• Proceedings of the KAIS Fall Conference
• /
• 2010.05a
• /
• pp.455-458
• /
• 2010

침입탐지시스템은 공격이라고 판단되면 경보를 발생하여 보안 관리자에게 알려주거나 자체적으로 대응을 하게 된다. 그러나 이러한 경보들 중에 오경보가 많이 포함되어 있어 침입탐지시스템의 성능을 저하시킬 뿐 아니라 대량의 경보자체가 보안메커니즘에 방해가 되고 있다. 특히 오경보중 False Positive가 전체 오경보의 대부분을 차지하고 있다. 즉, False Positive는 정상 행위를 침입행위로 오인하여 판단하는 것을 의미한다. 경보들 중 이러한 오경보들은 네트워크 전반에 걸친 보안 서비스의 질을 하락시키는 원인이 된다. 따라서 침입탐지시스템의 성능향상을 위해서는 이러한 오경보 문제가 반드시 해결되어야 한다. 본 논문에서는 침입탐지시스템의 오경보를 감소시키는 결정트리 기반 오경보 분류모델을 제안하였다. 결정트리 기반 오경보 분류 모델은 침입탐지시스템의 오경보율을 감소시키고 침입탐지율을 향상시키는 역할을 수행한다는 것을 확인할 수 있었다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2004.10a
• /
• pp.427-429
• /
• 2004

인터넷상에서 해킹도구들을 구할 수 있게 되고 이러한 정보들이 쉽고 빠르게 전파됨에 따라 쉽게 해킹을 시도할 수 있게 되었고 이로 인해 침입시도의 수가 급증하고 있다. 그 결과 침입탐지시스템(Intrusion Detection System, IDS)에서 발생하는 침입시도정보의 수도 늘어나고 있다. 또한 이렇게 생성되는 많은 침입시도정보들에서 긍정오류(false positive)와 같은 잘못된 침입시도정보들이 큰 문제이다. 침입으로 오인된 정보가 너무 많음으로 인해 네트워크 관리자가 정확하게 판단을 하여 대응하는데 많은 노력이 요구된다. 이러한 노력을 줄여주기 위하여 긍정오류와 반복되는 침입시도정보를 줄여주는 기법이 필요하다. 본 논문에서는 이러한 필터링 시스템을 제안한다. 시스템 정보를 이용하여 위험이 될 수 없는 공격을 제거하여 관리자에게 정확한 정보를 전달하고 동일한 공격들을 제거하여 침입 시도정보의 수를 줄여 주는 방법을 제안한다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2002.10c
• /
• pp.541-543
• /
• 2002

정보기술의 발전은 디지털 혁명의 근간이 되고 있는 반면, 정보유출ㆍ파괴ㆍ변조 등의 역기능 또한 내포하기 때문에 이러한 정보화의 역기능에 대한 신속한 탐지 및 능동적인 대응이 절실히 요구되고 있는 실정이다. 그러나 기존의 시스템은 침입에 대한 차단을 중심으로 운영되어 왔고, 침입탐지 시스템이라 할지라도 불법 침입에 대한 대응이 단지 경고나 보고 수준에 머물고 있어 능동적인 대응이 없다는 단점이 있다. 따라서 본 논문에서는 리눅스 시스템에서 실시간 침입탐지 시스템인 NIDS를 설계 구현하고, 동일 네트워크 망에서의 여러 호스트들을 통합적으로 관리하기 위하여 M/A 시스템을 설계ㆍ구현하였다. 여기서 NIDS와 M/A 시스템간의 통신은 SSL/TLS 프로토콜을 기반으로 이루어진다. NIDS에서는 Detection Module과 Response Module을 분리하여 구현하였고, 커널 레벨에서 PCAP 라이브러리를 통해 캡쳐된 패킷이 Detection Module에 의해 침입이라 판단되면 Response Module에서 일정 수준의 대응이 가능하도록 구현하였다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.1
• /
• pp.93-98
• /
• 2012

MANET composed of only moving nodes is concerned to core technology to construct ubiquitous computing environment. Also, it is a lack of security because of no middle infrastructure. So, it is necessary to intrusion detection system which can track malicious attack. In this study, cluster was used to stable intrusion detection, and rule about various attacks was defined to detect accurately attack that seems like network problem. Proposed method through experience was confirmed that stable detection rate was showed although number of nodes increase.

• Review of KIISC
• /
• v.33 no.4
• /
• pp.47-55
• /
• 2023

자동차 산업에서 전자제어장치 (Electronic Controller Unit, ECU)를 활용한 혁신으로 운전자들은 안전하고 편리한 운전경험을 누리고 있다. 그러나 이와 동시에, 차량 내부 ECU 간의 통신을 지원하는 CAN (Controller Area Network)을 대상으로 한 악의적인 침입과 사이버 공격의 위협 역시 증가하고 있다. 이러한 문제에 대응하기 위해 많은 연구가 진행 중이며, 특히 자동차 침입 탐지 시스템 (Intrusion Detection System, IDS)의 발전이 주목받고 있다. 그러나 대부분의 IDS는 주로 공격을 탐지하는 데 집중되어 있으며, 실제 악의적인 메시지를 전송한 ECU를 정확히 식별하는 데에는 한계점이 있다. 악의적인 ECU를 식별하는 기술은 공격 ECU를 격리시키거나 펌웨어 업데이트 등의 보안 패치를 적용하는데 필수적인 기술이다. 본 고에서는 현재까지 제안된 CAN에서의 악의적인 ECU를 식별하기 위한 기술들에 대해 살펴보고, 비교 분석 및 한계점에 대해 분석하고자 한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2023.05a
• /
• pp.262-264
• /
• 2023

Internet of Things (IoT) networks currently employ an increased number of users and applications, raising their susceptibility to cyberattacks and data breaches, and endangering our security and privacy. Intrusion detection, which includes monitoring and analyzing incoming and outgoing traffic to detect and prohibit the hostile activity, is critical to ensure cybersecurity. Conventional intrusion detection systems (IDS) are centralized, making them susceptible to cyberattacks and other relevant privacy issues because all the data is gathered and processed inside a single entity. This research aims to create a blockchain-based architecture to support federated learning and improve cybersecurity and intrusion detection in IoT networks. In order to assess the effectiveness of the suggested approach, we have utilized well-known cybersecurity datasets along with centralized and federated machine learning models.

• The KIPS Transactions:PartC
• /
• v.11C no.7 s.96
• /
• pp.1033-1042
• /
• 2004

According to the arbitration mechanism among the peers in the network, the P2P networking environments can be classified into hybrid P2P networking environments and pure P2P networking environments. In hybrid P2P networking environments, each peer gets continual services from the servers that arc operational most of the time, and so, network isolation does not occur because every peer can always keep connection to the server. In pure P2P networking environments, however, every peer directly connects to another peer without server intervention, and so, network isolation can occur when the per mediating the connection is terminated. In this paper, we propose a scheme for each peer to keep connection information of other peers by maintaining IDs of its neighbor peers, to reconnect to another peers when the mediating peer fails to work. and, for efficiency. to balance the number of connections that should be maintained by each peer. With our mechanism, each pier in the network can continuously maintain connection to the network and get seamless services from other peers. Through the simulation, we ascer-tained that network isolation does not occur in the pure P2P network adopting our mechanism and that our mechanism distributes and balances the connections that are maintained by each peer. We also analyzed the total network traffic and the mean number of hops for the connections made by each peer according to the recommended number of connections that is established at system setup time.

• KIPS Transactions on Software and Data Engineering
• /
• v.10 no.11
• /
• pp.449-456
• /
• 2021

An intrusion detection system is a technology that detects abnormal behaviors that violate security, and detects abnormal operations and prevents system attacks. Existing intrusion detection systems have been designed using statistical analysis or anomaly detection techniques for traffic patterns, but modern systems generate a variety of traffic different from existing systems due to rapidly growing technologies, so the existing methods have limitations. In order to overcome this limitation, study on intrusion detection methods applying various machine learning techniques is being actively conducted. In this study, a comparative study was conducted on data preprocessing techniques that can improve the accuracy of anomaly detection using NGIDS-DS (Next Generation IDS Database) generated by simulation equipment for traffic in various network environments. Padding and sliding window were used as data preprocessing, and an oversampling technique with Adversarial Auto-Encoder (AAE) was applied to solve the problem of imbalance between the normal data rate and the abnormal data rate. In addition, the performance improvement of detection accuracy was confirmed by using Skip-gram among the Word2Vec techniques that can extract feature vectors of preprocessed sequence data. PCA-SVM and GRU were used as models for comparative experiments, and the experimental results showed better performance when sliding window, skip-gram, AAE, and GRU were applied.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.10 no.4
• /
• pp.811-817
• /
• 2009

The rapid growth of network based IT systems has resulted in continuous research of security issues. Probe intrusion detection is an area of increasing concerns in the internet community. Recently, a number of probe intrusion detection schemes have been proposed based on various technologies. However, the techniques, which have been applied in many systems, are useful only for the existing patterns of probe intrusion. They can not detect new patterns of probe intrusion. Therefore, it is necessary to develop a new Probe Intrusion Detection technology that can find new patterns of probe intrusion. In this paper, we proposed a new network based probe intrusion detector(NePID) using anomaly traffic analysis and fuzzy cognitive maps that can detect intrusion by the denial of services attack detection method utilizing the packet analyses. The probe intrusion detection using fuzzy cognitive maps capture and analyze the packet information to detect syn flooding attack. Using the result of the analysis of decision module, which adopts the fuzzy cognitive maps, the decision module measures the degree of risk of denial of service attack and trains the response module to deal with attacks. For the performance evaluation, the "IDS Evaluation Data Set" created by MIT was used. From the simulation we obtained the max-average true positive rate of 97.094% and the max-average false negative rate of 2.936%. The true positive error rate of the NePID is similar to that of Bernhard's true positive error rate.

• Journal of the Korea Society of Computer and Information
• /
• v.16 no.4
• /
• pp.101-110
• /
• 2011

A smart grid networks delivers electricity from suppliers to consumers using digital technology with two-way communications to control appliances at consumers' homes to save energy, reduce cost and increase reliability and transparency. Security is critically important for smart grid networks that are usually used for the electric power network and IT environments that are opened to attacks, such as, eavesdroping, replay attacks of abnormal messages, forgery of the messages to name a few. ZigBee has emerged as a strong contender for smart grid networks. ZigBee is used for low data rate and low power wireless network applications. To deploy smart grid networks, the collected information requires protection from an adversary over the network in many cases. The security mechanism should be provided for collecting the information over the network. However, the ZigBee protocol has some security weaknesses. In this paper, these weaknesses are discussed and a method to improve security aspect of the ZigBee protocol is presented along with a comparison of the message complexity of the proposed security protocol with that of the current ZigBee protocol.