• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.23 no.10
• /
• pp.1311-1319
• /
• 2019

Currently, the web environment is a commonly used area for sharing information and conducting business. It is becoming an attack point for external hacking targeting on personal information leakage or system failure. Conventional signature-based detection is used in cyber threat but signature-based detection has a limitation that it is difficult to detect the pattern when it is changed like polymorphism. In particular, injection attack is known to the most critical security risks based on web vulnerabilities and various variants are possible at any time. In this paper, we propose a novelty detection technique to detect abnormal state that deviates from the normal state on web-server log dataset(WSLD). The proposed method is a machine learning-based technique to detect a minor anomalous data that tends to be different from a large number of normal data after replacing strings in web-server log dataset with vectors using machine learning-based embedding algorithm.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.4
• /
• pp.763-773
• /
• 2017

In recent years, personal information leakage and technology leakage accidents are frequently occurring. According to the survey, the most important part of this spill is the 'insider' within the organization, and the leakage of technology by insiders is considered to be an increasingly important issue because it causes huge damage to the organization. In this paper, we try to learn the normal behavior of employees using machine learning to prevent insider threats, and to investigate how to detect abnormal behavior. Experiments on the detection of abnormal behavior by implementing an Autoencoder composed of Recurrent Neural Network suitable for learning time series data among the neural network models were conducted and the validity of this method was verified.

• Proceedings of the Korean Information Science Society Conference
• /
• 2005.11a
• /
• pp.130-132
• /
• 2005

초고속 네트워크의 폭발적인 확산과 함께 네트워크 침입 사례 또한 증가하고 있다. 이를 검출하기 위한 방안으로 침입 탐지 시스템에 대한 관심과 연구 또한 증가하고 있다. 네트워크 침입을 탐지위한 방법으로 기존의 알려진 공격을 찾는 오용 탐지와 비정상적인 행위를 탐지하는 방법이 존재한다. 본 논문에서는 이를 혼합한 하이브리드 형태의 새로운 침입 탐지 시스템을 제안한다. 기존의 혼합된 방식과는 다르게 네트워크 데이터의 모델링과 탐지를 위해 가우시안 혼합 모델을 사용한다. 가우시안 혼합 모델에 기반한 침입 탐지 시스템의 성능을 평가하기 위해 DARPA'99 데이터에 적용하여 실험하였다. 실험 결과 정상과 공격은 확연히 구분되는 결과를 나타내었으며, 공격 간의 분류도 상당 수 가능하였다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.5
• /
• pp.1027-1037
• /
• 2019

Conventional cyber-attack detection solutions are generally based on signature-based or malicious behavior analysis so that have had difficulty in detecting unknown method-based attacks. Since the various information occurring all the time reflects the state of the system, by modeling it in a steady state and detecting an abnormal state, an unknown attack can be detected. Since a variety of system information occurs in a string form, word embedding, ie, techniques for converting strings into vectors preserving their order and semantics, can be used for modeling and detection. Novelty Detection, which is a technique for detecting a small number of abnormal data in a plurality of normal data, can be performed in order to detect an abnormal condition. This paper proposes a method to detect system anomaly by cyber attack using embedding and novelty detection.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2003.05c
• /
• pp.2093-2096
• /
• 2003

정보통신 구조의 확산 및 기술이 발전함에 따라 전산 시스템에 대한 침입과 피해가 증가되고 있는 실정이다. 이에 비정상행위 기반 침입탐지 시스템에 대한 연구가 활발히 진행되고 있는 가운데 특히, 시스템 호출 감사자료 척도에 은닉 마르코프 모델(HMM)로 모델링 하는 연구가 많이 이루어지고 있다. 하지만, 이는 일정한 임계값 이하의 비정상행위만을 감지할 뿐, 어떠한 유형의 침입인지를 판별하지 못한다. 본 논문에서는, 이러한 침입탐지 시스템의 맹점을 보완하기 위하여 Viterbi 알고리즘을 이용하여 상태 변화를 분석한 후, 어떤 유형의 침입이 발생하였는지를 판별하는 방법을 제안하고, 실험을 통해 제안한 시스템의 가능성을 보인다.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.35 no.3B
• /
• pp.408-420
• /
• 2010

On a Mobile Ad hoc NETwork(MANET), it is difficult to detect and prevent misbehaviors nodes existing between end nodes, as communication between remote nodes is made through multiple hop routes due to lack of a fixed networked structure. Therefore, to maintain MANET's performance and security, a technique to identify misbehaving middle nodes and nodes that are compromise by such nodes is required. However, previously proposed techniques assumed that nodes comprising MANET are in a friendly and cooperative relationship, and suggested only methods to identify misbehaving nodes. When these methods are applied to a larger-scale MANET, large overhead is induced. As such, this paper suggests a system model called Secure Cluster-based MANET(SecCBM) to provide secure communication between components aperANET and to ensure eed. As such, this pand managems suapemisbehavior nodes. SecCBM consists apetwo stages. The first is the preventis pstage, whereemisbehavior nodes are identified when rANET is comprised by using a cluster-based hierarchical control structure through dynamic authentication. The second is the post-preventis pstage, whereemisbehavior nodes created during the course apecommunication amongst nodes comprising the network are dh, thed by using FC and MN tables. Through this, MANET's communication safety and efficiency were improved and the proposed method was confirmed to be suitable for MANET through simulation performance evaluation.

• The KIPS Transactions:PartC
• /
• v.19C no.3
• /
• pp.185-190
• /
• 2012

The recent trends in malwares show the most widely used for the distribution of malwares that the targeted computer is infected while the user is accessing to the website, without being aware of the fact that, in which the harmful codes are concealed. In this thesis, we propose a new malicious web page detection system based on a real time analysis of normal/abnormal behaviors in client-side. By means of this new approach, it is not only the limitation of conventional methods can be overcome, but also the risk of infection from malwares is mitigated.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.15 no.4
• /
• pp.9-18
• /
• 2015

In recent years, the number of applications embedded in the various devices such as a smart phone is getting larger. Due to the frequent changes of states in the execution environment, various malfunctions may occur. In order to handle the issue, this paper suggests an approach to detecting method-level failures in the legacy software systems. We can determine if the software executes the abnormal behavior based on the behavior model. However, when we apply the context-sensitive behavior model to the method-level, several problems happen such as false alarms and monitoring overhead. To tackle those issues, we propose CIBFD (Context-Insensitive Behavior Model-based Failure Detection) method. Through the case studies, we compare CIBFD method with the existing method. In addition, we analyze the effectiveness of the method for each application domains.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2004.05b
• /
• pp.391-394
• /
• 2004

Change of paradigm of network attack technique was begun by fast extension of the latest Internet and new attack form is appearing. But, Most intrusion detection systems detect informed attack type because is doing based on misuse detection, and active correspondence is difficult in new attack. Therefore, to heighten detection rate for new attack pattern, visibilitys to apply human immunity mechanism are appearing. In this paper, we create self-file from normal behavior profile about network packet and embody self recognition algorithm to use self-nonself discrimination in the human immune system to detect anomaly behavior. Sense change because monitors self-file creating anomaly detector based on Negative Selection Algorithm that is self recognition algorithm's one and detects anomaly behavior. And we achieve simulation to use DARPA Network Dataset and verify effectiveness of algorithm through the anomaly detection rate.

• The KIPS Transactions:PartC
• /
• v.12C no.7 s.103
• /
• pp.1007-1014
• /
• 2005

A generation of rules or patterns for detecting attacks from network is very difficult. Detection rules and patterns are usually generated by Expert's experiences that consume many man-power, management expense, time and so on. This paper proposes statistical methods that effectively detect intrusion and attacks without expert's experiences. The methods are to select useful measures in measures of network connection(session) and to detect attacks. We extracted the network session data of normal and each attack, and selected useful measures for detecting attacks using relative entropy. And we made probability patterns, and detected attacks using likelihood ratio testing. The detecting method controled detection rate and false positive rate using threshold. We evaluated the performance of the proposed method using KDD CUP 99 Data set. This paper shows the results that are to compare the proposed method and detection rules of decision tree algorithm. So we can know that the proposed methods are useful for detecting Intrusion and attacks.