The basis for making a decision on responding to computer incidents is information about characteristics of the identified security breach, the values of which are determined during the diagnosis procedure. To reduce the time spent on determining the values of characteristics and increase the reliability of the diagnosis results, it is proposed to use machine learning methods implemented on the basis of artificial neural networks. The paper considers a combined artificial neural network as the basis of a model for diagnosing computer incidents. In this model, through the use of deep learning, the drawback of the classical multilayer perceptron associated with the need to form a massive base of training examples for the specific structure of the neural network is eliminated. The results of the experiments showed that the proposed model allows one to reduce the duration of training, while not reducing the values of the quality indicators of the functioning of the neural network.
Existing methods for protecting information from unauthorized influences in information and communication systems suggests a whole arsenal of information protection tools. The improvement of information protection technologies is primarily aimed at the early detection of masked and unknown scenarios for the implementation of security breaches. After detecting a computer incident, an analysis of the available information is carried out to identify the goals, causes, possible consequences and other characteristics of a security breach. Based on the analysis, response measures are taken. At the same time, standard means of information protection do not allow directly answering key questions of the analysis stage. For this, it is necessary to collect data from almost all the basic elements of the information and communication system and characterize the violation that has occurred, i.e. carry out a procedure of diagnosis. It should be noted that, despite the need to cover the maximum amount of information necessary for making a decision, diagnosis is required to be carried out in the shortest possible time. Prompt and accurate diagnosis allows one to provide a high security and thereby the steadiness of information and communication systems. Thus, the diagnosis of computer incidents is an important stage in managing information protection.
The need to use a variety of information protection tools in the information security system entails the complexity of management processes. Continuous improvement of methods for implementing security breaches and hiding information “traces” requires the use of diagnostic tools, not limited to a set of predefined rules and template, but taking into account the dynamics of events in the information and communication system, resistant to the appearance of external noises and that operate in close to real time. Existing diagnosis methods consisting in studying the contents of information sources (reports of protection tools, event logs of servers and workstations, communication equipment) take a lot of time, and the accuracy of the result depends on the knowledge and experience of specialists involved. There is a contradiction between the existing approach to diagnosing computer incidents and modern requirements for this process.
This paper proposes a model for diagnosing computer incidents based on a combined neural
network, which is an extension of the approach proposed in the paper [
The main theoretical contribution of this work is the formulation and solution of a new problem of diagnosing computer incidents based on an optimized combined neural network that provides minimal training time for given requirements for the quality indicators of the neural network.
The paper has the following structure. Section 2 provides an overview of relevant work. Section 3 defines the statement of the problem of diagnosis computer incidents. Sections 4 and 5 consider a combined neural network model for diagnosis computer incidents. Section 6 discusses the experimental results. Conclusions and directions for further research are presented in Section 7.
To carry out the procedure for diagnosing computer incidents, it is necessary to organize
effective processing of data from various sources. In works [
A promising way is the automation of routine diagnosis functions. The procedure for
collecting data for diagnosis has been automated for a long time and is represented by various
solutions [
It should be noted that the dimension of the input data set (to cover the events that occurred
in a typical information and communication system and afect the outcome of the diagnosis)
is quite large and may amount to several tens of thousands. Learning such a neural network
requires a large amount of training examples. In this regard, it is necessary to carry out
optimization of the structure of the neural network in order to prevent the negative efect of
retraining the network on a limited number of examples. To this end, it is proposed to build
a combined neural network consisting of the coding part of an auto-encoder and a multilayer
perceptron [
This combined neural network allows you to use a well-known and proven approach to solving classification problems for a new subject area, in the analysis of computer incidents.
The use of combined neural networks in the control system of an information security
system allows one to: (a) provide systematic information for making decisions on responding to
computer incidents; (b) significantly accelerate the processing and analysis of incoming
information; (c) increase the accuracy of the determined values of information security violation
characteristics; (d) identify the prerequisites for computer incidents. In general, the use of
combined neural networks in the problems of diagnosis provides a significant increase in the
efectiveness of information protection management. Consideration of previous experience in
the application of artificial neural networks is successfully used in many fields, for example,
in technical and medical diagnostics [
Examples of the successful use of artificial neural networks in diagnosing failure of
information systems equipment are given in papers [
Papers [
The laboriousness of the process of forming training examples for artificial neural networks that are based on supervised learning served as an incentive for the development of deep learning, during which the neural network independently generates distinctive features for input data sets. Efective optimization procedures using unsupervised learning were presented in [17], which demonstrated high performance for deep neural architectures.
Despite the fact that artificial neural networks are a powerful tool for processing data, as
evidenced by their widespread implementation in various fields of activity, the issues of
automatic diagnosis of computer incidents based on artificial neural networks have not been
properly addressed in the known literature. In papers [
In this paper, we propose an improved model that will eliminate these shortcomings.
Having discovered a computer incident, the information protection system collects data from various sources, which include the event logs of information protection tools, servers and workstations. Of the total volume of this data, only those that are potentially relevant to a breach of information security are of interest. The rest are considered as information noise. In other words, the transformation is carried out from the initial set of events X registered in the information system to the set of informative diagnostic signs ′ , ∶ → ,
′ - number of types of diagnostic features. ,
- number of information sources, - number = 1, = 1, , ∈ where of event types, = {
, } ′ = { ′ = 1,
, }
,
Further, it is necessary to determine the values of the security violation characteristics by the available set of diagnostic signs ℎ , = 1, , where ℎ - the number of the set of values of the security violation characteristics . security violation characteristics, the values of which must be determined during the diagnosis, solution to the diagnostic problem is to find the mapping of the set of informative events - the number of possible values of the -th security violation characteristic. Thus, the ′ to
The security breach characteristics are in fact a detailed description of the security violation of information. A list of the main security violation characteristics is given in Table 1.
By the method of determining the values of the security violation characteristics, we divide the characteristics into primary and secondary. The primary ones are those characteristics whose values are determined by direct measurement or calculation (for example, user identiifers, time, and others). Secondary characteristics are those for the determination of the values of which it is necessary to build functional dependences on the values of diagnostic signs.
To use the results of the diagnosis as new training examples, it is necessary to repeat the training procedure. Accordingly, the problem of minimizing the time devoted to training arises. At the same time, it is necessary to ensure the preservation of previously achieved quality indicators of the artificial neural network . The objective function for the developed diagnostic model can be represented as
→ , ≥ , where - the value of the quality index of the artificial neural network after each next training, - the value of the quality index of an artificial neural network, which obtained during first training.
To achieve the goals of diagnosing computer incidents, information is collected from numerous elements of the information and communication system and the resulting picture of the distribution of recorded events is compared with previously known distributions for which the values of the security violation characteristics are determined.
Due to the lack of formalized analytical dependencies between the events that have occurred and the values of the security violation characteristics, it is proposed to use feedforward neural networks, for example, a multilayer perceptron, to determine such dependencies. In relation to the task of diagnosing computer incidents, a multi-layer perceptron generalizes diagnostic signs with the subsequent determination of the values of the security violation characteristics.
However, in order for the neural network to be able to generalize the available examples, and not just remember them, it is necessary to strike a balance between the volume of the training sample and the number of neurons in the structure of the neural network. To ensure compliance with the quality requirements of the created neural network, it is proposed to combine a multilayer perceptron with the encoding part of the autoencoder, that is, use a combined artificial neural network. This architecture allows one to build a model for diagnosing computer incidents that overcomes the dificulties with the formation of a large number of training examples and allows one to adequately characterize the violation of information security.
A model of a combined artificial neural network for diagnosing computer incidents is presented in Fig. 1, where - the size of input layer, - the size of the hidden layer of the autoencoder, -– the size of the hidden layer of the perceptron, -– the size of the output layer of the combined neural network. The ratio between the number of neurons has the following form: ≫ > > .
x′1 x′2 x′3 ... x′in-2 x′in-1 x′in 1 2 3 ... in-2 in-1 in
hidden layer Output layer 1 2 3 ... gr-1 gr 1 2 3 ... gr-1 gr 1 2 ... sk sk-1 1 ... m {hni={0,…,1 {hni={1,…,0
Autoencoder, as it is known, reduces the dimension of the vector of the initial data arriving at the input of a combined artificial neural network [19]. Thus, the first stage is carried out to generalize the input data (they are compressed), i.e. ∶ ′ → ′ . In the hidden layer of the auto-encoder, the group diagnostic features ′ are formed. Then they go to the input of the multilayer perceptron, in this case a three-layer one, which implements a procedure for processing diagnostic signs and outputs a set of values of the -ary security violation characteristic, i.e. ∶ ′ → .
Thus, the output of the considered model is an assessment of the degree of compliance with the values of the characteristics of the security violation for the set of diagnostic features presented at the input. By training a combined artificial neural network, the weights of neural connections are determined ∈ , = 1, , = 1, , where - – the number of neurons in the previous layer, - the number of neurons in the layer under consideration. These coeficients allow one to record in general form the dependence of the value of the -th security violation characteristic on the input vector of diagnostic signs ′ : ℎ = 3( 2( 1( 1 ⋅ ′ ) ⋅ 2) ⋅ 3), where ∈ , = 1, 3 - the vector of weights of the -th layer, - the function of activation of neurons of the -th layer.
The implementation of the procedure for diagnosing computer incidents in an information and communication system using a combined artificial neural network involves the following sequence of actions: - collection and processing of data from information sources; - preparation of an input data set for an artificial neural network; - formation of group diagnostic features by the encoder part of the auto-encoder; - classification of the obtained group diagnostic features on the set of values of the desired characteristic of a security violation.
For each secondary characteristic of a security breach, its own neural network and its own set of training examples are formed. The result of the operation of the set of combined artificial neural networks in parallel mode is a set of values of information security violation characteristics, on the basis of which the development of a response option to a computer incident is further carried out.
The model for diagnosing a computer incident in an information and communication system is shown in Fig. 2. After detecting a computer incident, the information security tools report the primary security violation characteristics. At the same time, the process of determining the secondary characteristics of a security violation is launched. The sources of information transmit data to the feature preparation unit, where they are processed and presented to the required form before being fed with combined artificial neural networks. Having the analysis unit came, the normalized values of diagnostic features are processed in parallel mode by several neural networks at once. At the final stage of diagnosis, a final set of values of the characteristics of the security violation is formed, which includes the values of the primary and secondary characteristics.
Sources of information
Server Event Logs Work-station Event Logs Security Event Logs Network Hardware Event Logs
Computer Incident Diagnostic System X
Preserving the
primary characteristics of a security violation
X
Block for collection and preparation of diagnostic signs 1.Filtration 2.Aggregation 3.Normalization
X’
Analysis block
Combined ANN 1 . .
.
Combined ANN n
W
Block for optimizing the structure of combined neural
networks hn (secondary) hn (primary)
administrator
The set of initial data and diagnostic results can, if necessary, be used as new training examples (datasets). The number of examples in the training set afects the number of neurons in the hidden layer of an artificial neural network, according to the relation established by R. Hecht-Nielsen [20]: =
+
, 1 + l o g2( ) ≤ ≤ ( + 1)( + + 1) + , (2) where - the number of neurons of the output layer, - the number of training examples, - the number of neural connections, - the number of neurons in the input layer.
Accordingly, with the replenishment of the base of training examples, the structure of the neural network should be adjusted. The choice of the number of neurons in the hidden layer of the auto-encoder and perceptron afects the values of the quality indicators of the combined artificial neural network and the duration of the training. In order to minimize the training time and maintain the values of quality indicators at the required level, it is necessary to solve the optimization problem: { ( ) → , (3) ( ) ≥
To solve this problem, computational experiments were carried out. Based on the obtained experimental values, in the optimization unit of the structure of combined neural networks, (1) the optimal number of hidden layer neurons is selected and the combined neural networks are adjusted.
An experimental assessment of the proposed model for diagnosing computer incidents was carried out on the basis of the existing database of information security violations compiled by experts. The database contains a description of two security violation characteristics: “nature of the violation” and “consequences”. It consists of 276 entries, which include sets of diagnostic features from event logs for 20 workstations. To characterize a security violation, the “nature of the violation” of 276 records, 113 corresponds to a deliberate violation, and 163 to an unintentional violation. To characterize a security violation, the “consequences” of the implementation of the violation of 276 records, 164 correspond to significant damage, and 112 - to minor damage.
Combined neural networks were implemented in the C ++ programming language. The training was carried out on a workstation under the control of the Windows 7 Professional operating system, 16 Gb RAM, AMD Ryzen 5 2600 processor.
The experiments were carried out according to the following scheme. Initially, a database of training examples was formed, which included many pairs of sets of diagnostic signs and the corresponding values of the security violation characteristics. These pairs are designed to train combined artificial neural networks that are part of the computer incident diagnosis model and test their readiness for operation. Then, new training examples for subsequent adjustment of neural networks are stored in the same database. The training is carried out by the method of back propagation of error, during which the weighting coeficients of each communication between artificial neurons are adjusted [21].
Next, the structure of combined neural networks was formed. The size of the input layer for all combined neural networks corresponds to the size of the vector of diagnostic features. To cover the studied diagnostic features for a long period of time during the experiment, the input layer size was 32400. The output layer of each combined neural network is determined by the number of values of the secondary characteristic of the security violation.
The size of the hidden layers of the autoencoder and perceptron was initially selected based on the minimum suficient according to R. Hecht-Nielsen’s condition (1) and (2) and amounted to 12 and 1, respectively.
For training and quality control of the artificial neural network, the database was divided into two parts. Initially, 180 notes were taken for training and 76 entries for testing. The quality assessment of the combined neural network was carried out according to the generally accepted indicator -measure ( ), the value of which is calculated on the basis of indicators of precision and recall : = 2 ⋅ ⋅ + = + , + where is the number of records classified as the true value of the characteristic, while it is true, is the number of records classified as the true value of the characteristic, while it is actually false, is the number of records classified as the false value, while it is true.
The dependences of the values of the -measure indicator obtained during the computational experiment on the number of neurons in the hidden layers of the autoencoder and the perceptron for characterizing the security violation “nature of the violation” are shown in Fig. 3, and to characterize the security violation “consequences” - in Fig. 4. The combined neural network was trained on 180 examples.
As can be seen from Fig. 3 and Fig. 4, the combined neural network reaches the maximum value of the -measure index with the number of neurons of the hidden layer of the autoencoder of about 180 and 4 neurons of the hidden layer of the perceptron. With an increase in the number of hidden layer neurons, an increase in the -measure is not observed and subsequently even decreases due to the occurrence of the negative efect of overfitting.
By increasing the number of examples to 194 and testing on 82 examples, the task of optimizing the training time of a neural network is solved by choosing the minimum suficient number of hidden layer neurons without losing the quality of the originally created network. The combined neural network has high values of the accuracy indicator for determining the value of the binary characteristic of a security violation with the number of neurons 186 for the hidden layer of the auto-encoder and 4 for the hidden layer of the perceptron. With an increase in the number of neurons, the training time increases, and the values of the accuracy and completeness indicators initially remain the same, but then decrease. With a decrease in the number of neurons of the hidden layers, along with a slight decrease in the training time, the values of the accuracy and completeness indicators decrease. That is unacceptable according to the conditions of the problem.
These results indicate the need to adapt the structure of the combined neural network when replenishing the base of training examples. While for the number of training examples up to 200, the number of neurons in the hidden layer of the auto-encoder is advisable to choose about 185, the number of neurons in the hidden layer of the perceptron is 4. With an increase in the number of training examples by 14, the values of the -measure indicator remained the same with an increase in the number of neurons of the hidden layer of the auto-encoder by 6 and the preservation of 4 neurons of the hidden layer of the perceptron.
In comparison with a multilayer perceptron, a combined neural network allows us to ensure that the requirements for the -measure and training time are met, the values of which are given in Table 2. In this paper, training time the combined neural network is defined as the time period after which the specified requirement for the diference between the received and known output values of the network for all training examples is fulfilled.
Thus, the requirement according to expression 4.3 is met. As can be seen from Table 2, the training of a multi-layer perceptron takes much longer on a small number of examples and does not ensure the achievement of the values of the -measure indicator for a combined artificial neural network.
The paper proposed a new model for diagnosing computer incidents based on combined neural networks, and attempted to solve the problem of optimizing the structure of combined neural networks in order to minimize training time when adding new training examples.
The use of an auto-encoder as part of the combined neural network allowed one to switch from an input set of high-dimensional diagnostic features to a compact representation due to compression using the principal component method. The resulting set of group diagnostic features is classified according to the set of values of the characteristics of the security violation. The classification problem is solved by a three-layer perceptron. Reducing the dimension of a set of diagnostic features allows the training of a combined neural network on a fairly small base of training examples.
An experimental evaluation of the proposed model on a test bench made it possible to identify the optimal number of neurons in the hidden layers of the combined neural network in the interest of minimizing the training time.
Given the simplicity of the proposed model, it seems possible its practical application as part of the information protection system of a typical information and communication system.
The directions of further research are associated with the study of the use of combined neural networks to determine the values of the secondary characteristics of information security violations, depending on other previously defined characteristics, including primary ones, by adding recurrent neural networks to the structure. It is also interesting to study the efect of dropout for neurons of hidden layers of the combined neural network on the value of the -measure indicator.
This research is being supported by the grant of RSF #18-11-00302 in SPIIRAS. [15] M. Sakurada, T. Yairi, Anomaly detection using autoencoders with nonlinear dimensionality reduction, in: Proceedings of the MLSDA 2014 2nd Workshop on Machine Learning for Sensory Data Analysis, 2014, pp. 4–11. [16] M. Alkasassbeh, An empirical evaluation for the intrusion detection features based on machine learning and feature selection methods, arXiv preprint arXiv:1712.09623 (2017). [17] H. Larochelle, D. Erhan, A. Courville, J. Bergstra, Y. Bengio, An empirical evaluation of deep architectures on problems with many factors of variation, in: Proceedings of the 24th international conference on Machine learning, 2007, pp. 473–480. [18] V. Avramenko, A. Malikov, Diagnosing computer security incidents based on a combined artificial neural network, Information Security. Inside (2019) 72–76. [19] P. Baldi, Autoencoders, unsupervised learning, and deep architectures, in: Proceedings of ICML workshop on unsupervised and transfer learning, 2012, pp. 37–49. [20] R. Hecht-Nielsen, Kolmogorov’s mapping neural network existence theorem, in: Proceedings of the international conference on Neural Networks, volume 3, IEEE Press New York, 1987, pp. 11–14. [21] S. Khaikin, Neural networks: full course, M.: Williams 1104 (2006).