KR100464598B1 - The intrusion detection system and method unifying and resolving the misuses and anomalies of host - Google Patents

Abstract

The present invention relates to an intrusion detection technology for detecting host-based illegal intrusion in real time. The types of intrusions are so complex and diverse that they are difficult to detect in a single intrusion detection system. To this end, the present invention is to send the detection information of the multiple model intrusion detection sensor to the integrated determination unit, and integrated analysis, to give the reliability of the detection information of the intrusion detection sensor and to correlate the detection information of the multiple model intrusion detection sensor with each other Present an integrated decision methodology. Thus, through the integrated determination of multiple models of host-based misuse and abnormal behavior detection sensors, the false alarm rate can be reduced, the detection area can be expanded, and the accuracy of detection can be greatly improved.

Description

The intrusion detection system and method unifying and resolving the misuses and anomalies of host}

The present invention relates to an intrusion detection technology for detecting illegal intrusion in a host in real time. More specifically, the present invention expands the detection area and greatly improves the accuracy of detection through an integrated decision that analyzes the relationship between the misuse and abnormal behavior detection sensors of multiple models having different detection measures and analyzes the relationship. It is about how to let.

Typically, intrusion detection technology is a single intrusion detection system that provides detection only for misuse or a system that only considers detection information but does not consider relevance. Moreover, since prior knowledge of intrusion patterns is required as a prerequisite for detection of misuse, it is impossible to cope with a new intrusion pattern by detecting misuse alone.

As a solution, a method of adding detection of abnormal behavior has been proposed. However, even in this case, since statistical values such as frequency, average, and variance of normal behavior are used, there are still problems in accurately detecting intrusion behavior, as well as side effects that even normal behavior is recognized as intrusion behavior. There is.

The present invention has been made to solve the above-mentioned conventional problems, the object of the present invention is to detect the host-based intrusion behavior, to expand and detect the detection area through the integration of abnormal behavior as well as abnormal behavior It is to provide a method of integrating judgment that enables improved accuracy of results.

Generally, intrusion detection system provides a detection method based on misuse behavior so that false positives (side effects of recognizing normal behaviors as intrusions) do not occur, while false negatives (normal intrusion behaviors) are not generated unless additional detection patterns for intrusions are added. Side effects that are perceived as behavior). Here, if the threshold is applied with the same logic, the false positive rate increases while the threshold value is low, while the false negative rate decreases.

If the threshold is high, the false positive rate decreases while the falsenegative rate increases. Experience shows that most managers accept more than a certain level of false positives to avoid the risk of false negatives. In this case, intrusion detection is usually performed by finding the optimal threshold value. However, in this paper, the low threshold is applied to minimize the false negative rate and the detection method is also minimized by introducing the integrated decision methodology from various viewpoints and levels. Area enlargement and accuracy have been improved.

1 is a flow chart of a host-based integrated intrusion detection method having an integrated determination function of misuse and abnormal behavior according to the present invention.

Figure 2 is a schematic diagram showing the configuration of the host-based integrated intrusion detection system.

3 is a schematic diagram illustrating a host-based unified decision structure.

4 is a decision distribution diagram of a host-based abnormal behavior detection sensor for normal behavior of a system user.

FIG. 5 is a diagram illustrating the calculation of the body integral value for the determination distribution of the abnormal behavior detection sensor for the normal behavior of FIG. 4. FIG.

FIG. 6 is a diagram illustrating obtaining a threshold value corresponding to a normal behavior ratio from a decision distribution diagram of an abnormal behavior detection sensor of FIG. 5.

7 is a flowchart illustrating a process of deriving a reflection ratio of a host-based detection sensor of multiple models.

8 is a diagram showing an example of obtaining the reflection ratio between the host-based detection sensors of a plurality of models.

9 is a radial graph of the diagram of FIG. 8;

10 is a flow chart illustrating integration decisions within a host.

<Explanation of symbols for the main parts of the drawings>

1: host

101: transmitting unit 102: integrated determination unit

103: sensor unit 104: agent

105: Host-based abnormal behavior detection sensor using data mining

106: HMM type host based abnormal behavior detection sensor

107: Host based misuse detection sensor 117: Integrated sensor

118: integrated judgment sensor

An object of the present invention as described above, in a host connected to the local network via an electronic communication line, the host is composed of an agent and a sensor unit of the client server networking type, the agent integrates the information detected by the sensor unit Integrating misuse and abnormal behavior, which consists of a judging unit for judging and a transmission unit for transferring the detected result to another system for the purpose of integration or logging, wherein the sensor unit comprises a host-based abnormal behavior detection sensor and misuse detection sensor of multiple models. It can be achieved by providing a host-based integrated intrusion detection system having a determination function.

Here, the abnormal behavior detection sensor of the plurality of models preferably includes an abnormal behavior detection sensor of an HMM type and an abnormal behavior detection sensor of a data mining method.

In addition, the HMM type abnormal behavior detection sensor preferably detects system calls, file systems, and abnormal behaviors on system calls and file systems.

In addition, the data mining abnormality detection sensor is preferably used to detect the abnormal behavior using the association rules and clustering techniques to derive the association between the user's execution command and the program.

In this case, it is preferable that the host-based misuse detection sensor detects obvious intrusion by expressing an attack pattern using a fuzzy logic and colored petri-nets technique.

In addition, an object of the present invention, the step of detecting abnormal behavior and misuse through the host-based abnormal behavior detection sensor and the misuse detection sensor of a plurality of models (S1), between each abnormal behavior and misuse information detected at the host level Misuse characterized in that it comprises the step of deriving the reflection ratio (S2) and the step of generating intrusion information by integrally determining the reflection ratio between the information on the abnormal behavior and misuse behavior detected at the host level and each information (S3) This is accomplished by providing a host-based integrated intrusion detection method with integrated behavior and abnormal behavior determination.

Here, it is preferable that the abnormal behavior detection sensor of the plurality of models in the step (S1) detect the abnormal behavior by the HMM method and the data mining method.

Here, the abnormal behavior detection sensor detects system calls, file systems, and abnormal behaviors on system calls and file systems by HMM method, and the association rule that sees correlation between execution commands and programs of users by data mining method. It is desirable to detect anomalous behavior of clustering and clustering techniques.

Also, the misuse detection sensor may detect misuse in the host by analyzing an attack pattern in a fuzzy method and a colored petrinet method.

In addition, the step of deriving the reflection ratio between each detected abnormal behavior and misuse information (S2) reads the reliability (λ) file for the detection value detected by each sensor and reads from the normal behavior for each user based on the reliability. Re-saving the value of the degree of violation for each user ID (S11), reading the log file of each detection sensor (S12), checking whether all log files of each detection sensor (S13), each If the log files of the detection sensor are not read, reading the logs of the abnormal behavior detection sensor and the misuse detection sensor of a plurality of models, and storing the highest value among the log values of the integrated determination time unit of each sensor (S14), stored Comparing the time of the highest value among the log value of the unit of the integrated determination time of each sensor, and if the time zone value does not exist, processing as 0, and if it is stored separately (S15), all log wave If the read is preferably configured as a step (S16), and step (S17) which calculates and stores a reflection ratio of the other sensor of each detection sensor to store the maximum value of the matrix up to a value of the log by the sensor.

Here, the step (S3) of generating the intrusion information by determining the reflection rate between the information on the detected abnormal behavior and misuse and the respective information (S3), reading the log file of each detection sensor (S31), each Applying reliability (λ) information for each user ID to a log of the detection sensor (S32), additionally updating log data of the detection sensor in which reliability data is reflected to a queue for each user ID and each detection sensor (S33), Checking the detection time of the integrated determination unit (S34), and if it does not match by checking the detection time and repeat the step (S32) and step (S33), and if it matches, the determination value ( v ) of each detection sensor The step S35 is taken out of the queue, and the final determination value of the integrated determination unit is determined by applying the matrix η storing the reflection ratio and stored in the integrated determination unit log file (S36). Ha .

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the present invention.

As shown in FIG. 1, the integrated intrusion detection method of a plurality of models according to the present invention includes detecting abnormal behavior and misuse in a host (S1), and deriving a reflection ratio of detected abnormal behavior and misuse information (step 1). S2) and a step (S3) of generating intrusion information by integrating and determining the reflection rate between the information on the abnormal behavior and misuse behavior detected at the host level and the respective information.

As shown in FIG. 2, the host 1 is provided with an agent 104 and a sensor unit 103, respectively, and the agent is composed of a transmission unit 101 and an integrated determination unit 102.

As shown in FIG. 2, the sensor unit includes a plurality of data mining host-based abnormal behavior detection sensors 105, a HMM-based host abnormal behavior detection sensor 106, and a host-based misuse detection sensor 107. Is provided.

The integrated determination is made in one host 1, and in the host 1, the sensor unit 103 equipped with a plurality of models of detection sensors for detecting the degree of misuse or abnormal behavior is the integrated determination unit of the agent 104. All links to (102) provide information on misuse or abnormal behavior. That is, the misuse detection sensor 107 information and the abnormal behavior detection sensors 105 and 106 are combined and determined by the integrated determination unit 102, and the result is transmitted to the other intrusion detection system through the transmission unit 101 or Can be sent to a logging system.

In order to derive the best detection information by combining detection information of various detection sensors, it is necessary to reflect the correlation between detection sensors, adjust the intensity of intrusion or violation of normal behavior, and synchronize the integrated decision time.

The reason for reflecting the association between the detection sensors is that two sensors may respond to an event, and only one sensor may react at a time. Therefore, when each sensor responds to an event, each sensor As likely to be relevant, integration decisions are made under these usual assumptions.

Even if each detection sensor sends the same level of detection, it does not mean the same level of attack risk. In the case of host-based anomaly detection sensors, each user has a threshold that indicates whether an anomaly is detected. Therefore, information sent from each detection sensor should not be uniformly integrated. Therefore, the violation of detection information is adjusted in advance in order to integrate and export a single final detection result.

The timing of each detection sensor differs depending on the characteristics of the detection sensor or the normal behavior pattern of the user. Therefore, in the integrated decision coordinating the opinions of detection sensors having the same event and responding differently, the problem of determining when the integrated decision is made may be very important. Here, if the time for one detection sensor to respond is determined as the reference time of the integrated determination time, the correct integrated determination is not made. The reason is that when the detection sensor which is the basis of the integrated determination does not operate properly or does not output detection information, the integrated determination is not made. Therefore, in the present invention, it is possible to synchronize the integrated determination time so that the integrated determination is performed on the basis of the time when the detection information first enters the queue for the integrated determination in the unit of seconds or minutes. Can be arbitrarily determined.

The HMM type abnormal behavior detection sensor of the sensor unit 103 includes abnormal behavior detection for a system call, abnormal behavior detection for a file system, system call and file system, and the like. Three sensors are in charge of detecting abnormal behaviors. The abnormal behavior detection sensor of the data mining method of the sensor unit includes two abnormal behavior detection sensors that detect an abnormal behavior related to clustering and an association between a command or a program executed by a user.

The misuse detection sensor of the sensor unit 103 detects misuse behavior by analyzing an attack pattern in a fuzzy method and a colored petrinet method.

In addition to the above detection sensors, it is possible to add other multiple detection sensors.

The agent 104 collects detection information generated from a plurality of models of host-based intrusion detection sensors having different detection criteria, and the collected information is integrated by the integrated determination unit. It is in the form of client-server networking, to facilitate expansion and integration with other intrusion detection systems.

As shown in FIG. 3, the agent 104 is a sensor based on the results detected by the HMM sensor 106 and the data mining sensor 105, which are host-based abnormal behavior detection sensors, and the detection results of the misuse detection sensor 107. And determining a threshold value for each user, deriving an association between a plurality of models of detection sensors by the integrated sensor 117, and performing real-time integration determination by the integrated determination sensor. It also includes a function for transmitting information necessary for integration determination to other systems in consideration of integration or expansion with other intrusion detection systems.

Each detection sensor on the host can detect and process different areas and can also detect the same area. As each detection sensor produces its own detection results, the agent's integrated decision sensor coordinates the results. The integrated module of the host detection sensor verifies the detection result of each sensor by integrating and analyzing the information collected from each host detection sensor and determines attack behaviors that cannot be detected as a single sensor.

The integrated decision works offline and online. In offline, a correlation between a plurality of models of detection sensors is derived from the integrated sensor so as to perform a real-time integrated decision, and a threshold value for detecting abnormal behavior by sensor or user is determined. Based on this information, the integrated decision sensor performs the integrated decision in real time.

In the step of determining the sensor and the user-specific threshold value, in order to analyze the distribution of the determination result output by the sensor, first learning data for learning in the abnormal behavior detection sensor, and detects the detection result of the abnormal behavior detection sensor for the learning data Analyze The detection result is divided and analyzed for each section to obtain a decision distribution diagram of an abnormal behavior detection sensor for a normal behavior as shown in FIG. 4. The detection result is a state in which the attack is not included as a determination result for normal behavior.

The determination distribution of the abnormal behavior detection sensor for the normal behavior is used to estimate in advance how the abnormal behavior detection sensor will react when the normal behavior is performed. This estimation makes it possible to accurately distinguish between normal and abnormal behaviors and to reduce false positives.

In FIG. 4, the closer the value of the x-axis (abnormal behavior degree) is to 1, the higher the abnormal behavior degree. In FIG. 4, it can be seen that a primary cluster is generally formed between 0 and 0.5 and a secondary cluster is formed between 0.5 and 0.7. The part corresponding to the first cluster is a normal behavior determined correctly, and the part corresponding to the second cluster is a phenomenon caused by an error in learning or an algorithm. The second cluster is an obscure part that may be normal or abnormal. Therefore, this part can be improved by coordinating with the results of other sensors through the integrated determination process.

4 is a method of automatically interpreting a decision distribution diagram of an abnormal behavior detection sensor for normal behavior, and automatically dividing a first cluster and a second cluster by dividing the x-axis of the decision distribution into equally spaced intervals, and forming a continuous graph. Integrate by section to find the area of the graph.

As shown in FIG. 5, the x-axis is divided into equally spaced intervals, and a portion that is surely belonging to normal behavior and a portion that is not normal may be divided by the ratio of the area of each interval in the continuous graph. That is, a threshold value for detecting abnormal behavior may be obtained from detection results of each abnormal behavior detection sensor.

In the decision distribution diagram shown in FIG. 5, when the x-axis indicating the degree of abnormal behavior is divided into n sections according to the body integration method, the area of the n-th section is expressed by Equation 1 below by integrating along the x-axis in each section.

When the area of the whole area is obtained from the area A _n of the n-th section shown in Equation 1, Equation 2 is obtained.

If the system user has a 90% confidence in the normal behavior judgment result, it can be regarded as a valid area for normal behavior only up to 90% of the area A. Therefore, the threshold value that indicates whether an abnormal behavior is an i value satisfying the following equation (3).

When the interval k-1≤t≤k is determined, y _t is the value at x = x _t of a straight line passing through two points P _k-1 and P _k , and the area A in the interval [ x _k-1 , x _t ] ^t _k-1 is obtained as shown in Equation 4 below.

It is determined the total area A defined by the following equation (5) in, and the threshold value (x _t) which when separated define normal behavior ratio R of the distribution shown in Fig. 5 is x _t satisfy the following equation (6) of Obtained by

6 shows the obtained section [x _k-1 , x _k Normal behavior rateRThreshold corresponding tox _t ) Shows the location. Used in Figure 6a,b,h, x The variables are defined as in Equations 7 and 8 below.

In FIG. 6, the value of c is calculated by the proportional expression as in Equation 9 below.

If c and x are used, θ is obtained by the trapezoidal theorem as shown in Equation 10 below.

Summarizing the above equation into an equation for x , the following equation (11) is obtained.

Here, using the root formula and referring to the fact that x _t should be in the interval [ x _k-1 , x _k ] to obtain the value of x is given by Equation 12 below.

In this way, a threshold value x _t can be obtained as shown in Equation 13 below.

The variables for obtaining the reliability [lambda] for each sensor and user's normal behavior determination result are recorded. Since these records are used by the integrated sensor to adjust the results of each sensor, they are read, organized in a table, and saved to a file.

Even though each detection sensor sends the same value of detection level, it does not mean the same level of attack risk. Moreover, since abnormal behavior detection sensor has a threshold value for each user, information sent from each detection sensor uniformly It does not integrate the data, and adjusts the ratio between the detection opinions of the multiple model detection sensors. In other words, the fuzzy function is used to adjust the ratio of detection opinions before integration so that the results after integration are meaningful.

For example, even if two detection sensors send a value of 70 at the same time, if sensor A's threshold is 40 and sensor B's threshold is 60, the action sent by A is more dangerous than the normal. You can judge.

Therefore, the risk level was normalized for each threshold value using the relationship shown in Equation 6 below.

The integrated sensor reads each log file, divides them into units of integration time, merges them, and stores them in a temporary file, and reflects the temporary file (η) of each sensor of the host offline according to the algorithm proposed by the present invention. Obtain The reflectance ratio is stored in a separate file. In order to obtain the reflectance rate of the sensor, data including abnormal behavior and attack behavior are selected and the detection result of each sensor is recorded in each log file.

As shown in FIG. 7, in order to derive an association ratio between the host-based multi-model detection sensors, a process of calculating a reflection ratio may be performed by reading a reliability (λ) file of each detection sensor stored in advance and performing normal behavior for each user based on the reliability. Re-store the value of the violation from the user ID for each step (S11), reading the log file of each detection sensor (S12), checking whether all log files of each detection sensor (S13), each If the log files of the detection sensors are not read, reading the logs of the HMM sensor, the data mining sensor, and the misuse detection sensor, and storing the highest value among the log values of the integrated determination time unit of each sensor ( S14), comparing the integrated determination time of the recorded log information, and if the time zone value does not exist and processing as 0, storing the value separately (S15), when all log files are read. By step (S16), and each detection sensor to store the maximum value of the matrix up to a value of the log sensor by a step (S17) which calculates and stores a reflection ratio of the other sensor.

That is, by examining how each sensor responds to the same behavior of each detection sensor, it is possible to know how the detection area of each detection sensor is related to the detection area of each detection sensor. That is, when it is determined that one detection sensor has a high probability of intrusion, the other detection sensor may investigate how it reacts and express it as an association between the sensors. In general, a similar result can be defined when a similar result is obtained for the same behavior. This correlation is expressed as the response of the other sensor when the resulting value of each sensor is particularly higher than the overall reflectance ratio. Equation 7 below represents the reflectance ratio (η) when the i- th sensor derives the highest result value.

Where M is the number of sensors (1 ≦ i ≦ M , 1 ≦ j ≦ M ), and P _i is the probability that v _i will appear. Equation (7) is a mathematical form borrowed from Bayesian statistics.

The reflectance ratio obtained here should not be calculated by one calculation but should be the result of sufficient experimental data. Therefore, by applying an experimental log file to obtain the reflection ratio, the results obtained for each sensor are averaged as in Equation 8 below and taken as the reflection ratio.

The average? Obtained here is used as the reflectance ratio. Where R is the concept of time and represents the record size for a certain period.

The role of the reflecting ratio is to coordinate the opinions of the various sensors when they derive their respective opinions into a single, aggregated opinion. The reflectance ratio should reflect the relationship of each sensor. When one sensor has a strong opinion, how much it can be trusted is the opinion of other sensors that support it. The reflectance ratio consists of a two-dimensional array depending on the number of sensors. The row of the two-dimensional array is the most asserted sensor, and the column is the credibility of the opinion of the other sensor that supports it. The reason that the reflectance ratio should be obtained by using a lot of experimental data above is that the reflectance ratio for each sensor in the actual environment should be generated.

8 is an example of a table in which the values of the reflection ratios obtained above are recorded. If the detection result of the detection sensor does not produce a high determination result, that is, in the case of a clustering rule, only zero is displayed in the table. This failure to reflect the opinions of other sensors on one sensor can have many causes, including problems with the algorithm of the sensor. Therefore, the results determined by each detection sensor should be properly distributed.

The meaning of the axis of the radial graph in the radial graph shown in FIG. 9 indicates when the value of the sensor is the highest. For example, when the associated rule detection sensor has the highest result, it can be seen that the system call abnormal behavior is next higher, followed by the remaining HMM sensors.

The log of each detection sensor recorded in real time to adjust the strength of the intrusion or the degree of violation of normal behavior is received by the local host integration decision unit, and the file of the reliability (λ) of the aforementioned determination result is applied. . The violation value is entered into the user queue as it is updated to the highest value during the integration decision time. At this time, the number of cues is generated for each user by the number of detection sensors. The maximum value is determined as the final determination value by applying the detection value v of each detection sensor to the reflection rate matrix of the detection sensor generated by the integrated sensor.

That is, the final determination value is expressed by Equation 9 below.

As shown in FIG. 10, in the real-time integration determination by the integration determination unit, step S31 of reading the log file of each detection sensor and reading the reliability λ information for each user ID is performed to adjust the latitude (S32). ), Updating the log data of the detection sensor reflecting the reliability data to the queue for each user ID and each detection sensor (S33), checking whether the integrated determination time of the integrated determination unit is identical (S34), (matching If not, repeat steps S32 and S33, and if it matches, take the determination value of each detection sensor out of the queue (S35), and apply the matrix η 'which stores the reflection ratio obtained above. In operation S36, the final determination value is determined and stored in the log file of the integrated determination unit.

The transmission unit 101 may transmit the detected intrusion information to another location when integrating and expanding with other intrusion detection systems. In this case, the transmission unit 101 inserts and transmits the IP address of the corresponding host so that the intrusion detection system may know where the intrusion occurred. Also, the transmission unit 101 may generate an association table for each host.

As described above, according to the present invention, the detection information of the plurality of models of the host-based intrusion detection sensor is sent to the integrated determination unit to perform an integrated analysis, thereby providing reliability to the detection information of the intrusion detection sensors and inducing detection sensors of the multiple models. It is possible to make an integrated decision by correlating detection information of each other.

In addition, according to the present invention, it is possible to enlarge the detection area and greatly improve the accuracy of detection through the integrated determination of misuse and abnormal behavior detection sensors of multiple models in the host.

In the above, certain preferred embodiments of the present invention have been illustrated and described. However, the present invention is not limited to the above-described embodiments, and various modifications can be made by those skilled in the art without departing from the gist of the present invention as claimed in the claims. will be.

Claims (13)

delete delete delete delete delete Detecting abnormal behavior and misuse through multiple models of abnormal behavior detection sensors and misuse detection sensors in one host (S1); A step of deriving a reflection ratio between each detected abnormal behavior and misuse information (S2); And The host having an integrated determination function of misuse and abnormal behavior, comprising the step (S3) of generating a host-based intrusion information by integrating and determining the information on the detected abnormal behavior and misuse and the reflection rate between each information. Based integrated intrusion detection method, Derivation ratio derivation step (S2) between the detected abnormal behavior and misuse information, Reading the reliability (λ) file for the detection value detected by each sensor and resave the value of the violation degree from normal behavior for each user based on the reliability for each user ID (S11), Reading a log file of each detection sensor (S12), Checking whether all log files of each detection sensor have been read (S13), If the log files of each detection sensor are not read, reading the logs of the abnormal behavior detection sensor and the misuse detection sensor of a plurality of models, and storing the highest value among the log values of the integrated determination time unit of each sensor (S14), Comparing the time of the highest value among the log value of the unit of the integrated determination time of each sensor stored, and if the time zone value does not exist, processing as 0, and if it is stored separately (S15), If all log files have been read, storing the highest values of the logs in the highest value matrix for each sensor (S16), and Comprising a step of calculating and storing the reflection ratio of the different sensor for each detection sensor (S17); In step S3 of generating the intrusion information by integrating and determining the reflection rate between the information on the detected abnormal behavior and misuse and the respective information, Reading a log file of each detection sensor (S31), Applying reliability (λ) information for each user ID to a log of each detection sensor (S32), Further updating the log data of the detection sensor reflecting the reliability data to the queue for each user ID and each detection sensor (S33), Checking the detection time of the integrated determination unit (S34), Checking the detection time and repeating steps (S32) and (S33) if they do not match, and if there is a match, removing the determination value ( v ) of each detection sensor from the queue (S35), and And determining (S36) the final determination value of the integrated determination unit by applying the matrix (η) storing the reflection ratio and storing the final determination value in the integrated determination unit log file (S36). 7. The host-based system of claim 6, wherein the abnormal behavior detection sensor of the plurality of models in the step S1 detects the abnormal behavior by the HMM method and the data mining method. Integrated Intrusion Detection Method. The method of claim 6 or 7, wherein the abnormal behavior detection sensor in the step (S1), HMM method detects system call sequence, file system, and abnormal behavior on system call and file system. The data mining method is a host-based integrated intrusion detection method having an integrated determination function of misuse and abnormal behavior, characterized by detecting the association between the user's execution command and the program and the abnormal behavior of the clustering technique. 8. The host-based integration of claim 6, wherein the misuse detection sensor detects misuse by expressing an offense in a fuzzy manner and a colored Petrinet method. Intrusion Detection Method. delete 7. The following equation according to claim 6, wherein the step (S11) uses fuzzy as a preliminary step for integrating the values of detection sensors of a plurality of models. Host-based integrated intrusion detection method having an integrated determination function of misuse and abnormal behavior, characterized in that it comprises the step of regulating the value of each detection sensor by. 12. The method of claim 11, wherein the calculating and storing the reflection ratio of the different sensor for each detection sensor (S17) is the following equation A predetermined number of reflection ratios η obtained by repeating a step (a) of obtaining the reflection ratio η obtained by the above step and the step (a) of the reflection ratio η being obtained a predetermined number of times are calculated as follows. And (b) obtaining a final reflection ratio η 'by averaging using the host-based integrated intrusion detection method having an integrated determination function of misuse and abnormal behavior. delete