• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2015.05a
• /
• pp.219-221
• /
• 2015

스마트폰의 확산으로 금융관련 결제는 어디서나 가능하게 되었기에 편리함이 증가하였다. 하지만, 위와 같은 편리함과 동시에 사용자의 단말이 해커의 공격에 취약하거나 분실할 경우 심각한 문제가 된다. 따라서, 위와 같은 부정행위가 있을 경우 이를 자동으로 탐지하는 시스템이 필요하다. 그러므로, 본 논문은 이러한 문제점을 고려하여 스마트폰을 이용한 금융업무를 처리할때 GPS정보를 적용한 이상금융거래탐지시스템(Fraud Detection System) 모델을 제안한다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.04a
• /
• pp.359-361
• /
• 2003

기존의 오용 기반 침입탐지 시스템에서는 변형되거나 새로운 해킹 방법에 대한 지속적인 탐지패턴을 지원해 주어야 하는 단점이 있다. 이러한 변형되거나 알려지지 않은 공격에 대한 탐지는 비정상행위 탐지 방법으로 본 논문에서는 컴퓨터 면역시스템의 부정 및 긍정선택 방법과 가중치의 특성을 이용하였다. 즉, 알리진 공격으로부터 특성을 추출하여 알려지지 않은 공격에 대응할 수 있도록 특성을 변경하는 방법을 사용하였다. 이러한 방법으로 공격 특성을 추출하고 특성 추출에 사용하지 않은 다른 공격에 대한 탐지를 실험한 결과 u2r 공격인 buffer overflow 공격과 race condition 공격에 대하여 정확한 탐지가 이루어짐을 보였다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.5
• /
• pp.1069-1076
• /
• 2017

Recently $Pok\acute{e}mon$ GO implements an online game with location-based real time augmented reality on mobile. The correct play of this game should be based on collecting the $Pok\acute{e}mon$ that appears as the user moves around by foot, but as the popularity increases, it appears an abuse to play easily. Many people have used an application that provides a mock location service such as Fake GPS, and these applications can be judged to be cheating in online games because they can play games in the house without moving. Detection of such cheating from a client point of view (mobile device) can consume a large amount of resources, which can reduce the speed of the game. It is difficult for developers to apply detection methods that negatively affect game usage and user's satisfaction. Therefore, in this paper, we propose a method to detect users abusing mock location service in online game by route analysis using GPS location record from the server point of view.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.5
• /
• pp.1153-1160
• /
• 2018

As the number of online game users increases and the market size grows, various kinds of cheating are occurring. Game bots are a typical illegal program that ensures playtime and facilitates account leveling and acquisition of various goods. In this study, we propose a method to detect game bots based on user action time interval (ATI). This technique observes the behavior of the bot in the game and selects the most frequent actions. We distinguish between normal users and game bots by applying Machine Learning to feature frequency, ATI average, and ATI standard deviation for each selected action. In order to verify the effectiveness of the proposed technique, we measured the performance using the actual log of the 'Aion' game and showed an accuracy of 97%. This method can be applied to various games because it can utilize all actions of users as well as character movements and social actions.

• The KIPS Transactions:PartC
• /
• v.13C no.1 s.104
• /
• pp.45-54
• /
• 2006

Nowadays, a lot of techniques have been applied for the detection of malicious behavior. However, the current techniques taken into practice are facing with the challenge of much variations of the original malicious behavior, and it is impossible to respond the new forms of behavior appropriately and timely. There are also some limitations can not be solved, such as the error affirmation (positive false) and mistaken obliquity (negative false). With the questions above, we suggest a new method here to improve the current situation. To detect the malicious code, we put forward dealing with the basic source code units through the conceptual graph. Basically, we use conceptual graph to define malicious behavior, and then we are able to compare the similarity relations of the malicious behavior by testing the formalized values which generated by the predefined graphs in the code. In this paper, we show how to make a conceptual graph and propose an efficient method for similarity measure to discern the malicious behavior. As a result of our experiment, we can get more efficient detection rate.

• Review of KIISC
• /
• v.27 no.4
• /
• pp.43-50
• /
• 2017

온라인 게임 내 가상재화를 현실 세계의 재화로 교환할 수 있다는 점 때문에, PC기반 온라인 게임 내 가상세계는 많은 작업장(Gold-farmer)들로 인한 부정행위가 빈번히 일어나고 있다. 사이버 재화를 현금거래하는 RMT (Real Money Trading)은 과거에는 PC기반 온라인게임, 특히 고포류 게임이나 MMORPG와 같은 장르들에 주로 존재했으나, 모바일 게임에서도 최근 몇 년 간 거래시장이 활발해 지고, 가치가 높은 아이템들이 출현하기 시작하면서 거래 규모가 비약적으로 성장하고 있다. 이로 인해, PC게임에서만 존재하던 작업장이 모바일 게임에도 출현하고, 게임계정 도용을 위한 모바일 악성앱이 등장하는 등 모바일 게임 내의 부정 행위 및 공격 시도 역시 증가하고 있다. 모바일 게임은 하드웨어의 성능 제약 문제, 네트워크 통신의 항상성이 보장되지 않는 문제, 안드로이드 등 플랫폼 OS 자체의 보안 문제, 앱 자체의 디컴파일 문제와 같이 근본적으로 해결하기 어려운 취약점이 존재하는 환경에서 구동되기 때문에 PC기반 게임에서의 게임 봇 및 작업장 탐지와 같은 기법을 적용하기에는 적합하지 않다. 본 연구에서는 모바일 게임 보안과 PC 게임 보안 기법들을 비교하고, 향후 모바일 게임 보안 향상을 위해 할 수 있는 방안을 제시해 보도록 한다.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.16 no.12
• /
• pp.8908-8914
• /
• 2015

The Internet continues to grow and develop, but there are going to generate a variety of Internet attacks that exploit it. In the initial Internet environment, the attackers maliciously exploited Internet environments for ostentations and hobbies. but these days many malicious attempts purpose the financial gain so systematic and sophisticated attacks that are associated with various crimes are occurred. The structures, such as viruses and worms were present in the form of one source multi-target before. but recently, APT(Advanced Persistent Threat, intelligent continuous attacks) in the form of multi-source single target is dealing massive damage. The performance evaluation analyzed whether to generate audit data and detect integrity infringement, and false positives for normal traffic, process detecting and blocking functions, and Agent policy capabilities with respect to the application availability.

• Journal of Intelligence and Information Systems
• /
• v.20 no.3
• /
• pp.93-108
• /
• 2014

To support business decision making, interests and efforts to analyze and use transaction data in different perspectives are increasing. Such efforts are not only limited to customer management or marketing, but also used for monitoring and detecting fraud transactions. Fraud transactions are evolving into various patterns by taking advantage of information technology. To reflect the evolution of fraud transactions, there are many efforts on fraud detection methods and advanced application systems in order to improve the accuracy and ease of fraud detection. As a case of fraud detection, this study aims to provide effective fraud detection methods for auction exception agricultural products in the largest Korean agricultural wholesale market. Auction exception products policy exists to complement auction-based trades in agricultural wholesale market. That is, most trades on agricultural products are performed by auction; however, specific products are assigned as auction exception products when total volumes of products are relatively small, the number of wholesalers is small, or there are difficulties for wholesalers to purchase the products. However, auction exception products policy makes several problems on fairness and transparency of transaction, which requires help of fraud detection. In this study, to generate fraud detection rules, real huge agricultural products trade transaction data from 2008 to 2010 in the market are analyzed, which increase more than 1 million transactions and 1 billion US dollar in transaction volume. Agricultural transaction data has unique characteristics such as frequent changes in supply volumes and turbulent time-dependent changes in price. Since this was the first trial to identify fraud transactions in this domain, there was no training data set for supervised learning. So, fraud detection rules are generated using outlier detection approach. We assume that outlier transactions have more possibility of fraud transactions than normal transactions. The outlier transactions are identified to compare daily average unit price, weekly average unit price, and quarterly average unit price of product items. Also quarterly averages unit price of product items of the specific wholesalers are used to identify outlier transactions. The reliability of generated fraud detection rules are confirmed by domain experts. To determine whether a transaction is fraudulent or not, normal distribution and normalized Z-value concept are applied. That is, a unit price of a transaction is transformed to Z-value to calculate the occurrence probability when we approximate the distribution of unit prices to normal distribution. The modified Z-value of the unit price in the transaction is used rather than using the original Z-value of it. The reason is that in the case of auction exception agricultural products, Z-values are influenced by outlier fraud transactions themselves because the number of wholesalers is small. The modified Z-values are called Self-Eliminated Z-scores because they are calculated excluding the unit price of the specific transaction which is subject to check whether it is fraud transaction or not. To show the usefulness of the proposed approach, a prototype of fraud transaction detection system is developed using Delphi. The system consists of five main menus and related submenus. First functionalities of the system is to import transaction databases. Next important functions are to set up fraud detection parameters. By changing fraud detection parameters, system users can control the number of potential fraud transactions. Execution functions provide fraud detection results which are found based on fraud detection parameters. The potential fraud transactions can be viewed on screen or exported as files. The study is an initial trial to identify fraud transactions in Auction Exception Agricultural Products. There are still many remained research topics of the issue. First, the scope of analysis data was limited due to the availability of data. It is necessary to include more data on transactions, wholesalers, and producers to detect fraud transactions more accurately. Next, we need to extend the scope of fraud transaction detection to fishery products. Also there are many possibilities to apply different data mining techniques for fraud detection. For example, time series approach is a potential technique to apply the problem. Even though outlier transactions are detected based on unit prices of transactions, however it is possible to derive fraud detection rules based on transaction volumes.

• The Transactions of the Korea Information Processing Society
• /
• v.7 no.2
• /
• pp.392-400
• /
• 2000

In this paper, we propose an electronic election protocol based on VIOT protocol which utilizes public key cryptographic system and blind signature method to meet the seccurity requirement in election systems. Our proposed electronic election protocol provide voter's privacy and non-repudiation functionality which detect any misdemeanors of voters or relevant personnels.

• Journal of Intelligence and Information Systems
• /
• v.21 no.1
• /
• pp.161-177
• /
• 2015

With the rapid evolution of technology, the size, number, and the type of databases has increased concomitantly, so data mining approaches face many challenging applications from databases. One such application is discovery of fraud patterns from agricultural product wholesale transaction instances. The agricultural product wholesale market in Korea is huge, and vast numbers of transactions have been made every day. The demand for agricultural products continues to grow, and the use of electronic auction systems raises the efficiency of operations of wholesale market. Certainly, the number of unusual transactions is also assumed to be increased in proportion to the trading amount, where an unusual transaction is often the first sign of fraud. However, it is very difficult to identify and detect these transactions and the corresponding fraud occurred in agricultural product wholesale market because the types of fraud are more intelligent than ever before. The fraud can be detected by verifying the overall transaction records manually, but it requires significant amount of human resources, and ultimately is not a practical approach. Frauds also can be revealed by victim's report or complaint. But there are usually no victims in the agricultural product wholesale frauds because they are committed by collusion of an auction company and an intermediary wholesaler. Nevertheless, it is required to monitor transaction records continuously and to make an effort to prevent any fraud, because the fraud not only disturbs the fair trade order of the market but also reduces the credibility of the market rapidly. Applying data mining to such an environment is very useful since it can discover unknown fraud patterns or features from a large volume of transaction data properly. The objective of this research is to empirically investigate the factors necessary to detect fraud transactions in an agricultural product wholesale market by developing a data mining based fraud detection model. One of major frauds is the phantom transaction, which is a colluding transaction by the seller(auction company or forwarder) and buyer(intermediary wholesaler) to commit the fraud transaction. They pretend to fulfill the transaction by recording false data in the online transaction processing system without actually selling products, and the seller receives money from the buyer. This leads to the overstatement of sales performance and illegal money transfers, which reduces the credibility of market. This paper reviews the environment of wholesale market such as types of transactions, roles of participants of the market, and various types and characteristics of frauds, and introduces the whole process of developing the phantom transaction detection model. The process consists of the following 4 modules: (1) Data cleaning and standardization (2) Statistical data analysis such as distribution and correlation analysis, (3) Construction of classification model using decision-tree induction approach, (4) Verification of the model in terms of hit ratio. We collected real data from 6 associations of agricultural producers in metropolitan markets. Final model with a decision-tree induction approach revealed that monthly average trading price of item offered by forwarders is a key variable in detecting the phantom transaction. The verification procedure also confirmed the suitability of the results. However, even though the performance of the results of this research is satisfactory, sensitive issues are still remained for improving classification accuracy and conciseness of rules. One such issue is the robustness of data mining model. Data mining is very much data-oriented, so data mining models tend to be very sensitive to changes of data or situations. Thus, it is evident that this non-robustness of data mining model requires continuous remodeling as data or situation changes. We hope that this paper suggest valuable guideline to organizations and companies that consider introducing or constructing a fraud detection model in the future.