• Convergence Security Journal
• /
• v.17 no.1
• /
• pp.31-38
• /
• 2017

As the cyber-attacks through the networks advance, it is difficult for the intrusion detection system based on the simple rules to detect the novel type of attacks such as Advanced Persistent Threat(APT) attack. At present, many types of research have been focused on the application of machine learning techniques to the intrusion detection system in order to detect previously unknown attacks. In the case of using the machine learning techniques, the performance of the intrusion detection system largely depends on the feature set which is used as an input to the system. Generally, more features increase the accuracy of the intrusion detection system whereas they cause a problem when fast responses are required owing to their large elapsed time. In this paper, we present a network intrusion detection system based on artificial neural network, which adopts a multi-objective genetic algorithm to satisfy the both requirements: accuracy, and fast response. The comparison between the proposing approach and previously proposed other approaches is conducted against NSL_KDD data set for the evaluation of the performance of the proposing approach.

• Journal of Convergence for Information Technology
• /
• v.10 no.8
• /
• pp.15-22
• /
• 2020

The 4th industrial revolution and the rapid change in the data environment revealed technical limitations in the existing relational database(RDB). As a new analysis method for unstructured data in all fields such as IDC/finance/insurance, interest in graph database(GDB) technology is increasing. The graph database is an efficient technique for expressing interlocked data and analyzing associations in a wide range of networks. This study extended the existing RDB to the GDB model and applied machine learning algorithms (pattern recognition, clustering, path distance, core extraction) to detect new abnormal signs. As a result of the performance analysis, it was confirmed that the performance of abnormal behavior(about 180 times or more) was greatly improved, and that it was possible to extract an abnormal symptom pattern after 5 steps that could not be analyzed by RDB.

• KNOM Review
• /
• v.21 no.2
• /
• pp.18-25
• /
• 2018

Since the development of block-chain technology by Satoshi Nakamoto and Bitcoin pioneered a new cryptocurrency market, a number of scale of cryptocurrency have emerged. There are crimes taking place using the anonymity and vulnerabilities of block-chain technology, and many studies are underway to improve vulnerability and prevent crime. However, they are not enough to detect users who commit crimes. Therefore, it is very important to detect abnormal behavior such as money laundering and stealing cryptocurrency from the network. In this paper, the characteristics of the transactions and user graphs in the Bitcoin network are collected and statistical information is extracted from them and presented as plots on the log scale. Finally, we analyze visualized plots according to the Densification Power Law and Power Law Degree, as a result, present features appropriate for detection of anomalies involving abnormal transactions and abnormal users in the Bitcoin network.

• Journal of Korea Game Society
• /
• v.16 no.1
• /
• pp.83-92
• /
• 2016

An online game is a huge distributed system comprised of servers and untrusted clients. In such circumstances, cheaters may employ abnormal behaviors through client modification or network packet tampering. Client-side detection methods have the merit of distributing the burden to clients but can easily be breached. In the other hand, server-side detection methods are trustworthy but consume tremendous amount of resources. Therefore, this paper proposes a security reinforcement method which involves both the client and the server. This method is expected to provide meaningful security fortification while minimizing server-side stress.

• Convergence Security Journal
• /
• v.22 no.3
• /
• pp.13-18
• /
• 2022

With the rapid development of IT technology, integration with existing industries has led to an increase in smart manufacturing that simplifies processes and increases productivity based on 4th industrial revolution technology. Security threats are also increasing and there are. In the case of supply chain attacks, it is difficult to detect them in advance and the scale of the damage is extremely large, so they have emerged as next-generation security threats, and research into detection technology is necessary. Therefore, in this paper, we collect, store, analyze, and visualize logs in multiple environments in real time using ELK Stack and Sysmon, which are open source-based analysis solutions, to derive information such as abnormal behavior related to supply chain attacks, and efficiently We try to provide an effective detection method.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2003.11c
• /
• pp.1859-1862
• /
• 2003

기존의 IDS는 침입 가능성이 있는 데이터에 대해 많은 양의 경보데이터를 발생시키고 이를 모두 로그의 형태로 저장한다. 이 때 대량의 로그 기록이 생성되는데, 이 대량의 로그가 기록된 데이터는 관리자가 실제로 위협적인 침입을 식별하고, 침입 행위에 신속하게 대응하는 것을 어렵게 한다. 따라서 이 논문에서는 IDS가 발생시킨 대량의 경보데이터를 규칙 기반 방법론을 적용하여 침입탐지에 필요한 데이터만 추출하여 로그에 기록함으로써 관리자가 IDS 관리를 효율적으로 할 수 있는 모델을 제시한다. 이 모델은 실시간으로 갱신되는 규칙에 의해 경보데이터 중 불필요한 것은 제거하고, 유사한 것은 통합함으로써 신속한 침입 탐지를 가능케 한다.

• Convergence Security Journal
• /
• v.20 no.5
• /
• pp.27-32
• /
• 2020

The Windows Event Log is a Log that defines the overall behavior of the system, and these files contain data that can detect various user behaviors and signs of anomalies. However, since the Event Log is generated for each action, it takes a considerable amount of time to analyze the log. Therefore, in this study, we designed and implemented an XML-based Event Log analysis tool based on the main Event Log list of "Spotting the Adversary with Windows Event Log Monitoring" presented at the NSA.

• KIPS Transactions on Software and Data Engineering
• /
• v.10 no.11
• /
• pp.491-500
• /
• 2021

In this study, we propose a method for detecting fall behavior using MS Kinect v2 RGBD Camera-based Human-Skeleton Keypoints and a 2-Stacked Bi-LSTM model. In previous studies, skeletal information was extracted from RGB images using a deep learning model such as OpenPose, and then recognition was performed using a recurrent neural network model such as LSTM and GRU. The proposed method receives skeletal information directly from the camera, extracts 2 time-series features of acceleration and distance, and then recognizes the fall behavior using the 2-Stacked Bi-LSTM model. The central joint was obtained for the major skeletons such as the shoulder, spine, and pelvis, and the movement acceleration and distance from the floor were proposed as features of the central joint. The extracted features were compared with models such as Stacked LSTM and Bi-LSTM, and improved detection performance compared to existing studies such as GRU and LSTM was demonstrated through experiments.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.4
• /
• pp.647-656
• /
• 2020

Recently, there has been an increasing number of cases in which important data (personal information, technology, etc.) of national and public institutions are leaked to the outside world. Surveys show that the largest cause of such leakage accidents is "insiders." Insiders of organization with the most authority can cause more damage than technology leaks caused by external attacks due to the organization. This is due to the characteristics of insiders who have relatively easy access to the organization's major assets. This study aims to present an optimized property selection model for detecting such abnormalities through supervised learning algorithms among machine learning techniques using actual data such as CrossNet data transfer system transmission log, e-mail transmission log, and personnel information, which safely transmits data between separate areas (security area and non-security area) of the business network and the Internet network.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2017.04a
• /
• pp.376-379
• /
• 2017

전 세계적으로 악성코드는 하루 100만개 이상이 새롭게 발견되고 있으며, 악성코드 발생량은 해마다 증가하고 있는 추세이다. 공격자는 보안장비에서 악성코드가 탐지되는 것을 우회하기 위해 기존 악성코드를 변형한 변종 악성코드를 주로 이용한다. 변종 악성코드는 자동화된 제작도구나 기존 악성코드의 코드를 재사용하므로 비교적 손쉽게 생성될 수 있어 최근 악성코드 급증의 주요 원인으로 지목되고 있다. 본 논문에서는 대량으로 발생하는 악성코드의 효과적인 대응을 위한 행위기반 악성코드 프로파일링 시스템 프로토타입을 제안한다. 동일한 변종 악성코드들은 실제 행위가 유사한 특징을 고려하여 악성코드가 실행되는 과정에서 호출되는 API 시퀀스 정보를 이용하여 악성코드 간 유사도 분석을 수행하였다. 유사도 결과를 기반으로 대량의 악성코드를 자동으로 그룹분류 해주는 시스템 프로토타입을 구현하였다. 악성코드 그룹별로 멤버들 간의 유사도를 전수 비교하므로 그룹의 분류 정확도를 객관적으로 제시할 수 있다. 실제 유포된 악성코드를 대상으로 악성코드 그룹분류 기능과 정확도를 측정한 실험에서는 평균 92.76%의 분류 성능을 보였으며, 외부 전문가 의뢰에서도 84.13%로 비교적 높은 분류 정확도를 보였다.