• Proceedings of the Korean Information Science Society Conference
• /
• 2003.10a
• /
• pp.874-876
• /
• 2003

전산 시스템에 대한 침입에 대응하기 위하여 시스템 호출 감사자료 척도를 사용하여 은닉 마르코프 모델(HMM)에 적용하는 비정상행위 기반 침입탐지 시스템에 대한 연구가 활발하다. 하지만, 이는 일정한 임계간 이하의 비정상행위만을 감지할 뿐, 어떠한 유형의 침입인지를 판별하지 못한다. 이에 Viterbi 알고리즘을 이용하여 상태 시퀀스를 분석하고, 공격 유형별 표준 상태시퀀스와의 유사성을 측정하여 유형을 판별할 수 있는데, 외부 혹은 내부 환경에 따라 상태 시퀀스가 항상 규칙적으로 추출될 수 없기 때문에, 단순 매칭으로 침입 유형을 판별하기가 어렵다. 본 논문에서는 이러한 문제를 해결하기 위하여 시퀀스의 변형을 효과적으로 고려하는 편집거리(Edit distance)를 이용하여 어떠한 유형의 침입이 발생하였는지를 판별하는 방법을 제안한다. 본 논문에서는 루트권한을 취득하기 위한 대표적인 침입유형으로 가장 널리 쓰이는 버퍼오버플로우 공격에 대해 실험하였는데, 그 결과 세부적인 침입 유형을 잘 판별할 수 있음을 확인하였다.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.15 no.5
• /
• pp.1066-1072
• /
• 2011

In the method to analyze the relationship in the system call orders, the normal system call orders are divided into a certain size of system call orders to generates gene and use them as the detectors. In the method to consider the system call parameters, the mean and standard deviation of the parameter lengths are used as the detectors. The attack of which system call order is normal but the parameter values are changed, such as the format string attack, cannot be detected by the method that considers only the system call orders, whereas the model that considers only the system call parameters has the drawback of high positive defect rate because of the information obtained from the interval where the attack has not been initiated, since the parameters are considered individually. To solve these problems, it is necessary to develop a more efficient learning and detecting method that groups the continuous system call orders and parameters as the approach that considers various characteristics of system call related to attacking simultaneously. In this article, we detected the anomaly of the system call orders and parameters by applying the temporal concept to the system call orders and parameters in order to improve the rate of positive defect, that is, the misjudgment of anomaly as normality. The result of the experiment where the DARPA data set was employed showed that the proposed method improved the positive defect rate by 13% in the system call order model where time was considered in comparison with that of the model where time was not considered.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2000.04a
• /
• pp.40-44
• /
• 2000

최근의 네트워크를 통한 침입과 유형은 갈수록 다양화되고 있으며, 지능적으로 변하고 있다. 그러나 외부의 침입자뿐만 아니라 내부의 권한 오용으로 인한 침입의 탐지도 중요시되고 있으며, 그에 따른 운영체제와 네트워크 분야의 보안에 관한 연구 또한 활발히 진행되어 어느 정도의 성과를 얻고 있다. 그러나 데이터베이스의 보안은 데이터베이스 관리시스템에 거의 의존하고 있는 실정이다. 본 논문에서는 사용자의 정상행위를 효과적으로 모델링하기 위해서 데이터마이닝 기법인 연관규칙과 순차패턴을 이용하여 사용자의 정상행위 패턴을 추출하였다. 결과적으로 외부침입자 및 내부의 권한 오용자에 대한 비정상행위를 효과적으로 판정할 수 있다.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.23 no.10
• /
• pp.1311-1319
• /
• 2019

Currently, the web environment is a commonly used area for sharing information and conducting business. It is becoming an attack point for external hacking targeting on personal information leakage or system failure. Conventional signature-based detection is used in cyber threat but signature-based detection has a limitation that it is difficult to detect the pattern when it is changed like polymorphism. In particular, injection attack is known to the most critical security risks based on web vulnerabilities and various variants are possible at any time. In this paper, we propose a novelty detection technique to detect abnormal state that deviates from the normal state on web-server log dataset(WSLD). The proposed method is a machine learning-based technique to detect a minor anomalous data that tends to be different from a large number of normal data after replacing strings in web-server log dataset with vectors using machine learning-based embedding algorithm.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2024.05a
• /
• pp.856-858
• /
• 2024

VR 기술의 발전은 다양한 분야에서 사용자에게 몰입감 있는 가상 현실 경험을 제공하지만, VR기기 내부에 사용자의 생체 데이터 및 금융정보와 같은 민감한 정보들이 저장되어 새로운 보안 문제를 야기하고 있다. 이에 따라 PIN, 패스워드 등과 같은 기존의 인증 방식이 VR 기기에 적용되고 있지만 이들은 shoulder-surfing attack 공격 취약하며 VR 환경에서 사용하기에 불편한 인터페이스를 가지고 있다. 따라서 본 논문에서는 이상 탐지 모델을 활용하여 외부 추론 공격에 강인하며 VR 환경에 적합한 사용자 행위 기반의 VR기기 사용자 인증 모델을 구현한다. 특정 task를 수행하는 동안 사용자의 행위 데이터를 수집 및 feature 데이터를 추출하고, 정상으로 라벨링 된 사용자의 데이터로 이상 탐지 머신러닝 모델들을 학습 후 정상 데이터와 비정상 데이터를 이용하여 인증 모델의 성능을 평가하였다. OC-SVM이 87.72%의 F1-score로 세 모델 중 가장 높은 성능을 보임을 확인하였으며, 향후 인증 모델 성능 향상을 위한 계획을 제시하였다.

• Journal of Internet Computing and Services
• /
• v.21 no.6
• /
• pp.57-69
• /
• 2020

As more people share their opinions in online communities, such as Internet portals and social networking services, more opinions are manipulated for the benefit of particular individuals and groups. In particular, when manipulations occur for political purposes, they influence election results as well as government policies and the quality of life. This type of manipulation has targeted the general public, and their analysis and detection has also focused on such manipulation. However, to more efficiently spread propaganda, recent manipulations have targeted common interest groups(e.g., a group of those interested in real estate) and propagated information whose content and style are customized to those groups. This work characterizes such manipulations on common interest groups and proposes method to detect manipulations. To this end, we collected and analyzed opinions posted on 10 common interest groups before and after an election. As a result, we found that manipulations on common interest groups indeed occurred and were gradually increasing toward the election date. We also proposed a detection system that examines individual opinions, their authors, and their collaborators. Using the collected opinions, we demonstrated that the proposed system can accurately classify more than 90% of manipulated opinions and that many of these opinions were posted by multiple collaborators. We believe that regular audits of opinions using the proposed system can quickly isolate manipulations and decrease their impact. Moreover, the proposed features can be used to identify manipulations in domains other than politics.

• Journal of KIISE:Information Networking
• /
• v.32 no.3
• /
• pp.301-309
• /
• 2005

Learning program's behavior using machine learning techniques based on system call audit data is an effective intrusion detection method. Rule teaming, neural network, statistical technique, and hidden Markov model are representative methods for intrusion detection. Among them neural networks are known for its good performance in teaming system call sequences. In order to apply it to real world problems successfully, it is important to determine their structure. However, finding appropriate structure requires very long time because there are no formal solutions for determining the structure of networks. In this paper, a novel intrusion detection technique using evolutionary neural networks is proposed. Evolutionary neural networks have the advantage that superior neural networks can be obtained in shorter time than the conventional neural networks because it leams the structure and weights of neural network simultaneously Experimental results against 1999 DARPA IDEVAL data confirm that evolutionary neural networks are effective for intrusion detection.

• Proceedings of the Korea Contents Association Conference
• /
• 2005.11a
• /
• pp.529-532
• /
• 2005

In anomaly intrusion detection, how to model the normal behavior of activities performed by a user is an important issue. To extract the normal behavior as a profile, conventional data mining techniques are widely applied to a finite audit data set. However, these approaches can only model the static behavior of a user in the audit data set This drawback can be overcome by viewing the continuous activities of a user as an audit data stream. This paper proposes a new clustering algorithm which continuously models a data stream. A set of features is used to represent the characteristics of an activity. For each feature, the clusters of feature values corresponding to activities observed so far in an audit data stream are identified by the proposed clustering algorithm for data streams. As a result, without maintaining any historical activity of a user physically, new activities of the user can be continuously reflected to the on-going result of clustering.

• Proceedings of the Korean Institute of Communication Sciences Conference
• /
• 2004.07a
• /
• pp.294-294
• /
• 2004

• Journal of the Korea Convergence Society
• /
• v.9 no.11
• /
• pp.15-21
• /
• 2018

In this study, we try to detect anomalies on the network intrusion detection system by learning only one class. We use KDD CUP 1999 dataset, an intrusion detection dataset, which is used to evaluate classification performance. One class classification is one of unsupervised learning methods that classifies attack class by learning only normal class. When using unsupervised learning, it difficult to achieve relatively high classification efficiency because it does not use negative instances for learning. However, unsupervised learning has the advantage for classifying unlabeled data. In this study, we use one class classifiers based on support vector machines and density estimation to detect new unknown attacks. The test using the classifier based on density estimation has shown relatively better performance and has a detection rate of about 96% while maintaining a low FPR for the new attacks.