• Journal of Korea Multimedia Society
• /
• v.7 no.1
• /
• pp.91-97
• /
• 2004

As the electronic commercial transaction is being transacted by contents which can get an illegal intrusion from the outside, we sincerely require security for them. We must consider a protection countermeasure about intrusion from protection of the passive form to protection intrusion of the active one. So the security is required against hackers illegality intrusion into the contents. As soon as the intrusion happens about the contents, the tools providing the monitor of contents are required to minimize the damage to the systems. Modified web contents detection system in this paper prevents the loss of resources and manpower required through individually monitoring on the web. Also, this paper offers rapid support of security that it analyzes the weakness of contents security of the web environment and the cause of the problem with the leakage of information. So this system has the pur pose of protecting the weakness of contents security and the leakage of information.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.11 no.1
• /
• pp.130-140
• /
• 2010

SIP (Session Initiation Protocol) is a signaling protocol to provide IP-based VoIP (Voice over IP) service. However, many security vulnerabilities exist as the SIP protocol utilizes the existing IP based network. The SIP Malformed message attacks may cause malfunction on VoIP services by changing the transmitted SIP header information. Additionally, there are several threats such that an attacker can extract personal information on SIP client system by inserting malicious code into SIP header. Therefore, the alternative measures should be required. In this study, we analyzed the existing research on the SIP anomaly message detection mechanism against SIP attack. And then, we proposed a Co-occurrence based SIP packet analysis mechanism, which has been used on language processing techniques. We proposed a association rule generation and an attack detection technique by using the actual SIP session state. Experimental results showed that the average detection rate was 87% on SIP attacks in case of using the proposed technique.

• The Journal of the Acoustical Society of Korea
• /
• v.37 no.2
• /
• pp.118-128
• /
• 2018

In this paper, we have studied how to search an underwater object by learning the image generated by the side scan sonar in the convolution neural network. In the method of human side analysis of the side scan image or the image, the convolution neural network algorithm can enhance the efficiency of the analysis. The image data of the side scan sonar used in the experiment is the public data of NSWC (Naval Surface Warfare Center) and consists of four kinds of synthetic underwater objects. The convolutional neural network algorithm is based on Faster R-CNN (Region based Convolutional Neural Networks) learning based on region of interest and the details of the neural network are self-organized to fit the data we have. The results of the study were compared with a precision-recall curve, and we investigated the applicability of underwater object detection in convolution neural networks by examining the effect of change of region of interest assigned to sonar image data on detection performance.

• Journal of the Korea Society of Computer and Information
• /
• v.17 no.12
• /
• pp.179-185
• /
• 2012

This paper proposes a design of RSIDS(RST and SVM based Intrusion Detection System) using RST(Rough Set Theory) and SVM(Support Vector Machine) algorithm. The RSIDS consists of PrePro(PreProcessing) module, RRG(RST based Rule Generation) module, and SAD(SVM based Attack Detection) module. The PrePro module changes the collected information to the data format of RSIDS. The RRG module analyzes attack data, generates the rules of attacks, extracts attack information from the massive data by using these rules, and transfers the extracted attack information to the SAD module. The SAD module detects the attacks by using it, which the SAD module notifies to a manager. Therefore, compared to the existing SVM, the RSIDS improved average ADR(Attack Detection Ratio) from 77.71% to 85.28%, and reduced average FPR(False Positive ratio) from 13.25% to 9.87%. Thus, the RSIDS is estimated to have been improved, compared to the existing SVM.

• Journal of the Institute of Electronics and Information Engineers
• /
• v.52 no.4
• /
• pp.184-193
• /
• 2015

Passive Surveillance System based on the TDOA detects the emitter position in the air using TOA of pulses comprising emitter signal from multiple receivers. In case that PRI of pulses from the emitter is not enough big in comparison with the distance among receivers, it causes the ambiguity problem in selecting proper pulse pairs for TDOA emitter geolocation. In this paper, a novel ambiguity resolution method of radar pulses is presented by using genetic algorithm after changing ambiguity problem into optimization problem between TDOA of received pulses from each receiver and emitter position. Simulation results are presented to show the performance of the proposed method.

• The Journal of Korean Institute of Next Generation Computing
• /
• v.15 no.1
• /
• pp.86-98
• /
• 2019

Recently, the trend of building container-based PaaS (Platform-as-a-Service) is expanding. Container-based platform technology has been a core technology for realizing a PaaS. Containers have lower operating overhead than virtual machines, so hundreds or thousands of containers can be run on a single physical machine. However, recording and monitoring the storage logs for a large number of containers running in cloud computing environment occurs significant overhead. This work has identified two problems that occur when detecting a file system change event of a container running in a cloud computing environment. This work also proposes a system for container file system event detection in the environment by solving the problem. In the performance evaluation, this work performed three experiments on the performance of the proposed system. It has been experimentally proved that the proposed monitoring system has only a very small effect on the CPU, memory read and write, and disk read and write speeds of the container.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.3
• /
• pp.459-469
• /
• 2023

The number of IoT devices is explosively increasing due to the development of embedded equipment and computer networks. As a result, cyber threats to IoT are increasing, and currently, malicious codes are being distributed and infected to IoT devices and exploited for DDoS. Currently, IoT devices that are the target of such an attack have various installation environments and have limited resources. In addition, IoT devices have a characteristic that once set up, the owner does not care about management. Because of this, IoT devices are becoming a blind spot for management that is easily infected with malicious codes. Because of these difficulties, the threat of malicious codes always exists in IoT devices, and when they are infected, responses are not properly made. In this paper, we will design an malware detection system for IoT in consideration of the characteristics of the IoT environment and present detection rules suitable for use in the system. Using this system, it will be possible to construct an IoT malware detection system inexpensively and efficiently without changing the structure of IoT devices that are already installed and exposed to cyber threats.

• Journal of the Korea Society for Simulation
• /
• v.32 no.4
• /
• pp.41-58
• /
• 2023

As naval warfare changes to composite warfare that includes simultaneous engagements against surface, underwater, and air enemies, performance and tactical analysis are required to respond to naval warfare. In particular, for practical analysis of composite warfare, it is necessary to study engagement simulations that can appropriately utilize the limited performance resources of the detection system. This paper proposes a DEVS (Discrete Event Systems Specifications)-based simulation model for composite warfare analysis. The proposed model contains generalized models of combat platforms and armed objects to simulate various complex warfare situations. In addition, we propose a detection performance allocation algorithm that can be applied to a detection system model, considering the characteristics of composite warfare in which missions must be performed using limited detection resources. We experimented with the effectiveness of composite warfare according to the strength of the detection system's resource allocation, the enemy force's size, and the friendly force's departure location. The simulation results showed the effect of the resource allocation function on engagement time and success. Our model will be used as an engineering basis for analyzing the tactics of warships in various complex warfare situations in the future.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2002.04b
• /
• pp.971-974
• /
• 2002

일반적으로 악의적인 사용자는 시스템에 공격을 가해 관리자 권한을 취득한 후 그 시스템에 쉽게 침입하기 위해 백도어를 설치해 놓는다. 이전의 백도어는 대부분 사용자 영역에서 수행중인 응용 프로그램의 형태로 설치가 되었다. 그러나 최근에는 로더블 모듈과 같은 운영체제의 확장 방법을 이용하여 커널 영역에서 수행되는 백도어가 나타나게 되었다. 이러한 커널 백도어를 구현하는 방식은 크게 시스템 콜 테이블을 수정하는 방법과 시스템 콜 처리 루틴을 수정하는 방법의 두 가지로 나눌 수 있다. 본 논문에서는 기존에 구현된 커널 백도어의 특성 분석을 하였으며, 이를 기반으로 커널 백도어를 효율적으로 차단 및 탐지할 수 있는 방안을 제안하고 있다. 본 논문에서 언급하는 방안은 커널 메모리 영역에 대한 분석을 통하여 백도어가 시스템 콜 테이블을 수정하거나 시스템 콜 처리 루틴을 변경할 수 없도록 하는 보호 메커니즘을 적용하고 있다. 이를 통하여 커널 내부로 적재되어 백도어를 생성하는 악의적인 모듈의 가능성을 원천적으로 방지할 수 있다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2007.11a
• /
• pp.1198-1201
• /
• 2007

무선 Ad-Hoc 네트워크는 노드의 참여와 이탈이 자유롭고 토폴로지의 변화가 많아 악의적인 노드에 의해 데이터의 무결성 및 기밀성 문제와 같은 보안 위협에 노출되어 있다. 또한 악의적인 노드의 참여로 잘못된 라우팅 정보의 삽입을 통해 네트워크 분할이나 잘못된 정보전달 제공으로 노드의 통신장애를 유발할 수 있다. 그러나 현재 이와 같은 무선 Ad-Hoc 네트워크에서의 악의적인 노드를 발견하고 대응할 수 있는 연구가 부족하며, 기존의 악의적인 노드 탐지 기술들[11][12][13][14]은 정상적인 노드임에도 불구하고 거짓으로 신고했을 경우 인증절차 없이 경로를 재탐색하여 최적의 경로를 변경시킴으로서 정상적인 전송환경을 구축하지 못하는 문제점이 있다. 본 논문에서는 다중경로 기반의 보안경로 탐색기술[8]을 이용해 보안경로에 존재하는 중간노드들 사이에서 악의적인 노드를 발견한고, 검증된 최단경로를 통해 데이터전송을 하는 기법을 제안하고자 한다. 제안한 기법을 적용함으로써 노드에 대한 신고가 있을 때 확인과정을 거쳐 불필요하게 경로를 재탐색하는 과정을 줄일 수 있다.