• Journal of the Korea Convergence Society
• /
• v.8 no.4
• /
• pp.19-24
• /
• 2017

The growing number of electronic financial transactions (e-banking) has entailed the rapid increase in security threats such as extortion and falsification of financial transaction data. Against such background, rigid security and countermeasures to hedge against such problems have risen as urgent tasks. Thus, this study aims to implement an improved case model by applying the Fraud Detection System (hereinafter, FDS) in a financial corporation 'A' using big data technique (e.g. the function to collect/store various types of typical/atypical financial transaction event data in real time regarding the external intrusion, outflow of internal data, and fraud financial transactions). As a result, There was reduction effect in terms of previous scenario detection target by minimizing false alarm via advanced scenario analysis. And further suggest the future direction of the enhanced FDS.

• Proceedings of the Korean Institute of Communication Sciences Conference
• /
• 2004.07a
• /
• pp.294-294
• /
• 2004

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.6
• /
• pp.1033-1042
• /
• 2023

This paper proposes a network intrusion detection system that identifies abnormal flows within the network. The majority of datasets commonly used in research lack time-series information, making it challenging to improve detection rates for attacks with fewer instances due to a scarcity of sample data. However, there is insufficient research regarding detection approaches. In this study, we build upon previous research by using the Artificial neural network(ANN) model and a stack ensemble technique in our approach. To address the aforementioned issues, we incorporate temporal information by leveraging adjacent flows and enhance the learning of samples from sparse attacks, thereby improving both the overall detection rate and the detection rate for sparse attacks.

• Information Systems Review
• /
• v.22 no.1
• /
• pp.59-72
• /
• 2020

Artificial Intelligence is establishing itself as a familiar tool from an intractable concept. In this trend, financial sector is also looking to improve the problem of existing system which includes Fraud Detection System (FDS). It is being difficult to detect sophisticated cyber financial fraud using original rule-based FDS. This is because diversification of payment environment and increasing number of electronic financial transactions has been emerged. In order to overcome present FDS, this paper suggests 3 types of artificial intelligence models, Generative Adversarial Network (GAN), Deep Neural Network (DNN), and Convolutional Neural Network (CNN). GAN proves how data imbalance problem can be developed while DNN and CNN show how abnormal financial trading patterns can be precisely detected. In conclusion, among the experiments on this paper, WGAN has the highest improvement effects on data imbalance problem. DNN model reflects more effects on fraud classification comparatively.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2013.11a
• /
• pp.638-639
• /
• 2013

Anymon Plus(ver 3.0)은 통합 로그 분석 시스템으로 대용량 로그 및 빅데이터의 실시간 수집 저장 분석할 수 있는 제품(초당 40,000 이벤트 처리)으로서, 방화벽 로그 분석을 통한 비정상 네트워크 행위 탐지, 웹 로그 분석을 통한 사용 패턴 분석, 인터넷 쇼핑몰 사기 주문 분석 및 탐지, 내부 정부 유출 분석 및 탐지 등과 같은 다양한 분야로 응용이 확대되고 있다. 본 논문에서는 보안관련 인프라 로그를 분석하고 예측하여 예상 보안사고 시기에 집중적 경계를 통한 선제적 대응을 모색하기 위해 통계적 이론에 기반한 통합 로그 분석 시스템을 개발하기 위해, 회귀분석 및 시계열 분석이 가능한 예측 엔진 시스템을 설계하고 구현한다.

• Smart Media Journal
• /
• v.13 no.4
• /
• pp.65-75
• /
• 2024

This paper proposes a new approach to video surveillance systems, which have become essential components in modern urban management. By utilizing blockchain and IPFS, it enhances data integrity and privacy protection. Additionally, anomaly detection and automatic video storage are enabled through object detection technology, thus improving urban safety and security. This integrated approach serves as an efficient management methodology for surveillance systems, providing city administrators and citizens with a safer and more effective monitoring environment.

• KIPS Transactions on Software and Data Engineering
• /
• v.10 no.11
• /
• pp.449-456
• /
• 2021

An intrusion detection system is a technology that detects abnormal behaviors that violate security, and detects abnormal operations and prevents system attacks. Existing intrusion detection systems have been designed using statistical analysis or anomaly detection techniques for traffic patterns, but modern systems generate a variety of traffic different from existing systems due to rapidly growing technologies, so the existing methods have limitations. In order to overcome this limitation, study on intrusion detection methods applying various machine learning techniques is being actively conducted. In this study, a comparative study was conducted on data preprocessing techniques that can improve the accuracy of anomaly detection using NGIDS-DS (Next Generation IDS Database) generated by simulation equipment for traffic in various network environments. Padding and sliding window were used as data preprocessing, and an oversampling technique with Adversarial Auto-Encoder (AAE) was applied to solve the problem of imbalance between the normal data rate and the abnormal data rate. In addition, the performance improvement of detection accuracy was confirmed by using Skip-gram among the Word2Vec techniques that can extract feature vectors of preprocessed sequence data. PCA-SVM and GRU were used as models for comparative experiments, and the experimental results showed better performance when sliding window, skip-gram, AAE, and GRU were applied.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.2
• /
• pp.37-47
• /
• 2011

In the recent years, malicious codes called malware are having shown significant increase due to the code obfuscation to evade detection mechanisms. When the code obfuscation technique is applied to malwares, they can change their instruction sequence and also even their signature. These malwares which have same functionality and different appearance are able to evade signature-based AV products. Thus, AV venders paid large amount of cost to analyze and classify malware for generating the new signature. In this paper, we propose a novel approach for detecting metamorphic malwares. The proposed mechanism first converts malware's API call sequences to call graph through dynamic analysis. After that, the callgraph is converted to semantic signature using 128 abstract nodes. Finally, we extract all subgraphs and analyze how similar two malware's behaviors are through subgraph similarity. To validate proposed mechanism, we use 273 real-world malwares include obfuscated malware and analyze 10,100 comparison results. In the evaluation, all metamorphic malwares are classified correctly, and similar module behaviors among different malwares are also discovered.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.14 no.4
• /
• pp.97-110
• /
• 2004

As modem web services become enormously complex, web attacks has become frequent and serious. Existing security solutions such as firewalls or signature-based intrusion detection systems are generally inadequate in securing web services, and analysis of raw web log data is simply impractical for most organizations. Visual display of "interpreted" web logs, with emphasis on anomalous web requests, is essential for an organization to efficiently track web usage patterns and detect possible web attacks. In this paper, we discuss various issues related to effective real-time visualization of web usage patterns and anomalies. We implemented a software tool named SAD (session anomaly detection) Viewer to satisfy such need and conducted an empirical study in which anomalous web traffics such as Misuse attacks, DoS attacks, Code-Red worms and Whisker scans were injected. Our study confirms that SAD Viewer is useful in assisting web security engineers to monitor web usage patterns in general and anomalous web sessions in particular.articular.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.5
• /
• pp.1069-1076
• /
• 2017

Recently $Pok\acute{e}mon$ GO implements an online game with location-based real time augmented reality on mobile. The correct play of this game should be based on collecting the $Pok\acute{e}mon$ that appears as the user moves around by foot, but as the popularity increases, it appears an abuse to play easily. Many people have used an application that provides a mock location service such as Fake GPS, and these applications can be judged to be cheating in online games because they can play games in the house without moving. Detection of such cheating from a client point of view (mobile device) can consume a large amount of resources, which can reduce the speed of the game. It is difficult for developers to apply detection methods that negatively affect game usage and user's satisfaction. Therefore, in this paper, we propose a method to detect users abusing mock location service in online game by route analysis using GPS location record from the server point of view.