딥러닝 기반 정보시스템 이상 탐지 = Deep learning based anomaly detection in information system

다국어 초록 (Multilingual Abstract)

The corporate information system plays an important management system in relation to corporate management, such as personnel management, budget management, and financial management. If there is an abnormal failure of the information system, the work will be paralyzed until it is restored.
For the stable operation of important information systems, companies are making efforts to respond to abnormal situations through monitoring and designating departments in charge and people in charge of each system.
However, the complexity of information systems creates difficulties in maintenance, making it difficult to respond quickly to abnormal conditions. Existing monitoring methods for checking the abnormal status of the information system should be more intelligent and advanced.
This paper proposes a method that collects data from information systems operated by actual companies and uses negative sampling and contrastive learning to check abnormal conditions before or immediately using performance data of monitoring systems. The data of the information system in operation has more normal data than abnormal data. In order to deal with the data imbalance, the negative sampling method is adopted based on t-distributed stochastic neighbor embedding. To learn with a small dataset, a contrastive learning is proposed by augmenting data.
To see the effectiveness of the proposed methods, we have compared with conventional deep learning models such as CNN, LSTM, and spectral residuals, which showed good performance in related work. In experimental results, the proposed contrastive learning with negative sampling method showed 99.47% in true positive rate(TPR). On the other hand, the conventional CNN and LSTM with negative sampling showed 98.80% and 98.67% in TPR, respectively. This result shows that the proposed method is effective in anomaly detection with a small dataset.

목차 (Table of Contents)

• 1.서 론 1
• 2. 관련연구 4
• 2.1 IT 인프라 이상탐지 4
• 2.2 정보시스템 이상탐지 5
• 3. 정보시스템 이상탐지 학습데이터 구축 6
• 3.1 성능 모니터링시스템과 접근기록 데이터 수집 7
• 3.2 이상상태 탐지를 위한 학습데이터 구축 13
• 4. 딥러닝기반 이상상태 탐지 모델 16
• 4.1 tSNE를 이용한 네거티브 샘플링 16
• 4.2 대조학습을 이용한 이상상태 탐지 모델 19
• 5. 실험 및 평가 21
• 5.1 성능 측정 방법 21
• 5.2 딥러닝기반 비교실험 방법 22
• 5.3 학습모델별 비교실험 결과 25
• 5.4 딥러닝 모델별 최적 실험결과 비교 28
• 5.5 토론 29
• 6. 결 론 30
• 참고문헌 32