초록 ▼

□ 연구 목적
- 머신러닝 및 사용자 행위분석을 통한 신규지능형 공격의 탐지가 가능한 탐지기술 및 다양한 보안솔루션을 탑재할 수 있는 통합 보안 플랫폼을 포함하는 네트워크 보안제품의 개발
□ 연구 개발 내용
- 고속 탐지 시스템 개발
- 대용량 데이터 수집을 위한 수집 시스템 개발
- 통합 보안 플랫폼의 개발
- 신규 지능형 공격의 탐지를 위한 핵심 기술 개발
- 네트워크 보안 강화를 위한 SDP 개발
□ 연구개발성과
- 고속 탐지 시스템 개발: 어플리케이션과 전송 수준에서의 데이터

□ 연구 목적
- 머신러닝 및 사용자 행위분석을 통한 신규지능형 공격의 탐지가 가능한 탐지기술 및 다양한 보안솔루션을 탑재할 수 있는 통합 보안 플랫폼을 포함하는 네트워크 보안제품의 개발
□ 연구 개발 내용
- 고속 탐지 시스템 개발
- 대용량 데이터 수집을 위한 수집 시스템 개발
- 통합 보안 플랫폼의 개발
- 신규 지능형 공격의 탐지를 위한 핵심 기술 개발
- 네트워크 보안 강화를 위한 SDP 개발
□ 연구개발성과
- 고속 탐지 시스템 개발: 어플리케이션과 전송 수준에서의 데이터 수집 시스템 고도화(700Mbps)
- 대용량 데이터 수집을 위한 수집 시스템 개발: 성능 고도화를 통해 동시에 600만대의 TCP 세션 지원 및 1Gbps의 데이터 저장 속도 지원
- 통합 보안 플랫폼의 개발: 4종의 보안솔루션에 대한 검사를 700Mbps 수준으로 개발
- 신규 지능형 공격의 탐지를 위한 핵심 기술 개발: 머신러닝을 통한 사용자 행위분석 엔진의 이상탐지 정확도 95% 달성
- 네트워크 보안 강화를 위한 SDP 개발: 클라우드 환경을 위한 SDP 게이트웨이, 컨트롤러, 클라이언트 단말용 에이전트 개발 완료

(출처 : 요약서 4p)

Abstract ▼

□ Purpose & Contents
□ Research Purpose
○ Development of network security products including integrated security platform with various security solutions and detection technology that can detect new intelligent attacks through machine learning and analysis of user behavior
○ Protecting comp

□ Purpose & Contents
□ Research Purpose
○ Development of network security products including integrated security platform with various security solutions and detection technology that can detect new intelligent attacks through machine learning and analysis of user behavior
○ Protecting company from internal and external security threats
- Ensuring the safety of all input and output data through the network
- Detect external threats as well as external threats
- Detection of data leakage from inside the company to the outside and leakage of personal information through user behavior analysis
○ Development of new intelligent attack detection technology through analysis of user behavior based on machine learning
- Signature based detection and heuristic detection method can not detect new intelligent attacks
- Detection of irregularized new intelligent attacks by checking whether user device is abnormal by user behavior analysis
- Obtain visibility of invisible attacks through analysis of big data collection and machine learning of collected data
○ New secure ecosystem through integrated security platform
- Easily applied without interfering between various existing security solutions
- Obtain a win-win model that preserves the independence of existing seucirty technologies and enables mutual cooperation
○ Network security enhancment using SDP(Software Defined Perimeter)
- Traffic control and security application through software-based network configuration
- Blocks various existing network-related attacks such as DDoS, MITM and identity theft
○ Development of cloud services in the form of SaaS and virtual appliance type products available in the appliance, cloud and virtual environment
- Development of appliance products for on-premise installation of midsize businesses, large corporations and national institutions
- Development of virtual appliance type products applicable to cloud-based business systems
- Development of SaaS cloud service for SOHO, SMB and individuals
- Provides seamless security by supporting mobility between appliance and SaaS for enterprise BYOD devices

□ Research Content
[Development of high-speed detection system]
○ High-speed network malicious packet detection technology through DPI(Deep Packet Inspection)
- Development of efficient traffic collection function for handling large volume traffic
- Development of high-speed detection technology for risk/abnormal traffic
- Minimize unnecessary operations and shorten reaction time through quick initial response

[Development big data collection system]
○ Linkage with data collection device
- Organize and store network packets on big data platform for machine learning(Supports 700Mbps data storage rate)
- Configuring load balancing and distributed collecting systems
○ Ensuring data security and HA(High Availability)
- Synchronization for secure storage of collected data(duplexing)

[Development of integrated security platform]
○ Development of a platform to accept various existing security solutions
- Linkage existing security solutions to detect the risk of inflow andoutflow traffic
- Development of standard RESTful API to interoperate with existing security solutions
○ Maximize security administrator’s convenience through user-friendly web interface

[Development of key technologies for detecting new intelligent attacks]
○ Research and development of machine learning based user behavior analysis technology unique to proposal company
- Detecting user abnormal behavior and dangerous behavior by developing user behavior analysis based on machine learning
○ Development of attack detection technology based on user behavior analysis
- Create a profile by modeling the user's existing behavior (Big Data)
- Developing technology to detect security threat by comparing and analyzing profile of user or other user with same authority and current behavior pattern

[Development of SDP to enhance network security]
○ Blocking various network attack such as DoS or MITM
- Applying seamless and flexible policy by controling network using software
- Reduce attack potential and security costs by reducing attackable vector

□ Results
□ Developing of high-speed detection system
◯ Completion of unstructured database to store data collected by high-speed detection system
◯ Data is stored with quadrupling through four nodes in one cluster and developed in a structure that can be expanded easily
◯ Maximized data availability by storing in a distributed fashion and ensuring future scalability and data reliability
◯ (700Mbps)Advancement of web traffic in-depth analysis and collection technology at the application level(Layer7)
◯ (700Mbps)Advancement of network information collection and monitoring system at transport level(Layer4)

□ [Development big data collection system]
◯ Supports 6 million simultaneous TCP sessions at the same time through performance enhancement and supports 1Gbps data storage rate
◯ Supports interworking with machine learning server for learning of collected data

□ Development of integrated security platform
◯ API development for interworking of Anti-virus service of Google’s Virus-total, Cloudbirc’s blacklist IP, MaxMind’s country IP and Web Shell URL
◯ Provide SIEM services through log consolidation analysis of each 3rd party solution
◯ Completed testing of four security solutions at 700Mbps level

□ Development of key technologies for detecting new intelligent attacks
◯ Development of four kinds of anomaly detection engine such as user behavior analysis at application layer (L7), user behavior analysis at network transport layer (L4), enterprise network abnormal behavior analysis at network transport layer and situation based abnormality detection
◯ Achieves 95% accuracy of anomaly detection engine analysis of user behavior through machine learning
◯ 5 kinds of machine learning algorithm applied(LSTM-Autoencoder, GRU-A utoencoder, LSTM-Prediction, GRU-Prediction, AutoEncoder)
◯ Completion of division of 30 kinds of network behavior profile for machine learning

□ Development of SDP to enhance network security
◯ Development SDP Client, Server and Controller
◯ Developed SDP gateway and controller for cloud environment
◯ Completed development of agent for SDP client device(Smart phone, Table PC, IoT device)
◯ Enhanced Security with SDP 2 Factor Authentication(ID/PW, OTP, Fingerprint)

□ Expected Contribution
□ Application plan (Separate Productization)
○ Hardware-based server(appliance) type products installed in the customer's network
○ Virtual appliance-based products for protecting business systems in cloud servers
○ Development and commercialization of cloud-type service(SECaaS type service)

□ Application plan (Used as the core element technology of related products)
○ Used to enhance web attack detection engine of WAPPLES, the web firewall of the proposal institution
○ Provides the function of tracking the association between Web and DB to D’Amo, the data encryption solution of the proposal institution
○ Use SDP function for IoT device network management when establishing IoT security platform of the proposal institution

□ Expected effect (technical aspect)
○ Commercialization of intelligent continuous attack detection technology using multiple technologies
○ Development of User Behavior Analysis Technology
○ Development of integrated security platform
○ Commercialization of software-defined perimeter technology
○ Development of security technology with global competitiveness

□ Expected effect (economic and industrial aspects)
◯ Reduced damage due to intelligent continuous attacks
◯ Reduce the amount of damage due to corporate secret leakage
◯ Optimize business with user profiling
◯ Pioneering overseas markets

□ Expected effect (social aspects)
◯ Establishing the concept of security that does not inconvenience users
◯ Raising awareness of domestic security technology in overseas markets

(출처 : SUMMARY 12p)

목차 Contents

• 표지 ... 1
• 제 출 문 ... 2
• 보고서 요약서 ... 4
• 연구개발사업 주요 연구성과 ... 6
• 국문 요약문 ... 7
• SUMMARY ... 12
• 목차 ... 18
• Table of Contents ... 20
• 제1장. 연구개발과제의 개요 ... 22
• 1. 연구개발 목적 ... 22
• 2. 연구개발의 필요성 ... 23
• 3. 연구개발 범위 ... 26
• 제2장. 국내외 기술 개발 현황 ... 28
• 1. 국내·외 기술 현황 ... 28
• 2. 국내·외 시장 현황 ... 41
• 3. 국내·외 경쟁기관 현황 ... 43
• 4. 국내·외 경쟁기관·제품 대비 개발과제의 우수성 ... 44
• 제3장. 연구 수행 내용 및 성과 ... 46
• 1. 개발 목표 및 개발 내용 ... 46
• 2. 연구 수행 성과 ... 59
• 제4장. 목표 달성도 및 관련 분야 기여도 ... 62
• 1. 최종목표 및 평가방법 ... 62
• 2. 정량적 연구성과 목표 및 달성도 ... 72
• 3. 질적 성과 목표 및 달성도 ... 75
• 4. 기술개발 기여도 ... 76
• 제5장. 연구개발성과의 활용계획 ... 78
• 1. 미래 원천기술 확보 ... 78
• 2. 제품화 전략 ... 79
• 제6장. 연구 과정에서 수집한 해외 과학기술 정보 ... 80
• 1. 머신 러닝(Machine Learning) ... 80
• 2. SDP(Software Defined Perimeter) ... 83
• 제7장. 연구개발성과의 보안등급 ... 86
• 제8장. 국가과학기술종합정보시스템에 등록한 연구시설·장비 현황 ... 87
• 제9장. 연구개발과제 수행에 따른 연구실 등의 안전 조치 이행 실적 ... 88
• 1. 연구시설 및 연구 장비 보유 현황 ... 88
• 2. SW도구, 지적재산권 등 기타 보유 현황 ... 88
• 3. 연구실 안전조치 이행 계획 ... 88
• 4. 안전관리대책 ... 90
• 제10장. 연구개발과제의 대표적 연구 실적 ... 93
• 제11장. 기타 사항 ... 94
• 제12장. 참고 문헌 ... 95
• 첨부 1. 자체 보안관리 진단표 ... 97
• 첨부 2. 연구실 안전조치 이행표 ... 98
• 첨부 3. 기술화 성과 증빙자료 ... 99
• 붙임. 머신러닝 기반의 네트워크 분석을 통한 지능형 공격 방어기술 개발 (사업성 성과) ... 100
• 끝페이지 ... 136