• Proceedings of the Korea Information Processing Society Conference
• /
• 2003.05c
• /
• pp.2025-2028
• /
• 2003

다양한 위협과 침입공격에 노출되어 있는 조직의 경우, 특정 제품에서 제공하는 한정된 침입탐지패턴의 한계를 극복하여 침입사건을 효과적으로 탐지하여 대응하기 위하여 이기종 침입탐지시스템 설치 및 운용이 요구된다. 이기종 침입탐지시스템 운용은 침입탐지 감사데이터 포맷이 제품별로 상이하고, 두개 제품 이상에 구현된 동일한 침입탐지 패턴이라도 설계의 차이점에 기인하여 오판률 가능성이 증가할 가능성이 있으며, 특히 탐지사건에 대한 대응으로 e-mail, SMS 등을 이용할 경우 중복 탐지로 인한 과도한 대응 등의 문제점이 있을 수 있으므로 이기종 침입탐지시스템 운영 환경에 적합한 기종간 통합 및 대응 모델과 관련 모듈 설계에 관한 연구가 필요하다 본 논문에서는 최근 연구되는 Aggregation 및 Correlation 개념을 적용하여 이기종 침입탐지시스템 운용 환경에서 침입탐지패턴 통합 및 대응을 위한 요구사항을 도출하고 통합 및 대응을 위한 IPMAC 모델 및 탐지알고리즘을 제시하여 관련 모듈을 설계 및 구현한 결과를 제안한다.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.11 no.12
• /
• pp.2287-2297
• /
• 2007

The proposed ANIDS(Advanced Network Intrusion Detection System) which is network-based IDS using Association Rule Mining, collects the packets on the network, analyze the associations of the packets, generates the pattern graph by using the highly associated packets using Association Rule Mining, and detects the intrusion by using the generated pattern graph. ANIDS consists of PMM(Packet Management Module) collecting and managing packets, PGGM(Pattern Graph Generate Module) generating pattern graphs, and IDM(Intrusion Detection Module) detecting intrusions. Specially, PGGM finds the candidate packets of Association Rule large than $Sup_{min}$ using Apriori algorithm, measures the Confidence of Association Rule, and generates pattern graph of association rules large than $Conf_{min}$. ANIDS reduces the false positive by using pattern graph even before finalizing the new pattern graph, the pattern graph which is being generated is compared with the existing one stored in DB. If they are the same, we can estimate it is an intrusion. Therefore, this paper can reduce the speed of intrusion detection and the false positive and increase the detection ratio of intrusion.

• The Korean Journal of Applied Statistics
• /
• v.35 no.3
• /
• pp.407-419
• /
• 2022

The semiconductor fabrication process is complex and time-consuming. There are sometimes errors in the process, which results in defective die on the wafer bin map (WBM). We can detect the faulty WBM by finding some patterns caused by dies. When one manually seeks the failure on WBM, it takes a long time due to the enormous number of WBMs. We suggest a two-step approach to discover the probable pattern on the WBMs in this paper. The first step is to separate the normal WBMs from the defective WBMs. We adapt a hierarchical clustering for de-noising, which nicely performs this work by wisely tuning the number of minimum points and the cutting height. Once declared as a faulty WBM, then it moves to the next step. In the second step, we classify the patterns among the defective WBMs. For this purpose, we extract features from the WBM. Then machine learning algorithm classifies the pattern. We use a real WBM data set (WM-811K) released by Taiwan semiconductor manufacturing company.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.7 no.5
• /
• pp.978-985
• /
• 2003

The implementation of abnormal behavior detection IDS is more difficult than the implementation of misuse behavior detection IDS because usage patterns are various. Therefore, most of commercial IDS is misuse behavior detection IDS. However, misuse behavior detection IDS cannot detect system intrusion in case of modified intrusion patterns occurs. In this paper, we apply data mining so as to detect intrusion with only audit data related in intrusion among many audit data. The agent in the distributed IDS can collect log data as well as monitoring target system. False positive should be minimized in order to make detection accuracy high, that is, core of intrusion detection system. So We apply data mining algorithm for prediction of modified intrusion pattern in the level of audit data learning.

• Journal of Software Assessment and Valuation
• /
• v.8 no.2
• /
• pp.13-27
• /
• 2012

This paper presents a tree-pattern based code-clone detector as CCR(Code Clone Ransacker) that finds all clusterd dulpicate pattern by comparing all pair of subtrees in the programs. The pattern included in its entirely in another pattern is ignored since only the largest duplicate patterns are interesed. Evaluation of CCR is high precision and recall. The previous tree-pattern based code-clone detectors are known to have good precision and recall because of comparing program structure. CCR is still high precision and the maximum 5 times higher recall than Asta and about 1.9 times than CloneDigger. The tool also include the majority of Bellon's reference corpus.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.04a
• /
• pp.539-541
• /
• 2003

본 논문에서는 컨텐츠 사이트에서 디지털 컨텐츠를 보호하기 위하여 사용자 행동 패턴을 분석을 이용해 특이한 성향을 보이는 사용자를 탐지하기 위한 모델을 제시하였다. 사용자의 행동 패턴을 분석하기 위한 탐지 규칙(detection rule)으로 Syntactic Rule과 Semantic Rule을 정의하였다. 사용자 로그 분석 결과 탐지 규칙에 대한 위반 정도가 일정 범위를 벗어나는 사용자를 비정상적인 사용자로 추정하였다. 또한 제안 모델은 eCRM 시스템에서 이탈 가능성이 있는 고객 집단을 사전에 탐지하여 고객으로 유지하기 위한 promotion 전략 수립에 응용될 수 있다.

• Journal of Korea Multimedia Society
• /
• v.6 no.6
• /
• pp.1062-1070
• /
• 2003

In this paper, we observe one of the aquatic insect, fish(Medaka)'s behavior which reacts to giving toxic chemicals until lethal conditions using automatic tracking sl$.$stem. For the result, we define the Pattern A is a normal movement of fish and Pattern B is after giving the chemicals. In order to detect the movement of fish automatically, these patterns are selected for the training data of the artificial neural networks. The average recognition rates of the pattern B are remarkably increased after inputs of toxic chemical(diazinon) while the Pattern A is decreased distinctively. This study demonstrates that artificial neural networks are useful method for detecting presence of toxicoid in environment as for an alternative of in-situ behavioral monitoring tool.

• Journal of Korea Game Society
• /
• v.2 no.1
• /
• pp.55-61
• /
• 2002

유 무선환경에서 침입 패턴이 다양화되고, 모바일의 편리성이 강조되면서 네트워크 대역폭이 다양한 전송 기반을 요구하고 있다. 그리고 무선기반의 자료가 급증하고 있어, 무선환경에서의 침입탐지시스템 성능에 문제가 될 수 있다. 그러므로 게이트웨이를 근간으로 한 무선전송 기반을 보호하고, 컴퓨터 운영체제 상에 내재된 보안상의 결함을 보호하기 위하여 기존의 운영체제 내에 보안 기능을 추가한 운영체제이며, 커널의 핵심 부분을 인지하여 무선기반의 시스템 사용자에 대한 식별 및 인증, 강제적 접근 통제, 임의적 접근 통제, 해킹 대응 등의 보안 기능 요소들을 갖추게 하여 보안성에 강한 시스템 유지를 요구한다. 그러므로 감시대상의 정보를 미리 알고, WAP환경하에서 감시대상에 유효한 침입패턴만을 검사하도록 침입패턴 데이터베이스를 분리하는 모델을 제시하여, 이러한 문제점에 대한 해결책을 제시하고자 하였다. 따라서 기존 침입탐지시스템의 패턴 데이터베이스를 분석하였고, 이를 적절히 분리하여 이를 다시 운영체제에 반영하는 기법이다. 그리고 이를 제시한 모델을 검증하고자 실제 구현과 실험을 통해 이를 검증하였다.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.20 no.7
• /
• pp.613-621
• /
• 2019

Recently, with the development of the Internet of Things (IoT) and cloud computing technologies, security threats have increased as malicious codes infect IoT devices, and new malware spreads ransomware to cloud servers. In this study, we propose a threat-detection technique that checks obfuscated script patterns to compensate for the shortcomings of conventional signature-based and behavior-based detection methods. Proposed is a malicious code-detection technique that is based on malicious script-pattern analysis that can detect zero-day attacks while maintaining the existing detection rate by registering and checking derived distribution patterns after analyzing the types of malicious scripts distributed through websites. To verify the performance of the proposed technique, a prototype system was developed to collect a total of 390 malicious websites and experiment with 10 major malicious script-distribution patterns derived from analysis. The technique showed an average detection rate of about 86% of all items, while maintaining the existing detection speed based on the detection rule and also detecting zero-day attacks.

• Journal of the Korea Society of Computer and Information
• /
• v.17 no.4
• /
• pp.11-18
• /
• 2012

Deep packet inspection which perform pattern matching to search for malicious patterns in the packet is most computationally intensive task. Hardware-based pattern matching is required for real-time packet inspection in high-speed network. In this paper, we have designed and implemented network intrusion detection hardware as a Microblaze-based SoC using Virtex-6 FPGA, which capture the network input packet, perform hardware-based pattern matching for patterns in the Snort rule, and provide the matching result to the software. We verify the operation of the implemented system using traffic generator and real network traffic. The implemented hardware can be used in network intrusion detection system operated in wire-speed.