first detection model with the second detection model; and publishing a self-learning mode event by assigning learning stop to the output data. ### Claim 13 A self-learning-based intrusion detection method, comprising: detecting an anomaly behavior in network traffic based on a first detection model; and as a self-learning event is published, generating a second detection model through self-learning in parallel with detecting the anomaly behavior, wherein detecting the anomaly behavior comprises: as the second detection model is generated, replacing the first detection model with the second detection model, and thereafter detecting the anomaly behavior in the network traffic. ### Claim 14 (depends on 13) The self-learning-based intrusion detection method of claim 13, wherein detecting the anomaly behavior comprises: converting network input data into NetFlow data; extracting detection-purpose behavior feature data from the NetFlow data; and predicting whether a behavior in the extracted behavior feature data is anomalous, based on the first detection model. ### Claim 15 (depends on 14) The self-learning-based intrusion detection method of claim 14, wherein detecting the anomaly behavior further comprises: detecting a signature of the NetFlow data. ### Claim 16 (depends on 15) The self-learning-based intrusion detection method of claim 15, wherein generating the second detection model comprises: auto-labeling the NetFlow data as to whether the NetFlow data is normal or abnormal as a self-learning mode starts; generating learning-purpose behavior feature data of auto-labeled NetFlow data; and generating the second detection model by performing learning based on the learning-purpose behavior feature data. ### Claim 17 (depends on 16) The self-learning-based intrusion detection method of claim 16, wherein predicting whether the behavior is anomalous comprises: measuring a self-learning score based on at least one of accuracy of a detection result based on the first detection model or a false positive rate, or a combination thereof; and when the self-learning score is greater than a preset threshold value, starting the self-learning mode. ### Claim 18 (depends on 16) The self-learning-based intrusion detection apparatus of claim 16, wherein the start of the self-learning mode is performed in compliance with a command from a manager through an external control/analysis system. ### Claim 19 (depends on 17) The self-learning-based intrusion detection method of claim 17, wherein predicting whether the behavior is anomalous further comprises: as the second detection model is generated, replacing the first detection model with the second detection model; and stopping the self-learning mode. ### Claim 20 A self-learning-based intrusion detection apparatus, comprising: an in-memory database (DB) including a function of a Publish/Subscribe (Pub/Sub) server of performing event channel subscribe and event publish messaging; a memory configured to store at least one program; and a processor configured to execute the program, wherein the program is configured to perform: in an anomaly behavior detection mode, converting network input data into NetFlow data; detecting a signature of the NetFlow data; extracting detection-purpose behavior feature data from the NetFlow data; and predicting whether a behavior in the extracted behavior feature data is anomalous, based on a first detection model, in a self-learning mode, as the self-learning mode starts, auto-labeling the NetFlow data as to whether the NetFlow data is normal or abnormal; generating learning-purpose behavior feature data of auto-labeled NetFlow data; and generating a second detection model by performing learning based on the learning-purpose behavior feature data, wherein the self-learning mode and the anomaly behavior detection mode are performed in parallel for interconnection with the Pub/Sub server, as the second detection model is generated, the first detection model is replaced with the second detection model.