• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.5
• /
• pp.1043-1057
• /
• 2015

In order to recognize intelligent threats quickly and detect and respond to them actively, major public bodies and private institutions operate and administer an Intrusion Detection Systems (IDS), which plays a very important role in finding and detecting attacks. However, most IDS alerts have a problem that they generate false positives. In addition, in order to detect unknown malicious codes and recognize and respond to their threats in advance, APT response solutions or actions based systems are introduced and operated. These execute malicious codes directly using virtual technology and detect abnormal activities in virtual environments or unknown attacks with other methods. However, these, too, have weaknesses such as the avoidance of the virtual environments, the problem of performance about total inspection of traffic and errors in policy. Accordingly, for the effective detection of intrusion, it is very important to enhance security monitoring, consequentially. This study discusses a plan for the reduction of false positives as a plan for the enhancement of security monitoring. As a result of an experiment based on the empirical data of G, rules were drawn in three types and 11 kinds. As a result of a test following these rules, it was verified that the overall detection rate decreased by 30% to 50%, and the performance was improved by over 30%.

• KIPS Transactions on Software and Data Engineering
• /
• v.10 no.3
• /
• pp.91-98
• /
• 2021

Today's information and communication technology is rapidly developing, the security of IT infrastructure is becoming more important, and at the same time, cyber attacks of various forms are becoming more advanced and sophisticated like intelligent persistent attacks (Advanced Persistent Threat). Early defense or prediction of increasingly sophisticated cyber attacks is extremely important, and in many cases, the analysis of network-based intrusion detection systems (NIDS) related data alone cannot prevent rapidly changing cyber attacks. Therefore, we are currently using data generated by intrusion detection systems to protect against cyber attacks described above through Host-based Intrusion Detection System (HIDS) data analysis. In this paper, we conducted a comparative study on machine learning algorithms using LID-DS (Leipzig Intrusion Detection-Data Set) host-based intrusion detection data including thread information, metadata, and buffer data missing from previously used data sets. The algorithms used were Decision Tree, Naive Bayes, MLP (Multi-Layer Perceptron), Logistic Regression, LSTM (Long Short-Term Memory model), and RNN (Recurrent Neural Network). Accuracy, accuracy, recall, F1-Score indicators and error rates were measured for evaluation. As a result, the LSTM algorithm had the highest accuracy.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 1996.11a
• /
• pp.390-399
• /
• 1996

보안 관리(Security Management)는 매우 광범위한 주제이다. EDI 망에서의 보안 관리는 목적하는 보안 정책 즉, 원하는 보안 서비스, 적용할 보안 메카니즘, 보안 수행 절차, 기반을 이루는 보안 구조, 사용 오류, 침입 시도 등의 보안에 관한 모든 사항을 관리하는 것으로 정의할 수 있다. 보안 관리의 범위는 EDI 망에서의 보안 구역(Security Domain) 단위로 구분되며, 이 보안영역은 원하는 보안 정책을 적용하는 대상 구역이 된다. 본 논문에서는 ITU-T X.800(또는 ISO/IEC 7498-2)의 표준화에 기반을 둔 보안 영역 내에서 개발되고 있는 안전한 EDI 망에서의 보안 관리 기능 영역을 위한 정의, 범위, 요구 사항을 시스템 보안 관리, 보안 서비스 관리, 보안 메카니즘 관리, 관리 자체의 보안, 일반적 보안 관리 사항 등 5가지 범주로 나누어 다루며, 표준화 내용, 관리 도구 등을 다룬다.

• The Journal of Information Systems
• /
• v.15 no.4
• /
• pp.211-224
• /
• 2006

This study investigates the application of data mining techniques such as artificial neural networks, rough sets, and induction teaming to the intrusion detection systems. To maximize the effectiveness of data mining for intrusion detection systems, we introduced the asymmetric costs with false positive errors and false negative errors. And we present a method for intrusion detection systems to utilize the asymmetric costs of errors in data mining. The results of our empirical experiment show our intrusion detection model provides high accuracy in intrusion detection. In addition the approach using the asymmetric costs of errors in rough sets and neural networks is effective according to the change of threshold value. We found the threshold has most important role of intrusion detection model for decreasing the costs, which result from false negative errors.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.16 no.2
• /
• pp.49-54
• /
• 2016

In this paper, we propose an Arduino-based effective home security monitoring system. Proposed home security monitoring system consists of arduino which is inexpensive main processor, ultrasonic sensor and human body detection sensor to detect whether someone breaks into home. Data from ultrasonic sensor and human body detection sensor are transmitted to web server via ethernet shield connected to arduino. Web server checks whether someone breaks into home by using stored data from ultrasonic sensor and human body detection sensor. Snapshot is photographed via webcam connected by using JQuery. Photographed snapshot is stored in web server as image file. A user can monitor in web or smart device environment by using HTML5, CSS and Canvas. When examining efficiency of proposed home security monitoring system, it was found that proposed system is easier to be made than existing home security system and is cost effective by using arduino and is efficient and convenient and stable as it enables a user to handle an error in person and it uses reliable data.

• Journal of the Korea Society of Computer and Information
• /
• v.14 no.5
• /
• pp.65-75
• /
• 2009

The development of IT technology, Internet popularity is increasing geometrically. However, as its side effect, the intrusion behaviors such as information leakage for key system and infringement of computation network etc are also increasing fast. The attack traffic detection method which is suggested in this study utilizes the Snort, traditional NIDS, filters the packet with false positive among the detected attack traffics using Nmap information. Then, it performs the secondary filtering using nessus vulnerability information and finally performs correlation analysis considering appropriateness of management system, severity of signature and security hole so that it could reduce false positive alarm message as well as minimize the errors from false positive and as a result, it raised the overall attack detection results.

• Korean Journal of Biological Psychiatry
• /
• v.22 no.2
• /
• pp.78-86
• /
• 2015

Objectives Although ginseng has been reported to protect neuronal cells and improve various cognitive functions, relationship between ginseng supplementation and response inhibition, one of the important cognitive domains has not been explored. In addition, effects of ginseng on in vivo human brain have not been investigated using the diffusion tensor imaging (DTI). The purpose of the current study is to investigate changes in intrusion errors and white matter microstructure after Korean Red Ginseng supplementation using standardized neuropsychological tests and DTI. Methods Fifty-one healthy participants were randomly allocated to the Korean Red Ginseng (n = 26) or placebo (n = 25) groups for 8 weeks. The California Verbal Learning Test was used to assess the number of intrusion errors. Intelligence quotient (IQ) was measured with the Korean Wechsler Adult Intelligence Scale. Depressive and anxiety symptoms were evaluated using Hamilton Depression Rating Scale, Hamilton Anxiety Rating Scale, and Hopkins Symptom Checklist-25. The fractional anisotropy (FA) was measured from the brain DTI data. Results After the 8-week intervention, Korean Red Ginseng supplementation significantly reduced intrusion errors after adjusting age, sex, IQ, and baseline score of the intrusion errors (p for interaction = 0.005). Change in FA values in the left anterior corona radiata was greater in the Korean Red Ginseng group compared to the placebo group (t = 4.29, p = 0.04). Conclusions Korean Red Ginseng supplementation may be efficacious for improving response inhibition and white matter microstructure integrity in the prefrontal cortex.

• Journal of Ocean Engineering and Technology
• /
• v.21 no.3 s.76
• /
• pp.8-15
• /
• 2007

This study is intended to examine the relationship between the magnitude of sand spit in the estuary of the stream and improvement of the quality of water that flaws into the sea, by means of hydraulic experimentation. In order to determine the effect of improvements of water quality when river flow is stagnant, the estuary flows into the sea through the small sand spit, and a two-dimensional physical model experiment was carried out. Distribution of concentration was decreased in response to an increase in length of sand spit and time. The experimental results are compared with theoretical results, based on the solution of the equation. Also, there are functions of influx prevention of salt wedge and purification of pollution water due to sand spit in small estuary.

• Proceedings of the Korean Information Science Society Conference
• /
• 2006.06b
• /
• pp.238-240
• /
• 2006

네트워크상에서 발생하는 다양한 형태의 대량의 데이터를 정확하고 효율적으로 분석하기 위해 설계되고 있는 마이닝 시스템들은 목표지향적으로 훈련데이터들을 어떻게 구축하여 다룰 것인지에 대한 문제보다는 대부분 얼마나 많은 데이터 마이닝 기법을 지원하고 이를 적용할 수 있는지 등의 기법에 초점을 두고 있다. 따라서, 점점 더 에이전트화, 분산화, 자동화 및 은닉화 되는 최근의 보안공격기법을 정확하게 탐지하기 위한 방법은 미흡한 실정이다. 본 연구에서는 유비쿼터스 환경 내에서 발생 가능한 문제 중 복잡하고 지능화된 침입패턴의 탐지를 위해 데이터 마이닝 기법과 결함허용방법을 이용하는 개선된 학습알고리즘과 후처리 방법에 의한 RTPID(Refinement Training and Post-processing for Intrusion Detection)시스템을 제안한다. 본 논문에서의 RTPID 시스템은 active learning과 post-processing을 이용하여, 네트워크 내에서 발생 가능한 침입형태들을 정확하고 효율적으로 다루어 분석하고 있다. 이는 기법에만 초점을 맞춘 기존의 데이터마이닝 분석을 개선하고 있으며, 특히 제안된 분석 프로세스를 진행하는 동안 능동학습방법의 장점을 수용하여 학습효과는 높이며 비용을 감소시킬 수 있는 자가학습방법(self learning)방법의 효과를 기대할 수 있다. 이는 관리자의 개입을 최소화하는 학습방법이면서 동시에 False Positive와 False Negative 의 오류를 매우 효율적으로 개선하는 방법으로 기대된다. 본 논문의 제안방법은 분석도구나 시스템에 의존하지 않기 때문에, 유사한 문제를 안고 있는 여러 분야의 네트웍 환경에 적용될 수 있다.더욱 높은성능을 가짐을 알 수 있다.의 각 노드의 전력이 위험할 때 에러 패킷을 발생하는 기법을 추가하였다. NS-2 시뮬레이터를 이용하여 실험을 한 결과, 제안한 기법이 AOMDV에 비해 경로 탐색 횟수가 최대 36.57% 까지 감소되었음을 알 수 있었다.의 작용보다 더 강력함을 시사하고 있다.TEX>로 최고값을 나타내었으며 그 후 감소하여 담금 10일에는 $1.61{\sim}2.34%$였다. 시험구간에는 KKR, SKR이 비교적 높은 값을 나타내었다. 무기질 함량은 발효기간이 경과할수록 증하였고 Ca는 $2.95{\sim}36.76$, Cu는 $0.01{\sim}0.14$, Fe는 $0.71{\sim}3.23$, K는 $110.89{\sim}517.33$, Mg는 $34.78{\sim}122.40$, Mn은 $0.56{\sim}5.98$, Na는 $0.19{\sim}14.36$, Zn은 $0.90{\sim}5.71ppm$을 나타내었으며, 시험구별로 보면 WNR, BNR구가 Na만 제외한 다른 무기성분 함량이 가장 높았다.O to reduce I/O cost by reusing data already present in the memory of other nodes. Finally, chunking and on-line compression mechanisms are included in both models. We demonstrate that we can obtain significantly high-performanc

• Journal of the Korea Society of Computer and Information
• /
• v.12 no.1 s.45
• /
• pp.161-168
• /
• 2007

Web attack uses structural, logical and coding error or web application rather than vulnerability to Web server itself. According to the Open Web Application Security Project (OWASP) published about ten types of the web application vulnerability to show the causes of hacking, the risk of hacking and the severity of damage are well known. The detection ability and response is important to deal with web hacking. Filtering methods like pattern matching and code modification are used for defense but these methods can not detect new types of attacks. Also though the security unit product like IDS or web application firewall can be used, these require a lot of money and efforts to operate and maintain, and security unit product is likely to generate false positive detection. In this research profiling method that attracts the structure of web application and the attributes of input parameters such as types and length is used, and by installing structural database of web application in advance it is possible that the lack of the validation of user input value check and the verification and attack detection is solved through using profiling identifier of database against illegal request. Integral security management system has been used in most institutes. Therefore even if additional unit security product is not applied, attacks against the web application will be able to be detected by showing the model, which the security monitoring log gathering agent of the integral security management system and the function of the detection of web application attack are combined.