• The KIPS Transactions:PartC
• /
• v.12C no.5 s.101
• /
• pp.649-658
• /
• 2005

Since the Network based attack Is extensive in the real state of damage, It is very important to detect intrusion quickly at the beginning. But the intrusion detection using supervised learning needs either the preprocessing enormous data or the manager's analysis. Also it has two difficulties to detect abnormal traffic that the manager's analysis might be incorrect and would miss the real time detection. In this paper, we propose a traffic attributes correlation analysis mechanism based on self-organizing maps(SOM) for the real-time intrusion detection. The proposed mechanism has three steps. First, with unsupervised learning build a map cluster composed of similar traffic. Second, label each map cluster to divide the map into normal traffic and abnormal traffic. In this step there is a rule which is created through the correlation analysis with SOM. At last, the mechanism would the process real-time detecting and updating gradually. During a lot of experiments the proposed mechanism has good performance in real-time intrusion to combine of unsupervised learning and supervised learning than that of supervised learning.

• Convergence Security Journal
• /
• v.1 no.1
• /
• pp.21-29
• /
• 2001

For multiple attacks through large networks e.g., internet, IDS had better be installed over several hosts and collect all the audit data from them with appropriate synthesis. We propose a new distributed intrusion detection system called SPIDER II which is the upgraded version of the previous standalone IDS - SPIDER I. As like the previous version, SPIDER II has been implemented on Linux Accel 6.1 in CNU C. After planting intrusion detection engines over several target hosts as active agents, the administration module of SPIDER II receives all the logs from agents and analyzes hem. For the world-wide standardization on IDS, SPIDER II is compatible with MITRE's CVE(Common Vulnerabilities and Exposures).

• The KIPS Transactions:PartC
• /
• v.13C no.3 s.106
• /
• pp.295-302
• /
• 2006

An intrusion detection system writes a lot of alarms against attack behaviors in real time. These alarms contain not only actual attack alarms, but also false alarms that are mistakes made by the intrusion detection system. False alarms are the main reason that reduces the efficiency of the intrusion detection system, and we propose framework for false alarms analysis in the paper. Also, we apply an incremental data mining method for pattern analysis of false alarms increasing continuously. The framework consists of GUI, DB Manager, Alert Preprocessor, and False Alarm Analyzer. We analyze the false alarms increasingly through the experiment of the proposed framework and show that false alarms are reduced by applying the analyzed false alarm rules in the intrusion detection system.

• Proceedings of the Korea Society for Industrial Systems Conference
• /
• 2009.05a
• /
• pp.32-36
• /
• 2009

본 논문에서는 DCT영역에서 반복적 이진위상컴퓨터형성홀로그램을 이용한 디지털 영상 워터마킹 기술을 제안하였다. 워터마크로 주로 사용되는 랜덤 시퀸스 또는 로고와 같은 은닉영상 대신 은닉영상을 손실없이 재생할 수 있는 이진위상컴퓨터형성홀로그램을 생성하고, 이를 반복적으로 표현해서 워터마크로 사용한다. 그리고 이 워터마크를 호스트영상의 DCT 계수에 적절한 규칙을 통해 가중치를 부여하여 삽입한 후, IDCT한다. 워터마크의 추출은 워터마킹된 영상과 호스트영상을 DCT하고, 삽입시 적용한 규칙을 통해서 수행한다. 그리고 추출된 워터마크의 역푸리에 변환과 호스트영상에 삽입하기전의 워터마크를 역푸리에 변환하여 재생한 은닉영상과의 상관을 취함으로써 워터마크의 존재여부를 검증한다. 제안한 방법은 워터마크 삽입/추출시 반복되는 홀로그램정보를 활용하고, 이진 값으로 구성되어 있으므로 기존의 어떠한 워터마킹 기술보다 외부 공격에 견실한 특징을 가지고 있으며, 컴퓨터 시뮬레이션을 통해 그 성능을 확인하였다.

• Journal of Internet Computing and Services
• /
• v.7 no.3
• /
• pp.119-132
• /
• 2006

The network based security techniques well-known until now have week points to be passive in attacks and susceptible to roundabout attacks so that the misuse detection based intrusion prevention system which enables positive correspondence to the attacks of inline mode are used widely. But because the Misuse detection based Intrusion prevention system is proportional to the detection rules, it causes excessive false alarm and is linked to wrong correspondence which prevents the regular network flow and is insufficient to detect transformed attacks, This study suggests an Intrusion prevention system which uses Support Vector machines(hereinafter referred to as SVM) as one of rule based Intrusion prevention system and Anomaly System in order to supplement these problems, When this compared with existing intrusion prevention system, show performance result that improve about 20% and could through intrusion prevention system that propose false positive minimize and know that can detect effectively about new variant attack.

• The KIPS Transactions:PartC
• /
• v.9C no.3
• /
• pp.367-374
• /
• 2002

IPsec offers not odd Internet security service such as Internet secure communication and authentication but also the safe key exchange and anti-replay attack mechanism. Recently IPsec is implemented on the various operating systems. But there is no existing tool that checks the servers, which provide IPsec services, work properly and provide their network security services well. In this paper, we design and implement the rule based security evaluation system for IPsec engine. This system operated on Windows and UNX platform. We developed the system using Java and C language.

• Journal of Korea Multimedia Society
• /
• v.6 no.5
• /
• pp.778-787
• /
• 2003

Intrusion detection systems based on rules are not efficient for mutated attacks, because they need additional rules for the variations. In this paper, we propose an intrusion detection system using the time delay neural network. Packets on the network can be considered as gray images of which pixels represent bytes of them. Using this continuous packet images, we construct a neural network classifier that discriminates between normal and abnormal packet flows. The system deals well with various mutated attacks, as well as well known attacks.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2004.05a
• /
• pp.1091-1094
• /
• 2004

전통적인 호스트 기반 침입탐지시스템과 네트워크 기반 침입탐지시스템은 각각 로그 데이터나 패킷 정보에서 단일 공격을 탐지하고 침입경보를 생성한다. 그러므로, 기존의 침입탐지시스템들은 침입경보간의 상호 연관성에 대한 정보가 부족하게 되고, 다수의 거짓 침입경보를 발생시킨다. 이를 해결하기 위해, 본 논문에서는 추론 규칙을 이용하는 침입경보 연관관계 시스템을 제안한다. 제안한 시스템은 침입경보 수집기, 침입경보 전처리기, 침입경보 연관관계 분석기로 구성되어 있다. 침입경보 수집기는 각 침입탐지시스템으로부터 필터링 과정을 거쳐 전송된 침입경보를 받아 침입경보 데이터베이스에 저장한다. 침입경보 전처리기는 불필요한 침입경보를 줄임으로써 침입경보 연관관계 분석의 효율성을 높인다. 마지막으로, 침입경보 연관관계 분석기는 추론 규칙을 이용하여 침입경보간의 상호연관성을 파악한다.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.8 no.1
• /
• pp.123-136
• /
• 2004

In this paper, complexity and regularity of polynomial multiplication over $GF({2^n})$ are defined by using Hamming weight of rows and columns of the matrix ever GF(2) which represents polynomial multiplication. It is shown experimentally that in order to construct the block cipher robust against differential cryptanalysis, polynomial multiplication of substitution layer and the permutation layer should have high complexity and high regularity. With result of the experiment, a way of constituting S box and G function is suggested in the block cipher whose structure is similar to SEED, which is KOREA standard of 128-bit block cipher. S box can be formed with a nonlinear function and an affine transform. Nonlinear function must be strong with differential attack and linear attack, and it consists of an inverse number over $GF({2^8})$ which has neither a fixed pout, whose input and output are the same except 0 and 1, nor an opposite fixed number, whose output is one`s complement of the input. Affine transform can be constituted so that the input/output correlation can be the lowest and there can be no fixed point or opposite fixed point. G function undergoes linear transform with 4 S-box outputs using the matrix of 4${\times}$4 over $GF({2^8})$. The components in the matrix of linear transformation have high complexity and high regularity. Furthermore, G function can be constituted so that MDS(Maximum Distance Separable) code can be formed, SAC(Strict Avalanche Criterion) can be met, and there can be no weak input where a fixed point an opposite fixed point, and output can be two`s complement of input. The primitive polynomials of nonlinear function affine transform and linear transformation are different each other. The S box and G function suggested in this paper can be used as a constituent of the block cipher with high security, in that they are strong with differential attack and linear attack with no weak input and they are excellent at diffusion.

• Journal of Internet Computing and Services
• /
• v.22 no.3
• /
• pp.27-35
• /
• 2021

With the development of the Internet, various IT technologies such as IoT, Cloud, etc. have been developed, and various systems have been built in countries and companies. Because these systems generate and share vast amounts of data, they needed a variety of systems that could detect threats to protect the critical data contained in the system, which has been actively studied to date. Typical techniques include anomaly detection and misuse detection, and these techniques detect threats that are known or exhibit behavior different from normal. However, as IT technology advances, so do technologies that threaten systems, and these methods of detection. Advanced Persistent Threat (APT) attacks national or companies systems to steal important information and perform attacks such as system down. These threats apply previously unknown malware and attack technologies. Therefore, in this paper, we propose a hybrid intrusion detection system that combines anomaly detection and misuse detection to detect unknown threats. Two detection techniques have been applied to enable the detection of known and unknown threats, and by applying machine learning, more accurate threat detection is possible. In misuse detection, we applied Classification based on Association Rule(CBA) to generate rules for known threats, and in anomaly detection, we used One-Class SVM(OCSVM) to detect unknown threats. Experiments show that unknown threat detection accuracy is about 94%, and we confirm that unknown threats can be detected.