• Proceedings of the Korean Information Science Society Conference
• /
• 2002.10e
• /
• pp.571-573
• /
• 2002

네트워크 관련 기술들이 테라급으로 급속히 발전하고 있는데 비해, 상대적으로 네트워크의 발전 속도에 뒤지고 있는 네트워크 침입 탐지 시스템의 성능 향상을 위해서, 기존의 소프트웨어 방식으로 구현된 침입 탐지 시스템을 고속의 패킷 처리에 뛰어난 성능을 가지고 있는 네트워크 프로세서를 이용하여 재설계 및 구현하였다. 네트워크 침입 탐지 시스템에서 대부분의 수행시간을 차지하는 네트워크 패킷을 분류하고, 이상 패킷을 탐지하는 기능을 인텔의 IXP1200 네트워크 프로세서의 마이크로엔진이 고속으로 패킷을 처리하게 함으로써 네트워크 침입 탐지 시스템의 성능 향상을 도모하였다.

• The Journal of Korean Institute of Electromagnetic Engineering and Science
• /
• v.30 no.6
• /
• pp.507-517
• /
• 2019

Multi-function radar(MFR) is a system that uses various functions such as detection, tracking, and classification. To operate the functions in real-time, the detection stage in MFR usually uses radar signals for short measurement time. We can utilize several conventional detectors in the MFR system to detect low radar cross section maritime targets in the sea-clutter; however, the detectors, which have been developed to be effective for radar signals measured for a longer time, may be inappropriate for MFR. In this study, we proposed a modelling technique of sea-clutter short measurement time. We combined the modeled sea-clutter signal with the maritime-target signal, which was obtained by the numerical analysis method. Using this combined model, we exploited four independent detectors and analyzed the detection performances.

• Journal of KIISE:Information Networking
• /
• v.35 no.6
• /
• pp.474-481
• /
• 2008

Scanning worm increases network traffic load and result in severe network congestion because it is a self-replicating worm and send copies of itself to a number of hosts through the Internet. So an early detection system which can automatically detect scanning worms is needed to protect network from those attacks. Although many studies are conducted to detect scanning worms, most of them are focusing on the method using packet header information. The method using packet header information has long detection delay since it must examine the header information of all packets entering or leaving the network. Therefore we propose an algorithm to detect scanning worms using network traffic characteristics such as variance of traffic volume, differentiated traffic volume, mean of differentiated traffic volume, and product of mean traffic volume and mean of differentiated traffic volume. We verified the proposed algorithm by analyzing the normal traffic captured in the real network and the worm traffic generated by simulator. The proposed algorithm can detect CodeRed and Slammer which are not detected by existing algorithm. In addition, all worms were detected in early stage: Slammer was detected in 4 seconds and CodeRed and Witty were detected in 11 seconds.

• Proceedings of the Korean Information Science Society Conference
• /
• 2004.04a
• /
• pp.262-264
• /
• 2004

시스템 호출 감사자료기반 기계학습기법을 사용한 프로그램 행위 학습방법은 효과적인 호스트기반 침입탐지 방법이며, 특히 신경망은 기존 연구 중 가장 좋은 성능을 보였다. 하지만 보통의 신경망은 그 구조를 찾기 위한 방법이 알려져 있지 않아 침입탐지에 효과적인 구조를 찾기 위해서는 많은 시간이 요구된다. 본 논문에서는 기존 신경망 기반 침입탐지시스템의 단점을 보완하고 성능을 향상시키기 위해 진화신경망을 이용한 방법을 제안한다. 진화 신경망은 신경망의 구조와 가중치를 동시에 학습하기 때문에 일반 신경망보다 빠른 시간 내에 더 좋은 성능의 신경망을 얻을 수 있다는 장점이 있다. 1999년의 DARPA IDEVAL자료로 실험한 결과 기존의 연구보다 좋은 성능을 보여 진화신경망이 침입탐지에 효과적임을 확인할 수 있었다.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2020.01a
• /
• pp.7-9
• /
• 2020

기존 CCTV 비디오에서 딥러닝 기반의 이상 탐지 연구는 객체의 행동 값만을 이용하여 이상을 탐지하였기 때문에, 시간 흐름에 따른 정보가 축소되는 문제점이 있었다. 그러나 CCTV 비디오에서의 이상의 원인은 다양한 요소와 시계열 분석에 따른 정보로 이루어져 있어 시간 정보를 유지하면서 다양한 특징 값을 사용한 모델을 설계할 필요가 있다. 따라서 본 논문에서는 C3D에 광학 흐름을 결합한 새로운 앙상블 모델을 제안한다. 실험 결과 본 논문에서 제안하는 모델이 75.83의 AUC를 얻어 기존에 연구되었던 행동 값만을 사용한 모델보다 높은 정확도를 달성하였다. 또한 이상 탐지 모델 설계 시 객체의 행동에 다양한 측면을 고려할 수 있는 여러 특징 값과 시계열 분석에 따른 정보를 사용하는 것이 적절하다는 결론을 도출하였다.

• The Journal of the Korea Contents Association
• /
• v.6 no.1
• /
• pp.41-53
• /
• 2006

In this paper, an adaptive ROI(region of interest) detection system for spatialtemporal features is proposed. It utilizes spatiotemporal features for the purpose of detecting ROI. It is assumed that motion representing temporal visual conspicuity between adjacent frames takes higher priority over spatial visual conspicuity. Because objects or regions in motion usually draw stronger attention than others in motion pictures. In case of still images visual features that constitute topographic feature maps are used as spatial features. Comparative experiments with a human subjective evaluation show that correct detection rate of visual attention region is improved by exploiting both spatial and temporal features compared to the case of exploiting either feature.

• KIPS Transactions on Computer and Communication Systems
• /
• v.8 no.2
• /
• pp.35-40
• /
• 2019

Traditional Malware Detection is susceptible for detecting malware which is modified by polymorphism or obfuscation technology. By learning patterns that are embedded in malware code, machine learning algorithms can detect similar behaviors and replace the current detection methods. Data must collected continuously in order to learn malicious code patterns that change over time. However, the process of storing and processing a large amount of malware files is accompanied by high space and time complexity. In this paper, an HDFS-based distributed processing system is designed to reduce space complexity and accelerate feature extraction time. Using a distributed processing system, we extract two API features based on filtering basis, 2-gram feature and APICFG feature and the generalization performance of ensemble learning models is compared. In experiments, the time complexity of the feature extraction was improved about 3.75 times faster than the processing time of a single computer, and the space complexity was about 5 times more efficient. The 2-gram feature was the best when comparing the classification performance by feature, but the learning time was long due to high dimensionality.

• Journal of the Korea Society of Computer and Information
• /
• v.25 no.12
• /
• pp.63-71
• /
• 2020

In this paper, we propose a fire detection technology using YOLOv3 and EfficientDet, the most reliable artificial intelligence detection algorithm recently, an alert service that simultaneously transmits four kinds of notifications: text, web, app and e-mail, and an AWS system that links fire detection and notification service. There are two types of our highly accurate fire detection algorithms; the fire detection model based on YOLOv3, which operates locally, used more than 2000 fire data and learned through data augmentation, and the EfficientDet, which operates in the cloud, has conducted transfer learning on the pretrained model. Four types of notification services were established using AWS service and FCM service; in the case of the web, app, and mail, notifications were received immediately after notification transmission, and in the case of the text messaging system through the base station, the delay time was fast enough within one second. We proved the accuracy of our fire detection technology through fire detection experiments using the fire video, and we also measured the time of fire detection and notification service to check detecting time and notification time. Our AI fire detection and notification service system in this paper is expected to be more accurate and faster than past fire detection systems, which will greatly help secure golden time in the event of fire accidents.

• Journal of the Korea Society for Simulation
• /
• v.19 no.4
• /
• pp.139-149
• /
• 2010

Internet was designed for network scalability and best-effort service which makes all hosts connected to Internet to be vulnerable against attack. Many papers have been proposed about attack detection algorithms against the attack using IP spoofing and DoS/DDoS attack. Purpose of DoS/DDoS attack is achieved in short period after the attack begins. Therefore, DoS/DDoS attack should be detected as soon as possible. Attack detection algorithms using false alarm rates consist of the false negative rate and the false positive rate. Moreover, they are important metrics to evaluate the attack detections. In this paper, we analyze the performance of the attack detection algorithms using the impact of false negative rate and false positive rate variation to the normal traffic and the attack traffic by simulations. As the result of this, we find that the number of passed attack packets is in the proportion to the false negative rate and the number of passed normal packets is in the inverse proportion to the false positive rate. We also analyze the limits of attack detection due to the relation between the false negative rate and the false positive rate. Finally, we propose a solution to minimize the limits of attack detection algorithms by defining the network state using the ratio between the number of packets classified as attack packets and the number of packets classified as normal packets. We find the performance of attack detection algorithm is improved by passing the packets classified as attacks.

• Proceedings of the Korean Information Science Society Conference
• /
• 2010.06c
• /
• pp.534-539
• /
• 2010

OpenMP 프로그램의 수행 중에 발생하는 자료 경합과 같은 병행성 오류는 디버깅을 위하여 반드시 탐지되어야만 한다. 그러나 이를 탐지하는 것은 어려운 일이다. 접근사건의 발생 후 관계를 기반으로하는 경합 탐지 기법은 프로그램의 수행 중에 발생하는 스레드의 병행성 정보를 식별하기위한 레이블을 생성하고, 생성된 스레드의 레이블을 기반으로 공유변수에 접근하는 사건을 접근역사를 통해 감시함으로써 경합을 탐지한다. 이러한 경합 탐지의 방법에서 레이블 생성을 위한 NR 레이블링 기법은 병행성 정보생성 시에 지역자료 구조를 사용함으로써 병목현상이 발생하지 않으며, 접근역사에 저장하는 레이블의 크기가 상수 값을 갖는 공간적 효율성을 제공한다. 또한 부모스레드의 정보역사를 정렬된 리스트 형태로 가져 병행성 정보 비교 시에 이진탐색이 가능하므로 시간적 효율성을 가지는 우수한 기법이다. 그러나, NR 레이블링은 레이블의 생성시에 부모스레드의 정보역사를 유지하기 위해서 내포 병렬성의 깊이에 의존하는 시간적 비용이 요구된다. 본 논문에서는 부모스레드의 정보역사 유지를 위해 상수적인 시간 및 공간적 복잡도를 갖도록 NR 레이블링 기법을 개선한다. 합성 프로그램을 이용하여 실험한 결과에서 개선된 기법은 최대 병렬성의 증가에 따라 레이블의 생성과 유지시 기존의 기법보다 평균 4.5배 빠르고, 레이블링을 위해 평균 3배 감소된 기억공간을 요구하며, 내포 병렬성에 의존적이지 않음을 보인다.