• Journal of KIISE:Computing Practices and Letters
• /
• v.15 no.11
• /
• pp.806-818
• /
• 2009

Since the invention of the integrated circuit (IC) in 1950s, semiconductor technology has undergone dramatic development up to these days. A complete semiconductor is manufactured through a diversity of processes. For better semiconductor productivity, fault detection and classification (FDC) has been rigorously studied for finding faults even before the processes are completed. For FDC, various kinds of sensors are attached in many semiconductor manufacturing devices, and sensor values are collected in a periodic manner. The collection of sensor values consists of sequences of real numbers, and hence is regarded as a kind of time-series data. In this paper, we propose an algorithm for detecting and clustering faults in semiconductor processes. The proposed algorithm is a modification of the existing anomaly detection algorithm dealing with symbolically-represented time-series. The contributions of this paper are: (1) showing that a modification of the existing anomaly detection algorithm dealing with general time-series could be used for semiconductor process data and (2) presenting experimental results for improving correctness of fault detection and clustering. As a result of our experiment, the proposed algorithm caused neither false positive nor false negative.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.6
• /
• pp.1527-1537
• /
• 2016

As increasing of smartphone penetration over the world, various mobile payment services have been emerged and fraud transactions have drastically increased. Although many financial companies have deployed security solutions to detect fraud transactions in on/off-line environment, mobile payment services still lack fraud detection solutions and researches. The mobile payment is mainly comprised of micro-payments and payment environment is different from other payments, so mobile-specialized fraud detection is needed. In this paper, we propose a FDS (Fraud Detection System) based on data mining for mobile payment services. The method of this paper is applied to the real data provided by a PG (Payment Gateway) company in Korea. The proposed FDS consists of two phases; (1) the first phase is focused on classifying transactions at high speed (2) the second is designed to detect abnormal transactions with high accuracy. We could detect 13 transactions per second with 93% accuracy rate.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2011.11a
• /
• pp.941-944
• /
• 2011

모바일 클라우드 서비스는 사용자가 모바일 단말에 자원을 가지고 있지 않더라도 인터넷을 통해 외부의 다양한 IT 자원을 제공하는 서비스로서 모바일 단말이 가지는 성능적 한계를 극복시킬 수 있다는 장점과 함께 이용자 수가 증가하고 있다. 그러나 클라우드 컴퓨팅 환경에 존재하는 개인 및 기업의 정보 유출과 같은 문제들은 모바일 클라우드 컴퓨팅 환경에도 그대로 상속되기 때문에 이러한 문제에 대응하기 위해서는 모바일 클라우드 컴퓨팅 환경에서 정보유출을 탐지할 수 있는 이상행위 탐지 알고리즘이 마련되어야 한다. 여기서 이상행위란, 모바일 클라우드 자원에 접근하는 방법에 있어 기존에 인지하고 있던 정상적인 행위에서 벗어나는 행위를 의미하며 이상행위로 판단되는 상황이 발생되는 경우, 이를 정보유출이 발생할 수 있는 상황으로 인지함으로써 적절한 대응을 할 수 있게 된다. 따라서 본 논문에서는 모바일 클라우드 자원의 정보유출을 방지하기 위한 목적으로 자원 접근에 대한 이상행위 탐지 알고리즘 개발 모델을 제시한다. 이상행위 탐지 알고리즘을 개발하고 이를 검증하기 위해서는 이상행위를 일으키는 공격 모델 및 대응 모델이 개발되어야 한다. 따라서 본 논문에서는 인증 및 권한관리의 취약점을 이용하여 위협을 일으키는 공격 모델을 개발하는 방법을 제시하고, 사용자의 접속환경 및 클라우드 자원의 정보 흐름을 분석함으로써 이상행위를 탐지하는 알고리즘을 제시한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2023.05a
• /
• pp.370-372
• /
• 2023

신용카드 부정 사용은 고객 및 기업의 신용과 재산에 막대한 손실을 미치고 있다. 이에 따라 금융사들은 이상금융거래탐지시스템을 도입하였으나 이상 거래 발생 여부를 지속적으로 모니터링하고 있기 때문에 시스템 유지에 많은 비용이 따른다. 따라서 본 논문에서는 컴퓨팅 리소스를 절약함과 동시에 성능 개선 효과를 보인 신용카드 이상 거래 탐지 알고리즘을 제안한다. CTGAN 을 활용하여 정상 거래와 이상 거래의 비율을 일부 완화하였고 XAI 기법인 SHAP 를 활용하여 유의미한 속성값을 선택하였다. 이것을 기반으로 LSTM Autoencoder를 사용하여 이상데이터를 탐지하였다. 그 결과 전통적인 비지도 학습 기법에 비해 제안 알고리즘이 우수한 성능을 보였음을 확인하였다.

• Review of KIISC
• /
• v.29 no.6
• /
• pp.53-58
• /
• 2019

최근 5G 네트워크의 발전으로 사물인터넷의 활용도가 커지며 시장이 급격히 확대되고 있다. 사물인터넷 기기가 급증하면서 이를 대상으로 하는 위협이 크게 늘며 사물인터넷 기기의 보안이 중요시 되고 있다. 그러나 이러한 사물인터넷 기기는 기존의 ICT 장비와는 다르게 리소스가 제한되어 있다. 본 논문에서는 이러한 특성을 갖는 사물인터넷 환경에 적합한 보안기술로 네트워크 학습을 통해 사물인터넷 기기의 이상행위를 탐지하는 경량화된 인공신경망 기술을 제안한다. 기기 별 혹은 사용자 별 네트워크 행위 패턴을 분석하여 특성 연구를 진행하였으며, 사물인터넷 기기의 정상행위를 수집하고 학습데이터로 활용한다. 이러한 학습데이터를 통해 인공신경망 기반의 오토인코더 알고리즘을 활용하여 이상행위 탐지 모델을 구축하였으며, 파라미터 튜닝을 통해 모델 사이즈, 학습 시간, 복잡도 등을 경량화 하였다. 본 논문에서 제안하는 탐지 모델은 신경망 프루닝 및 양자화를 통해 경량화된 오토인코더 기반 인공신경망을 학습하였으며, 정상 행위 패턴을 벗어나는 이상행위를 식별할 수 있었다. 본 논문은 1. 서론을 통해 현재 사물인터넷 환경과 보안 기술 연구 동향을 소개하고 2. 관련 연구를 통하여 머신러닝 기술과 이상 탐지 기술에 대해 소개한다. 3. 제안기술에서는 본 논문에서 제안하는 인공신경망 알고리즘 기반의 사물인터넷 이상행위 탐지 기술에 대해 설명하고, 4. 향후연구계획을 통해 추후 활용 방안 및 고도화에 대한 내용을 작성하였다. 마지막으로 5. 결론을 통하여 제안기술의 평가와 소회에 대해 설명하였다.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.31 no.2C
• /
• pp.208-218
• /
• 2006

In this paper, we introduce the creation methods of attack detection model using data mining technologies that can classify the latest attack types, and can detect the modification of existing attacks as well as the novel attacks. Also, we evaluate comparatively these attack detection models in the view of detection accuracy and detection time. As the important factors for creating detection models, there are data, attribute, and detection algorithm. Thus, we used NetFlow data gathered at the real network, and KDD Cup 1999 data for the experiment in large quantities. And for attribute selection, we used a heuristic method and a theoretical method using decision tree algorithm. We evaluate comparatively detection models using a single supervised/unsupervised data mining approach and a combined supervised data mining approach. As a result, although a combined supervised data mining approach required more modeling time, it had better detection rate. All models using data mining techniques could detect the attacks within 1 second, thus these approaches could prove the real-time detection. Also, our experimental results for anomaly detection showed that our approaches provided the detection possibility for novel attack, and especially SOM model provided the additional information about existing attack that is similar to novel attack.

• Journal of the Korean Society of Marine Environment & Safety
• /
• v.27 no.1
• /
• pp.127-134
• /
• 2021

In this study, an anomaly detection (AD) algorithm was implemented to detect the failure of a marine air compressor. A lab-scale experiment was designed to produce fault datasets (time-series electric current measurements) for 10 failure modes of the air compressor. The results demonstrated that the temporal pattern of the datasets showed periodicity with a different period, depending on the failure mode. An AD model with a convolutional autoencoder was developed and trained based on a normal operation dataset. The reconstruction error was used as the threshold for AD. The reconstruction error was noted to be dependent on the AD model and hyperparameter tuning. The AD model was applied to the synthetic dataset, which comprised both normal and abnormal conditions of the air compressor for validation. The AD model exhibited good detection performance on anomalies showing periodicity but poor performance on anomalies resulting from subtle load changes in the motor.

• Tunnel and Underground Space
• /
• v.33 no.6
• /
• pp.561-573
• /
• 2023

Korea Atomic Energy Research Institute (KAERI) constructed the KURT (KAERI Underground Research Tunnel) to analyze the hydrogeological/geochemical characteristics of deep rock mass. Numerous boreholes have been drilled to conduct various field tests. The selection of suitable investigation intervals within a borehole is of great importance. When objectives are centered around hydraulic flow and groundwater sampling, intervals with sufficient groundwater flow are the most suitable. This study defines such points as hydraulic outliers and aimed to detect them using borehole geophysical logging data (temperature and EC) from a 1 km depth borehole. For systematic and efficient outlier detection, machine learning algorithms, such as DBSCAN, OCSVM, kNN, and isolation forest, were applied and their applicability was assessed. Following data preprocessing and algorithm optimization, the four algorithms detected 55, 12, 52, and 68 outliers, respectively. Though this study confirms applicability of the machine learning algorithms, it is suggested that further verification and supplements are desirable since the input data were relatively limited.

• Journal of Internet Computing and Services
• /
• v.21 no.5
• /
• pp.109-118
• /
• 2020

Recently, people are spending a lot of time inside their homes because of various diseases. It is difficult to ask others for help in the case of a single-person household that is injured in the house or infected with a disease and needs help from others. In this study, an algorithm is proposed to detect emergency event, which are situations in which single-person households need help from others, such as injuries or disease infections, in their homes. It proposes vision pattern detection algorithms using home CCTVs, audio pattern detection algorithms using artificial intelligence speakers, activity pattern detection algorithms using acceleration sensors in smartphones, and dust pattern detection algorithms using air purifiers. However, if it is difficult to use due to security issues of home CCTVs, it proposes a fusion method combining audio, activity and dust pattern sensors. Each algorithm collected data through YouTube and experiments to measure accuracy.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.15 no.2
• /
• pp.13-22
• /
• 2005

To improve the anomaly IDS using system calls, this study focuses on Neural Networks Learning using the Soundex algorithm which is designed to change feature selection and variable length data into a fixed length learning pattern. That is, by changing variable length sequential system call data into a fixed length behavior pattern using the Soundex algorithm, this study conducted neural networks learning by using a backpropagation algorithm with fuzzy membership function. The back-propagation neural networks and Neuro-Fuzzy technique are applied for anomaly intrusion detection of system calls using Sendmail Data of UNM to demonstrate its aspect of he complexity of time, space and MDL performance.