• Proceedings of the Korea Information Processing Society Conference
• /
• 2012.04a
• /
• pp.533-536
• /
• 2012

인터넷의 급격한 성장과 함께 컴퓨터 통신 이용률이 폭발적으로 증가함에 따라 여러 악성코드가 등장하게 되었다. 이러한 악성코드는 시스템의 비정상 동작 유발, 네트워크 성능 저하, 개인정보유출의 문제를 발생시킨다. 현재의 악성코드 분석은 Signature 분석이 대부분이며, Signature 분석은 특정 패턴의 악성코드는 빠르게 탐지하나, 변조된 코드는 탐지하지 못하며, 이미 피해가 널리 퍼진 뒤 분석 및 차단이 가능하다는 단점을 가진다. 따라서 본 논문은 NDIS(Network Driver Interface Specification)를 이용하여 악성코드에 대해 수동적인 Signature 분석의 단점을 보완 하는 시스템 및 네트워크 상태 분석모델을 제시 하여 보다 능동적인 탐지 및 차단 프로세스를 정의하고, 모델 구현을 위한 방법을 제시한다.

• Convergence Security Journal
• /
• v.12 no.4
• /
• pp.77-84
• /
• 2012

The control network has been operated in a closed. But it changes to open to external for business convenience and cooperation with several organizations. As the way of connecting with user extends, the risk of control network gets high. Thus, in this paper, proposed the technique of an anomalous event detection using white-list for control network security and minimizing the cyber threats. The proposed method can be collected and cataloged of only normal data from traffic of internal network, control network and field devices. Through way to check the this situation, we can separate normal and abnormal behavior.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.1
• /
• pp.39-48
• /
• 2022

In this paper, we propose an anomaly detection system (ADS) to detect anomalies of the in-vehicle network for unmanned aerial vehicle (UAV). The proposed ADS detects the anomalies by measuring the similarity of status messages sequences periodically sent by the UAV to the ground control system. We defined three types of malicious message injection attacks that can be performed on the in-vehicle network of UAV and simulated those attack techniques in the Pixhawk4 quadcopter. The proposed ADS can detect abnormal sequences with accuracy of higher than 96%.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2003.05c
• /
• pp.2093-2096
• /
• 2003

정보통신 구조의 확산 및 기술이 발전함에 따라 전산 시스템에 대한 침입과 피해가 증가되고 있는 실정이다. 이에 비정상행위 기반 침입탐지 시스템에 대한 연구가 활발히 진행되고 있는 가운데 특히, 시스템 호출 감사자료 척도에 은닉 마르코프 모델(HMM)로 모델링 하는 연구가 많이 이루어지고 있다. 하지만, 이는 일정한 임계값 이하의 비정상행위만을 감지할 뿐, 어떠한 유형의 침입인지를 판별하지 못한다. 본 논문에서는, 이러한 침입탐지 시스템의 맹점을 보완하기 위하여 Viterbi 알고리즘을 이용하여 상태 변화를 분석한 후, 어떤 유형의 침입이 발생하였는지를 판별하는 방법을 제안하고, 실험을 통해 제안한 시스템의 가능성을 보인다.

• The KIPS Transactions:PartC
• /
• v.14C no.3 s.113
• /
• pp.199-208
• /
• 2007

In a ubiquitous network environment, detecting the leakage of personal information is very important. The leakage of personal information might cause severe problem such as impersonation, cyber criminal and personal privacy violation. In this paper, we have proposed a detection method of personal information leakage based on network traffic characteristics. The experimental results indicate that the traffic character of a real campus network shows the self-similarity and Proposed method can detect the anomaly of leakage of personal information by malicious code.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.11 no.1
• /
• pp.130-140
• /
• 2010

SIP (Session Initiation Protocol) is a signaling protocol to provide IP-based VoIP (Voice over IP) service. However, many security vulnerabilities exist as the SIP protocol utilizes the existing IP based network. The SIP Malformed message attacks may cause malfunction on VoIP services by changing the transmitted SIP header information. Additionally, there are several threats such that an attacker can extract personal information on SIP client system by inserting malicious code into SIP header. Therefore, the alternative measures should be required. In this study, we analyzed the existing research on the SIP anomaly message detection mechanism against SIP attack. And then, we proposed a Co-occurrence based SIP packet analysis mechanism, which has been used on language processing techniques. We proposed a association rule generation and an attack detection technique by using the actual SIP session state. Experimental results showed that the average detection rate was 87% on SIP attacks in case of using the proposed technique.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.3
• /
• pp.545-552
• /
• 2012

The rapid development of information technology is making large changes in our lives today. Also the infrastructure and services are combinding with information technology which predicts another huge change in our environment. However, the development of information technology brings various types of side effects and these side effects not only cause financial loss but also can develop into a nationwide crisis. Therefore, the detection and quick reaction towards these side effects is critical and much research is being done. Intrusion detection systems can be an example of such research. However, intrusion detection systems mostly tend to focus on judging whether particular traffic or files are malicious or not. Also it is difficult for intrusion detection systems to detect newly developed malicious codes. Therefore, this paper proposes a method which determines whether the present network model is normal or abnormal by comparing it with past network situations.

• Journal of the Korean Institute of Intelligent Systems
• /
• v.26 no.3
• /
• pp.246-252
• /
• 2016

Since thermal power plant (TPP) equipment is operated under very high pressure and temperature, failures of the equipment give rise to severe losses of life and property. To prevent the losses, fault detection method is, therefore, absolutely necessary to identify abnormal operating conditions of the equipment in advance. In this paper, we present Mahalanobis distance (MD) based fault detection method for steam boiler tube in TPP. In the MD-based method, it is supposed that abnormal data samples are far away from normal samples. Using multivariate samples collected from normal target system, mean vector and covariance matrix are calculated and threshold value of MD is decided. In a test phase, after calculating the MDs between the mean vector and test samples, alarm signals occur if the MDs exceed the predefined threshold. To demonstrate the performance, a failure case due to boiler tube leakage in 200MW TPP is employed. The experimental results show that the presented method can perform early detection of boiler tube leakage successfully.

• KIPS Transactions on Software and Data Engineering
• /
• v.7 no.11
• /
• pp.435-442
• /
• 2018

Outlier detection means to detect data samples that deviate significantly from the distribution of normal data. Most outlier detection methods calculate an outlier score that indicates the extent to which a data sample is out of normal state and determine it to be an outlier when its outlier score is above a given threshold. However, since the range of an outlier score is different for each data and the outliers exist at a smaller ratio than the normal data, it is very difficult to determine the threshold value for an outlier score. Further, in an actual situation, it is not easy to acquire data including a sufficient amount of outliers available for learning. In this paper, we propose a clustering-based outlier detection method by constructing a model representing a normal data region using only normal data and performing binary classification of outliers and normal data for new data samples. Then, by dividing the given normal data into chunks, and constructing a clustering model for each chunk, we expand it to the ensemble method combining the decision by the models and apply it to the streaming data with dynamic changes. Experimental results using real data and artificial data show high performance of the proposed method.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 1999.05a
• /
• pp.203-207
• /
• 1999

In this paper we propose the automated generation algorithm of penetration scenario using association mining technique. Until now known intrusion detections are classified into anomaly detection and misuse detection. The former uses statistical method, features selection, neural network method in order to decide intrusion, the latter uses conditional probability, expert system, state transition analysis, pattern matching for deciding intrusion. In proposed many intrusion detection algorithms unknown penetrations are created and updated by security experts. Our algorithm automatically generates penetration scenarios applying association mining technique to state transition technique. Association mining technique discovers efficient and useful unknown information in existing data. In this paper the algorithm we propose can automatically generate penetration scenarios to have been produced by security experts and is easy to cope with intrusions when it is compared to existing intrusion algorithms. Also It has advantage that maintenance cost is not high.