• ETRI Journal
• /
• v.39 no.5
• /
• pp.621-631
• /
• 2017

Abnormal samples are usually difficult to obtain in production systems, resulting in imbalanced training sample sets. Namely, the number of positive samples is far less than the number of negative samples. Traditional Support Vector Machine (SVM)-based anomaly detection algorithms perform poorly for highly imbalanced datasets: the learned classification hyperplane skews toward the positive samples, resulting in a high false-negative rate. This article proposes a new imbalanced SVM (termed ImSVM)-based anomaly detection algorithm, which assigns a different weight for each positive support vector in the decision function. ImSVM adjusts the learned classification hyperplane to make the decision function achieve a maximum GMean measure value on the dataset. The above problem is converted into an unconstrained optimization problem to search the optimal weight vector. Experiments are carried out on both Cloud datasets and Knowledge Discovery and Data Mining datasets to evaluate ImSVM. Highly imbalanced training sample sets are constructed. The experimental results show that ImSVM outperforms over-sampling techniques and several existing imbalanced SVM-based techniques.

• Proceedings of the KIEE Conference
• /
• 2003.11c
• /
• pp.559-562
• /
• 2003

In this paper, we introduce a new method detecting thyristor faults of the power converter module in Control Rod Control System. When we control the currents in each coil of Control Rod Drive Mechanism by using the current control method, the current value can follow the current reference despite the faults like the missing phase or the diode acting. Comparing the fault current values with the normal current values, the bad transient characteristics of the abnormal current can make the operations of control rods incorrect. In this case, the information from the current trends cannot be enough to detect the fault occurrence in thyristors. Instead of the coil currents, the state of thyristors can be watched by measuring the coil voltages. In the existing system of Westinghouse type, the ripple detector takes charge of this task. But this detector has some shortcomings in the point of time for fault detection, we come to devise a new fault detection method solving the problems which belong to the ripple detector.

• International Journal of Computer Science & Network Security
• /
• v.21 no.6
• /
• pp.89-100
• /
• 2021

Smart Grid Network (SGN) is a next generation electrical power network which digitizes the power distribution grid and achieves smart, efficient, safe and secure operations of the electricity. The backbone of the SGN is information communication technology that enables the SGN to get full control of network station monitoring and analysis. In any network where communication is involved security is essential. It has been observed from several recent incidents that an adversary causes an interruption to the operation of the networks which lead to the electricity theft. In order to reduce the number of electricity theft cases, companies need to develop preventive and protective methods to minimize the losses from this issue. In this paper, we have introduced a machine learning based SVM method that detects malicious nodes in a smart grid network. The algorithm collects data (electricity consumption/electric bill) from the nodes and compares it with previously obtained data. Support Vector Machine (SVM) classifies nodes into Normal or malicious nodes giving the statues of 1 for normal nodes and status of -1 for malicious -abnormal-nodes. Once the malicious nodes have been detected, we have done a trust evaluation based on the nodes history and recorded data. In the simulation, we have observed that our detection rate is almost 98% where the false alarm rate is only 2%. Moreover, a Trust value of 50 was achieved. As a future work, countermeasures based on the trust value will be developed to solve the problem remotely.

• Journal of the Optical Society of Korea
• /
• v.9 no.4
• /
• pp.157-161
• /
• 2005

Medical infrared imaging is obtained by measuring the self-emitted infrared radiance from the human body. Infrared emission is related to surface temperature and temperature is one of the most important physiological parameters related to health. Though recent applications such as security identification and oriental medicine have provided new fields of biomedical applications, infrared thermography has had ups and downs in its usages in cancer detection. Some of the main difficulties include finding proper applications and efficient diagnostic algorithms. In this study, infrared thermal imaging was used to detect regional metastasis of breast cancer. Our measurements were done for 110 women. From 63 individuals of a Healthy Group and a Benign Breast Disease Group, we developed algorithms for differentiating malignant regional metastasis based on temperature difference and asymmetry of temperature distribution. Testing with 47 cancer patients, we achieved a positive predictive value of $87.5\%$ and a negative predictive value of $95.6\%$. The results were better than for mammogram examination. A proper analysis of infrared imaging proved to be a highly informative and sensitive method for differentiating regional cancer metastasis from normal regions.

• Journal of the Institute of Electronics and Information Engineers
• /
• v.51 no.9
• /
• pp.200-207
• /
• 2014

Arrhythmia electrocardiogram signal contains a specific unusual heartbeat with abnormal morphology. Because unusual heartbeat is useful for diagnosis and classification of various diseases, such as arrhythmia, detection of unusual heartbeat from the arrhythmic ECG signal is very important. Amplitude and kurtosis at R-peak point and RR interval are characteristics of ECG signal on R-wave. In this paper, we provide a method for detecting unusual heartbeat based on these. Through the value of the attribute deviates more from the average value if unusual heartbeat is more certainly, the proposed method detects unusual heartbeat in order using the mean and standard deviation. From 15 ECG signals of MIT-BIH arrhythmia database which has R-wave distortion, we compare the result of conventional method which uses the fixed threshold value and the result of proposed method. Throughout the experiment, the sensitivity is significantly increased to 97% from 50% using the proposed method.

• Journal of KIISE:Information Networking
• /
• v.36 no.3
• /
• pp.173-183
• /
• 2009

We present a real-time monitoring system for detecting anomalous network events using the entropy. The entropy accounts for the effects of disorder in the system. When an abnormal factor arises to agitate the current system the entropy must show an abrupt change. In this paper we deliberately model the Internet to measure the entropy. Packets flowing between these two networks may incur to sustain the current value. In the proposed system we keep track of the value of entropy in time to pinpoint the sudden changes in the value. The time-series data of entropy are transformed into the two-dimensional domains to help visually inspect the activities on the network. We examine the system using network traffic traces containing notorious worms and DoS attacks on the testbed. Furthermore, we compare our proposed system of time series forecasting method, such as EWMA, holt-winters, and PCA in terms of sensitive. The result suggests that our approach be able to detect anomalies with the fairly high accuracy. Our contributions are two folds: (1) highly sensitive detection of anomalies and (2) visualization of network activities to alert anomalies.

• Journal of the Korean Society of Safety
• /
• v.37 no.4
• /
• pp.20-27
• /
• 2022

This article aims to develop an algorithm that detects fire pump defects by analyzing the current signals of an induction motor, which are triggered by changes in the flow rate and pressure of multistage volute pumps that are used for fire services. The operational status of the pumps was categorized into three: first, normal operation; second, a defect that is caused by a change in the current value; and third, a defect occasioned by a change in current, pressure, and flow rate. When a fire pump was in normal operation, the motor's operating current was measured between 5.06 A and 6.9 A, the flow rate was estimated at 0-0.27 m³/min, and the pressure ranged from 0 to 0.47 MPa. In the event that a defect was caused by an abnormal current value in the motor, it was attributed to the pump's adherence. Furthermore, if there was no source of water, the defect was considered to have been induced by phase-loss operation, no-load operation, or run-stop operation, with the current value of each scenario being measured at > 52.8 A, < 4.13 A, > 45.15 A, and < 3.8 A, respectively, placing its overall range between 0 and 50 A. The sources of defects were detected based on an analysis of the flow rate, pressure, and current, which represent the following causes: air inflow into the casing, inadequate suction of water, and reverse-phase operation, respectively. Each cause entailed the following values: when air seeped into the casing, the pressure was measured at 0.24 MPa irrespective of changes in the flow rate; when there was inadequate suction of water, the pressure was recorded between 0 and 0.05 MPa despite changes in the flow rate; and when the power line's reverse-phase loss was the cause of the defect, the pressure was measured at 0.33 MPa for a flow rate of 0 L/min, and a higher flow rate decreased the pressure to nearly 0 MPa. The results of this study will enable engineers to develop a pump defect detection algorithm that is based on an analysis of current, and this algorithm will facilitate the execution of a program that will control a fire pump defect detection system.

• The Korean Journal of Nuclear Medicine
• /
• v.9 no.1
• /
• pp.51-58
• /
• 1975

It is a great value to find an early detection of involvement of ureteric obstruction in the carcinoma of cervix. Little or no knowledge of the condition of the kidneys or the lower urinary tract are able to elucidate by the biochemical studies such as blood nitrogen or urine creatinine in carcinoma of cervix. Findings of urography delineates the condition of urinary tract stasis in the renal pelvis and ureters, however, slight stasis maybe difficult to demonstrate. On the other hand isotope nephrography is accepted as a sensitive method to observe renal function especially in regarding to the excretory function of kidney. It was attempted to analysis the findings of urography conjunction with isotope nephrography in 50 cases of unselected patients with invasive carcinoma of cervix through pre and post irradiation follow up studies. Urography was done as a routine procedure and.analysed emphasising changes of collecting systems and ureter condition. Isotope nephrography was carried out by means of $15{\mu}ci\;I^{131}$-Hippuran injected intravenously and the curves were analysed as follows. Parameter were; time of maximum amplitude ($T_{max}$), half time of maximum amplitude ($T\frac{1}{2}$), Kac and Kex value calculated from these two parameters in Tobe's method. The excretion index by Aurell defines the ratio between the maximum activity and the activity measured on the slope of the third phase ten minites after it has reached its maximum. Results: 1. 28.8% had an abnormal IVP suggestive of ureteric involvement before irradiation therapy and the patient of stage III and IV were the great part. 2. 21.7% had abnormal findings of per-irradiation renogram whom showed normal IVP. The other group showed normal IVP which group also showed normal renogram prior irradiation. 3. The more severe the ureteric involvement, the change of excretion index was greater. 4. Even in stage I and II patient, abnormal renogram was revealed in 12 cases (39.4%) among 31 cases. 5. All cases of TAH showed abnormal findings of IVP and renogram. 6. No. definite change of renogram was obtained just after the irradiation therapy (point $A:8000{\sim}9000rads,\;B:5000{\sim}6000rads,\;Co:11000{\sim}13000rads$). Each 3 month follow up study was performed and comparing with preirradiation study which showed significant changes of excretion index of renogram were 42.8% in $6{\sim}9$ month follow-up and 75% in $9{\sim}12$ month, respectively. 7. It seems to be important to observe the parameter Kex and excretion index of renogram to determine early abnormality of kidney excretory function by means of post-irradiation follow up study.

• Journal of KIISE
• /
• v.45 no.3
• /
• pp.294-302
• /
• 2018

With the emergence of the new service industry due to the development of information and communication technology, cyber space risks such as personal information infringement and industrial confidentiality leakage have diversified, and the security problem has emerged as a critical issue. In this paper, we propose a behavior-based anomaly detection method that is suitable for real-time and large-volume data analysis technology. We show that the proposed detection method is superior to existing signature security countermeasures that are based on large-capacity user log data according to in-company personal information abuse and internal information leakage. As the proposed behavior-based anomaly detection method requires a technique for processing large amounts of data, a real-time search engine is used, called Elasticsearch, which is based on an inverted index. In addition, statistical based frequency analysis and preprocessing were performed for data analysis, and the DBSCAN algorithm, which is a density based clustering method, was applied to classify abnormal data with an example for easy analysis through visualization. Unlike the existing anomaly detection system, the proposed behavior-based anomaly detection technique is promising as it enables anomaly detection analysis without the need to set the threshold value separately, and was proposed from a statistical perspective.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.17 no.6
• /
• pp.1674-1688
• /
• 2023

The remarkable advancement of quantum steganography offers enhanced security for quantum communications. However, there is a significant concern regarding the potential misuse of this technology. Moreover, the current research on identifying malicious quantum steganography is insufficient. To address this gap in steganalysis research, this paper proposes a specialized quantum steganalysis algorithm. This algorithm utilizes quantum machine learning techniques to detect steganography in general quantum secure communication schemes that are based on pure states. The algorithm presented in this paper consists of two main steps: data preprocessing and automatic discrimination. The data preprocessing step involves extracting and amplifying abnormal signals, followed by the automatic detection of suspicious quantum carriers through training on steganographic and non-steganographic data. The numerical results demonstrate that a larger disparity between the probability distributions of steganographic and non-steganographic data leads to a higher steganographic detection indicator, making the presence of steganography easier to detect. By selecting an appropriate threshold value, the steganography detection rate can exceed 90%.