• The Transactions of the Korea Information Processing Society
• /
• v.6 no.7
• /
• pp.1858-1866
• /
• 1999

Recently, increasing attacks using network packets cause serious problems in networked environments ; from disturbing normal network operations to damaging computing resources. Among them denial of services are considered as critical attacks that directly exploit network packets to degrade availability. In this paper, we classify the types of denial of services in the network layer and develop detection methods that can keep the network from the classified denial of service attacks. The methods are then merged into an integrated denial of service detection algorithm that is scalable to detect new denial of service attacks.

• Proceedings of the Korean Information Science Society Conference
• /
• 2002.10c
• /
• pp.619-621
• /
• 2002

네트워크 기반 컴퓨터 시스템은 현대사회에 있어서 매우 중요한 역할을 담당하고 있기 때문에 이들은 정보 범죄들로부터 안정적이면서 효율적인 환경을 제공하는 것은 매우 중요한 일이다. 현재의 침입탐지 시스템은 네트워크 상에서 지속적으로 처리되는 대량의 패킷에 대하여 탐지속도가 떨어지고, 새로운 침입유형에 대한 대응방법이나 인지능력에도 한계가 있기 때문이다. 따라서 다양한 트래픽 속에서 탐지율을 높이고 탐지속도를 개선하기 위한 방안이 필요하다. 본 논문에서는 침입탐지 능력을 개선하기 위해 먼저, 광범위한 침입항목들에 대한 탐지 적용기술을 학습하고, 데이터 마이닝 기법을 이용하여 침입패턴 인식능력 및 새로운 패턴을 생성하는 적용기술을 제안하고자 한다. 침입 패턴생성을 위해 각 네트워크에 돌아다니는 관련된 패킷 정보와 호스트 세션에 기록되어진 자료를 필터링하고, 각종 로그 화일을 추출하는 프로그램들을 활용하여 침입과 일반적인 행동들을 분류하여 규칙들을 생성하였다. 마이닝 기법으로는 학습된 항목들에 대한 연관 규칙을 찾기 위한 연역적 알고리즘을 이용하였다. 또한, 추출 분석된 자료는 리눅스기반의 환경 하에서 다양하게 모아진 네트워크 로그파일들을 본 논문에서 제안한 방법에 따라 적용한 결과이다.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.25 no.8A
• /
• pp.1169-1176
• /
• 2000

In this paper, label assignment schemes considering the IP flow model for the efficient MPLS traffic engineering are proposed and evaluated. Based on the IP flow model, the IP flows are classified into transient flows and base flows. Base flows, which last for a long time, transmit data in high bit rate, and be composed of many packets, have good implications for the MPLS traffic engineering, because they usually cause network congestion. To make use of base flows for the MPLS traffic engineering, we propose two base flow classifiers and label assignment schemes where transient flows are allocated to the default LSPs and base flows to explicit LSPs. Proposed schemes are based on the traffic-driven label triggering method combined with a routing tabel. The first base flow classifier uses both flow size in packet counts and routing entries, and the other one, extending the dynamic X/Y flow classifier, is based on a cut-through ratio. Proposed schemes are shown to minimize the number of labels, not degrading the total cut-through ratio.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.25 no.7
• /
• pp.923-929
• /
• 2021

TCP communication and packet communication require transmission control technology to ensure high quality and high reliability. However, in the case of real-time data transmission, an inefficient transmission problem occurs. In order to overcome this problem and transmit the packet reliability, in general, early congestion control using the buffer level as an index was used. Control of the congestion control point and the cancellation point is delayed because the point at which congestion is controlled is based on the buffer level. Therefore, in this paper, not only the buffer level indicator, but also the ideal buffer level, which determines the packet discard probability, is classified so that the transmission rate and buffer level that measure network congestion are close to the level above the optimal setting. As a result, it was shown that the average buffer level can be directly controlled by maintaining the average buffer level by the ideal buffer level set in the experiment to prove the proposed method.

• KIPS Transactions on Computer and Communication Systems
• /
• v.2 no.8
• /
• pp.335-342
• /
• 2013

Nowadays, the traffic type and behavior are extremely diverse due to the growth of network speed and the appearance of various services on Internet. For efficient network operation and management, the importance of application-level traffic identification is more and more increasing in the area of traffic analysis. In recent years traffic identification methodology using statistical features of traffic flow has been broadly studied. However, there are several problems to be considered in the identification methodology base on statistical features of flow to improve the analysis accuracy. In this paper, we recognize these problems by analyzing the ground-truth traffic and propose the solution of these problems. The four problems considered in this paper are the distance measurement of features, the selection of the representative value of features, the abnormal behavior of TCP sessions, and the weight assignment to the feature. The proposed solutions were verified by showing the performance improvement through experiments in campus network.

• Journal of KIISE:Information Networking
• /
• v.28 no.2
• /
• pp.251-261
• /
• 2001

The traffic on the Internet has been growing exponentially for some time. This growth is beginning to stress the current-day routers. However, switching technology offers much higher performance. So the label switching network which combines IP routing with switching technology, is emerged. EspeciaJJy in the data driven label switching, flow classification and cache table management are needed. Flow classification is to classify packets into switching and non-switching packets, and cache table management is to maintain the cache table which contains information for flow classification and label switching. However, the cache table management affects the performance of label switching network considerably as well as flowclassification because the bigger cache table makes more packet switched and maintains setup cost lower, but cache is restricted by local router resources. For that reason, there is need to study the cache replacement scheme for the efficient cache table management with the Internet traffic characterized by user. So in this paper, we propose several cache replacement schemes for label switching network. First, without the limitation at switching capacity in the router. we introduce FIFO(First In First Out). LFC(Least Flow Count), LRU(Least Recently Used! scheme and propose priority LRU, weighted priority LRU scheme. Second, with the limitation at switching capacity in the router, we introduce LFC-LFC, LFC-LRU, LRU-LFC, LRU-LRU scheme and propose LRU-weighted LRU scheme. Without limitation, weighted priority LRU scheme and with limitation, LRU-weighted LRU scheme showed best performance in this paper.

• Journal of the Korean Institute of Illuminating and Electrical Installation Engineers
• /
• v.22 no.4
• /
• pp.26-34
• /
• 2008

This study focus on segmentation process that classifies road surfaces into 5 different categories, dry, wet water, icy, and snowy surfaces by analyzing asphalt-paved road images taken in daylight. By using the polarization coefficients, the proportions of horizontally polarized components to vertically polarized components, regions with over 1.3 polarization coefficients are classified as wet surfaces. Except for wet surfaces, the decision process a lies time-frequency analysis to other parts by using the third order wavelet packet transform. In addition, by using the average frequency characteristics of dry and icy surfaces from image templates, decide which is closer to a test image, and finally identify dry and icy surfaces. It is confirmed that the reposed estimation and segmentation of recognition on various images. This can be interpreted as an indication that image-only mad surface condition supervision is probable.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.40 no.7
• /
• pp.1339-1346
• /
• 2015

The traffic identification is a preliminary and essential step for stable network service provision and efficient network resource management. While a number of identification methods have been introduced in literature, the payload signature-based identification method shows the highest performance in terms of accuracy, completeness, and practicality. However, the payload signature-based method's processing speed is much slower than other identification method such as header-based and statistical methods. In this paper, we first classifies signatures by matching type based on range, order, and direction of packet in a flow which was automatically extracted. By using this classification, we suggest a novel method to improve processing speed of payload signature-based identification by reducing searching space.

• Journal of IKEEE
• /
• v.7 no.2 s.13
• /
• pp.288-298
• /
• 2003

We consider a window-controlled selective-repeat ARQ scheme for error control between two adjacent nodes lying on a communication path. In this scheme, each packet to be transmitted is endowed with a serial number in a cyclic and sequential fashion. In turn, the transmitting node is not allowed to transmit a packet belonging to a window before every packet in the previous window is positively acknowledged. Such postponement of packet transmission incurs a degradation in throughput and delay performance. In this paper, aiming at improving packet delay performance, we employs a supplement scheme in which a serial number is duplicated within a frame. Classifying duplication rules into fixed, random and adaptive categories, we present candidate rules in each category and evaluate the packet delay performance induced by each duplication rule. From numerical examples, we observe that duplicating serial numbers, especially ADR-T2 effectively reduces mean packet delay for the forward channel characterized by a low packet error rate. We also reveal that such delay enhancement is achieved by a high probability of hitting local optimal window size.

• Proceedings of the Korean Information Science Society Conference
• /
• 2008.06a
• /
• pp.124-127
• /
• 2008

DoS/DDoS로 대표되는 트래픽 폭주 공격은 대상 시스템뿐만 아니라 네트워크 대역폭, 프로세서 처리능력, 시스템 자원 등에 악영향을 줌으로써 네트워크에 심각한 장애를 유발할 수 있다. 따라서 신속한 트래픽 폭주 공격의 탐지는 안정적인 서비스 제공 및 시스템 운영에 필수요건이다. 전통적인 패킷 수집을 통한 DoS/DDoS의 탐지방법은 공격에 대한 상세한 분석은 가능하나 설치의 확장성 부족, 고가의 고성능 분석시스템의 요구, 신속한 탐지를 보장하지 못한다는 문제점을 갖고 있다. 본 논문에서는 15초 단위의 SNMP MIB 객체 정보를 바탕으로 SVDD(support vector data description)를 이용하여 보다 빠르고 정확한 침입탐지와 쉬운 확장성, 저비용탐지 및 정확한 공격유형별 분류를 가능케 하는 새로운 시스템을 설계 및 구현하였다. 실험을 통하여 만족스러운 침입 탐지율과 안전한 false negative rate, 공격유형별 분류율 수치 등을 확인함으로써 제안된 시스템의 성능을 검증하였다.