• 한국통신학회논문지
• /
• 제29권12C호
• /
• pp.1707-1721
• /
• 2004

본 논문에서는 네트워크 차원의 종합적인 보안관리가 가능한 침입탐지시스템의 분산 통신모델을 제안하고 보안노드와 분산 시스템 레벨에서 각각 모델링하고 시뮬레이터를 설계하고 구현한다. 노드 레벨에서는 하드웨어기반 침입탐지를 수행하는 기가비트 보안 노드의 구조분석을 기반으로 경보 메시지의 전달 성능을 평가한다. 분산 시스템 레벨에서는 보안정책을 기반으로 네트워크 수준에서 분산 침입방지시스템의 컴포넌트 사이에 전달되는 탐지 및 경보 정보의 전달 성능을 모의실험을 통하여 성능평가를 수행한다. 제안된 모델에서 통신 메커니즘의 결정요인들을 적용하여 성능 평가를 수행하고 시스템의 정량적인 이해를 하기 위하여 결과를 제시한다.

• Journal of Information Processing Systems
• /
• 제6권4호
• /
• pp.481-500
• /
• 2010

The Internet explosion and the increase in crucial web applications such as ebanking and e-commerce, make essential the need for network security tools. One of such tools is an Intrusion detection system which can be classified based on detection approachs as being signature-based or anomaly-based. Even though intrusion detection systems are well defined, their cooperation with each other to detect attacks needs to be addressed. Consequently, a new architecture that allows them to cooperate in detecting attacks is proposed. The architecture uses Software Agents to provide scalability and distributability. It works in two modes: learning and detection. During learning mode, it generates a profile for each individual system using a fuzzy data mining algorithm. During detection mode, each system uses the FuzzyJess to match network traffic against its profile. The architecture was tested against a standard data set produced by MIT's Lincoln Laboratory and the primary results show its efficiency and capability to detect attacks. Finally, two new methods, the memory-window and memoryless-window, were developed for extracting useful parameters from raw packets. The parameters are used as detection metrics.

• Journal of Information Processing Systems
• /
• 제16권4호
• /
• pp.975-990
• /
• 2020

Nowadays, the Internet of Things (IoT) network, is increasingly becoming a ubiquitous connectivity between different advanced applications such as smart cities, smart homes, smart grids, and many others. The emerging network of smart devices and objects enables people to make smart decisions through machine to machine (M2M) communication. Most real-world security and IoT-related challenges are vulnerable to various attacks that pose numerous security and privacy challenges. Therefore, IoT offers efficient and effective solutions. intrusion detection system (IDS) is a solution to address security and privacy challenges with detecting different IoT attacks. To develop an attack detection and a stable network, this paper's main objective is to provide a comprehensive overview of existing intrusion detections system for IoT environment, cyber-security threats challenges, and transparent problems and concerns are analyzed and discussed. In this paper, we propose software-defined IDS based distributed cloud architecture, that provides a secure IoT environment. Experimental evaluation of proposed architecture shows that it has better detection and accuracy than traditional methods.

• 한국정보처리학회:학술대회논문집
• /
• 한국정보처리학회 2023년도 추계학술발표대회
• /
• pp.151-153
• /
• 2023

Federated learning (FL)-based network intrusion detection techniques have enormous potential for securing the Industrial Internet of Things (IIoT) cybersecurity. The openness and connection of systems in smart industrial facilities can be targeted and manipulated by malicious actors, which emphasizes the significance of cybersecurity. The conventional centralized technique's drawbacks, including excessive latency, a congested network, and privacy leaks, are all addressed by the FL method. In addition, the rich data enables the training of models while combining private data from numerous participants. This research aims to create an FL-based architecture to improve cybersecurity and intrusion detection in IoT networks. In order to assess the effectiveness of the suggested approach, we have utilized well-known cybersecurity datasets along with centralized and federated machine learning models.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제12권6호
• /
• pp.2895-2921
• /
• 2018

Security has become one of the major concerns in mobile adhoc networks (MANETs). Data and voice communication amongst roaming battlefield entities (such as platoon of soldiers, inter-battlefield tanks and military aircrafts) served by MANETs throw several challenges. It requires complex securing strategy to address threats such as unauthorized network access, man in the middle attacks, denial of service etc., to provide highly reliable communication amongst the nodes. Intrusion Detection and Prevention System (IDPS) undoubtedly is a crucial ingredient to address these threats. IDPS in MANET is managed by Command Control Communication and Intelligence (C3I) system. It consists of networked computers in the tactical battle area that facilitates comprehensive situation awareness by the commanders for timely and optimum decision-making. Key issue in such IDPS mechanism is lack of Smart Learning Engine. We propose a novel behavioral based "Smart Multi-Instance Multi-Label Intrusion Detection and Prevention System (MIML-IDPS)" that follows a distributed and centralized architecture to support a Robust C3I System. This protocol is deployed in a virtually clustered non-uniform network topology with dynamic election of several virtual head nodes acting as a client Intrusion Detection agent connected to a centralized server IDPS located at Command and Control Center. Distributed virtual client nodes serve as the intelligent decision processing unit and centralized IDPS server act as a Smart MIML decision making unit. Simulation and experimental analysis shows the proposed protocol exhibits computational intelligence with counter attacks, efficient memory utilization, classification accuracy and decision convergence in securing C3I System in a Tactical Battlefield environment.

• 정보처리학회논문지C
• /
• 제16C권2호
• /
• pp.151-164
• /
• 2009

센서 네트워크는 유비쿼터스 컴퓨팅 구현을 위한 기반 네트워크 중의 하나로 그 중요성이 점차 부각되고 있으며, 네트워크 특성상 보안 기술 또한 기반 기술과 함께 중요하게 인식되고 있다. 현재까지 진행된 센서 네트워크 보안 기술은 암호화에 의존하는 인증 구조나 키 관리 구조에 대한 연구가 주를 이루었다. 그러나 센서 노드는 쉽게 포획이 가능하고 암호화 기술을 사용하는 환경에서도 키가 외부에 노출되기 쉽다. 공격자는 이를 이용하여 합법적인 노드로 가장하여 내부에서 네트워크를 공격할 수 있다. 따라서 네트워크의 보안을 보장하기 위해서는 한정된 자원의 많은 센서로 구성된 센서 네트워크 특성에 맞는 효율적인 침입탐지 구조가 개발되어야 한다. 본 논문에서는 센서 네트워크에서 에너지 효율성과 침입탐지 기능의 효율성을 함께 고려하여 침입탐지 기능을 분산적이고 동적으로 변화시킬 수 있는 분산 침입탐지 구조를 제안한다. 클러스터링 알고리즘인 HEED 알고리즘을 수정 (modified HEED, mHEED라 칭함)하여 각 라운드에서 노드의 에너지 잔량과 이웃 노드 수에 따라 분산 침입탐지노드가 선택되고, 침입탐지를 위한 코드와 이전 감시 결과가 이동 에이전트를 통해 전달이 되어 연속적인 감시 기능을 수행한다. 감시된 결과는 일반 센싱 정보에 첨부되어 전달되거나 긴급한 데이터의 경우 높은 우선순위 전달을 통해 중앙 침입탐지 시스템에 전달이된다. 시뮬레이션을 통해 기존 연구인 적응적 침입탐지 구조와 성능 비교를 수행하였고, 그 결과 에너지 효율성 및 오버헤드, 탐지가능성과 그 성능 측면에서 뛰어난 성능 향상을 입증할 수 있었다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제13권5호
• /
• pp.2732-2753
• /
• 2019

With the application of wireless sensor networks in the fields of ecological observation, defense military, architecture and urban management etc., the security problem is becoming more and more serious. Characteristics and constraint conditions of wireless sensor networks such as computing power, storage space and battery have brought huge challenges to protection research. Inspired by the danger theory in biological immune system, this paper proposes an intrusion detection model for wireless sensor networks. The model abstracts expressions of antigens and antibodies in wireless sensor networks, defines meanings and functions of danger signals and danger areas, and expounds the process of intrusion detection based on the danger theory. The model realizes the distributed deployment, and there is no need to arrange an instance at each sensor node. In addition, sensor nodes trigger danger signals according to their own environmental information, and do not need to communicate with other nodes, which saves resources. When danger is perceived, the model acquires the global knowledge through node cooperation, and can perform more accurate real-time intrusion detection. In this paper, the performance of the model is analyzed including complexity and efficiency, and experimental results show that the model has good detection performance and reduces energy consumption.

• 한국시뮬레이션학회논문지
• /
• 제17권2호
• /
• pp.83-90
• /
• 2008

본 연구에서는 분산인공지능의 한 영역인 블랙보드구조를 통한 침입탐지 에이전트간의 연동 방법에 대해서 소개한다. 연동을 위해서 블랙보드를 사용한 시스템은 쉽게 확장이 가능하여 새로운 에이전트를 추가하기 용이하고, 블랙보드의 레벨을 수정하기 용이하다. 대상시스템에 시뮬레이션을 수행한다. 본 연구에서는 정책기반 네트워크를 사용하여 침입 탐지의 성능을 높이고자 하는데, 이를 적용함으로써 false positive를 줄일 수 있다. 정책기반네트워크를 통해 침입탐지 에이전트들이 서로 연동함으로써 성능의 향상을 이룬다는 것을 기존의 시스템과 비교함으로써 증명한다. 본 연구의 결과는 다양한 보안 정책을 적용하는데 사용될 수 있다.

• 한국정보기술응용학회:학술대회논문집
• /
• 한국정보기술응용학회 2005년도 6th 2005 International Conference on Computers, Communications and System
• /
• pp.161-164
• /
• 2005

As the power of influence of the Internet grows steadily, attacks against the Internet can cause enormous monetary damages nowadays. A worm can not only replicate itself like a virus but also propagate itself across the Internet. So it infects vulnerable hosts in the Internet and then downgrades the overall performance of the Internet or makes the Internet not to work. To response this, worm detection and prevention technologies are developed. The worm detection technologies are classified into two categories, host based detection and network based detection. Host based detection methods are a method which checks the files that worms make, a method which checks the integrity of the file systems and so on. Network based detection methods are a misuse detection method which compares traffic payloads with worm signatures and anomaly detection methods which check inbound/outbound scan rates, ICMP host/port unreachable message rates, and TCP RST packet rates. However, single detection methods like the aforementioned can't response worms' attacks effectively because worms attack the Internet in the distributed fashion. In this paper, we propose a design of distributed worm detection system to overcome the inefficiency. Existing distributed network intrusion detection systems cooperate with each other only with their own information. Unlike this, in our proposed system, a worm detection system on a network in which worms select targets and a worm detection system on a network in which worms propagate themselves cooperate with each other with the direction-aware information in terms of worm's lifecycle. The direction-aware information includes the moving direction of worms and the service port attacked by worms. In this way, we can not only reduce false positive rate of the system but also prevent worms from propagating themselves across the Internet through dispersing the confirmed worm signature.

• 한국시뮬레이션학회논문지
• /
• 제12권4호
• /
• pp.25-40
• /
• 2003

With the growing usage of the networks, the world-wide Internet has become the main means to exchange data and carry out transactions. It has also become the main means to attack hosts. To solve the security problems which occur in the network such as Internet, we import software products of network security elements like an IDS (Intrusion Detection System) and a firewall. In this paper, we have designed and constructed the general simulation environment of network security model composed of multiple IDSes and a firewall which coordinate by CNP (Contract Net Protocol) for the effective detection of the intrusion. The CNP, the methodology for efficient integration of computer systems on heterogeneous environment such as distributed systems, is essentially a collection of agents, which cooperate to resolve a problem. Command console in the CNP is a manager who controls the execution of agents or a contractee, who performs intrusion detection. In the network security model, each model of simulation environment is hierarchically designed by DEVS(Discrete Event system Specification) formalism. The purpose of this simulation is that the application of rete pattern-matching algorithm speeds up the inference cycle phases of the intrusion detection expert system and we evaluate the characteristics and performance of CNP architecture with rete pattern-matching algorithm.