• Journal of Information Processing Systems
• /
• 제7권1호
• /
• pp.173-186
• /
• 2011

Due to the disadvantages of signature-based computer virus detection techniques, behavior-based detection methods have developed rapidly in recent years. However, current popular behavior-based detection methods only take API call sequences as program behavior features and the difference between API calls in the detection is not taken into consideration. This paper divides virus behaviors into separate function modules by introducing DLLs into detection. APIs in different modules have different importance. DLLs and APIs are both considered program calling resources. Based on the calling relationships between DLLs and APIs, program calling resources can be pictured as a tree named program behavior resource tree. Important block structures are selected from the tree as program behavior features. Finally, a virus detection model based on behavior the resource tree is proposed and verified by experiment which provides a helpful reference to virus detection.

• 제어로봇시스템학회:학술대회논문집
• /
• 제어로봇시스템학회 2005년도 ICCAS
• /
• pp.2337-2341
• /
• 2005

This paper presents the target detection method using Support Vector Machines(SVMs) and the navigation system using behavior-based fuzzy controller. SVM is a machine-learning method based on the principle of structural risk minimization, which performs well when applied to data outside the training set. We formulate detection of target objects as a supervised-learning problem and apply SVM to detect at each location in the image whether a target object is present or not. The behavior-based fuzzy controller is implemented as an individual priority behavior: the highest level behavior is target-seeking, the middle level behavior is obstacle-avoidance, the lowest level is an emergency behavior. We have implemented and tested the proposed method in our mobile robot "Pioneer2-AT". Comparing with a neural-network based detection method, a SVM illustrate the excellence of the proposed method.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제15권6호
• /
• pp.2188-2203
• /
• 2021

With the rapid development of mobile Internet, smart phones have been widely popularized, among which Android platform dominates. Due to it is open source, malware on the Android platform is rampant. In order to improve the efficiency of malware detection, this paper proposes deep learning Android malicious detection system based on behavior features. First of all, the detection system adopts the static analysis method to extract different types of behavior features from Android applications, and extract sensitive behavior features through Term frequency-inverse Document Frequency algorithm for each extracted behavior feature to construct detection features through unified abstract expression. Secondly, Long Short-Term Memory neural network model is established to select and learn from the extracted attributes and the learned attributes are used to detect Android malicious applications, Analysis and further optimization of the application behavior parameters, so as to build a deep learning Android malicious detection method based on feature analysis. We use different types of features to evaluate our method and compare it with various machine learning-based methods. Study shows that it outperforms most existing machine learning based approaches and detects 95.31% of the malware.

• 정보보호학회논문지
• /
• 제14권5호
• /
• pp.69-78
• /
• 2004

인터넷의 급속한 확장과 새로운 공격 형태의 출현으로 인해 공격 기법 패러다임의 변화가 시작되었다. 그러나, 대부분의 침입 탐지 시스템은 오용 탐지 기반의 알려진 공격 유형만을 탐지하며, 새로운 공격에 대해서는 능동적인 대응이 어려운 실정이다. 이에 새로운 공격 유형에 대한 탐지 능력을 높이기 위해 이상 탐지의 여러 기법들을 적용하려는 시도들이 나타나고 있다. 본 논문에서는 그래픽 기반의 베이지안 프레임워크를 이용하여 감사 데이터에 의한 행위 프로파일링 방법을 제안하고 이상 탐지와 분석을 위한 행위 프로파일을 시각화하고자 한다. 호스트/네트워크의 감사 데이터를 이상 탐지를 위한 준 구조적 데이터 형식의 행위 프로파일인 BF-XML로 변환하고, BF-XML을 SVG로 시각화를 시뮬레이션한다.

• 한국지능정보시스템학회:학술대회논문집
• /
• 한국지능정보시스템학회 2002년도 추계정기학술대회
• /
• pp.445-453
• /
• 2002

Past and current customer behavior is the best predicator of future customer behavior. This paper introduces a procedure on personalized defection detection and prevention for an online game site. The basic idea for our defection detection and prevention is adopted from the observation that potential defectors have a tendency to take a couple of months or weeks to gradually change their behavior (i.e. trim-out their usage volume) before their eventual withdrawal. For this purpose, we suggest a SOM (Self-Organizing Map) based procedure to determine the possible states of customer behavior from past behavior data. Based on this representation of the state of behavior, potential defectors are detected by comparing their monitored trajectories of behavior states with frequent and confident trajectories of past defectors. The key feature of this study includes a defection prevention procedure which recommends the desirable behavior state for the ext period so as to lower the likelihood of defection. The defection prevention procedure can be used to design a marketing campaign on an individual basis because it provides desirable behavior patterns for the next period. The experiments demonstrate that our approach is effective for defection prevention and efficient for defection detection because it predicts potential defectors without deterioration of prediction accuracy compared to that of the MLP (Multi-Layer Perceptron) neural network.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제8권3호
• /
• pp.965-983
• /
• 2014

Concurrent behaviors of multithreaded programs cannot be described effectively by automata-based models. Thus, concurrent program intrusion attempts cannot be detected. To address this problem, we proposed the process algebra-based detection model for multithreaded programs (PADMP). We generate process expressions by static binary code analysis. We then add concurrency operators to process expressions and propose a model construction algorithm based on process algebra. We also present a definition of process equivalence and behavior detection rules. Experiments demonstrate that the proposed method can accurately detect errors in multithreaded programs and has linear space-time complexity. The proposed method provides effective support for concurrent behavior modeling and detection.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제9권2호
• /
• pp.659-679
• /
• 2015

Distributed applications are composed of multiple nodes, which exchange information with individual nodes through message passing. Compared with traditional applications, distributed applications have more complex behavior patterns because a large number of interactions and concurrent behaviors exist among their distributed nodes. Thus, it is difficult to detect anomalous behaviors and determine the location and scope of abnormal nodes, and some attacks and misuse cannot be detected. To address this problem, we introduce a method for detecting anomalous behaviors based on process algebra. We specify the architecture of the behavior detection model and the detection algorithm. The anomalous behavior detection and analysis demonstrate that our method is a good discriminator between normal and anomalous behavior characteristics of distributed applications. Performance evaluation shows that the proposed method enhances efficiency without security degradation.

• 정보처리학회논문지C
• /
• 제10C권4호
• /
• pp.397-404
• /
• 2003

프로그램 행위기반 침입탐지 기법은 데몬 프로그램이나 루트 권한으로 실행되는 프로그램이 발생시키는 시스템 호출들을 분석하고 프로그램 행위 프로파일을 구축하여 잠재적인 공격을 효과적으로 탐지한다. 그러나 각 프로그램마다 매우 큰 프로파일이 구축되어야 하는 문제점이 있다. 본 논문은 프로파일의 크기를 줄이기 위해, 프로그램 행위 프로파일링 및 이상행위 탐지에 X$^2$ 거리기반 다변량 분석 기법을 응용하였다. 실험 결과, 프로파일을 비교적 작게 유지하면서 탐지율에서는 의미있는 결과를 보였다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제5권11호
• /
• pp.2191-2203
• /
• 2011

In this paper, we propose a fast and robust algorithm for fighting behavior detection based on Motion Vectors (MV), in order to solve the problem of low speed and weak robustness in traditional fighting behavior detection. Firstly, we analyze the characteristics of fighting scenes and activities, and then use motion estimation algorithm based on block-matching to calculate MV of motion regions. Secondly, we extract features from magnitudes and directions of MV, and normalize these features by using Joint Gaussian Membership Function, and then fuse these features by using weighted arithmetic average method. Finally, we present the conception of Average Maximum Violence Index (AMVI) to judge the fighting behavior in surveillance scenes. Experiments show that the new algorithm achieves high speed and strong robustness for fighting behavior detection in surveillance scenes.

• 정보과학회 논문지
• /
• 제45권3호
• /
• pp.294-302
• /
• 2018

정보통신 기술의 발전에 따른 새로운 서비스 산업의 출현으로 개인 정보 침해, 산업 기밀 유출 등 사이버 공간의 위험이 다양화 되어, 그에 따른 보안 문제가 중요한 이슈로 떠오르게 되었다. 본 연구에서는 기업 내 개인 정보 오남용 및 내부 정보 유출에 따른, 대용량 사용자 로그 데이터를 기반으로 기존의 시그니처(Signature) 보안 대응 방식에 비해, 실시간 및 대용량 데이터 분석기술에 적합한 행위 기반 이상 탐지방식을 제안하였다. 행위 기반 이상 탐지방식이 대용량 데이터를 처리하는 기술을 필요로 함에 따라, 역방향 인덱스(Inverted Index) 기반의 실시간 검색 엔진인 엘라스틱서치(Elasticsearch)를 사용하였다. 또한 데이터 분석을 위해 통계 기반의 빈도 분석과 전 처리 과정을 수행하였으며, 밀도 기반의 군집화 방법인 DBSCAN 알고리즘을 적용하여 이상 데이터를 분류하는 방법과 시각화를 통해 분석을 간편하게 하기위한 한 사례를 보였다. 이는 기존의 이상 탐지 시스템과 달리 임계값을 별도로 설정하지 않고 이상 탐지 분석을 시도하였다는 것과 통계적인 측면에서 이상 탐지 방식을 제안하였다는 것에 의의가 있다.