Apparatus and method for scheming model for detecting secure shell communication

Abstract

A method for scheming a model for detecting SSH communication according to an embodiment includes collecting a training dataset including a plurality of network session logs from a web proxy, generating a plurality of preprocessed log information based on a plurality of original datasets included in each of the plurality of network session logs, training, in a first algorithm-based first initial model and a second algorithm-based second initial model for detecting a log corresponding to SSH communication from network session logs, the first initial model and the second initial model based on the plurality of preprocessed log information, and using a new dataset as input to the trained first initial model and the trained second initial model and scheming a final model based on a detection result of the trained first initial model and a detection result of the trained second initial model.