• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.6 no.10
• /
• pp.2750-2763
• /
• 2012

The Domain Name System (DNS) is a critical Internet infrastructure that provides name to address mapping services. In the past decade, Denial-of-Service (DoS) attacks have targeted the DNS infrastructure and threaten to disrupt this critical service. While the flooding DoS attacks may be alleviated by the DNS caching mechanism, we show in this paper that flooding DoS attacks utilizing name error queries is capable of bypassing the cache of resolvers and thereby impose overwhelming flooding attacks on the name servers. We analyze the impacts of such DoS attacks on both name servers and resolvers, which are further illustrated by May 19 China's DNS Collapse. We also propose the detection and defense approaches for protecting DNS servers from such DoS attacks. In the proposal, the victim zones and attacking clients are detected through monitoring the number of corresponding responses maintained in the negative cache. And the attacking queries can be mitigated by the resolvers with a sample proportion adaptive to the percent of queries for the existent domain names. We assess risks of the DoS attacks by experimental results. Measurements on the request rate of DNS name server show that this kind of attacks poses a substantial threat to the current DNS service.

• KNOM Review
• /
• v.23 no.1
• /
• pp.10-17
• /
• 2020

As the threat of Distributed Denial-of-Service attacks that exploit weakly secure IoT devices has spread, research on source-side Denial-of-Service attack detection is being activated to quickly detect the attack and the location of attacker. In addition, a collaborative source-side attack detection technique that shares detection results of source-side networks located at individual sites is also being activated to overcome regional limitations of source-side detection. In this paper, we evaluate the performance of a collaborative source-side DDoS attack detection using statistical weights. The statistical weight is calculated based on the detection rate and false positive rate corresponding to the time zone of the individual source-side network. By calculating weighted sum of the source-side DoS attack detection results from various sites, the proposed method determines whether a DDoS attack happens. As a result of the experiment based on actual DNS request to traffic, it was confirmed that the proposed technique reduces false positive rate 2% while maintaining a high attack detection rate.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.10a
• /
• pp.697-699
• /
• 2003

최근의 네트워크 공격의 주류는 DoS (denial-of-service)와 DDoS (distributed DoS) 공격이다. 이러한 공격들은 공격자가 침입 대상 시스템의 자원을 완전히 소모시켜서 시스템이 정상적인 서비스를 할 수 없도록 하는 것이다. 각 시스템의 관리자들은 이러한 침입이나 공격을 막기 위한 방편 중에 하나로 IDS(Intrusion detection system)를 사용하고 있다. 그러나 IDS의 높은 false-positive(정상적인 사용을 공격으로 잘못 판단하는 경우)의 발생빈도는 심각한 문제점 중의 하나는 이다. 이런 false-positive의 발생빈도를 줄이고자 본 논문에서는 한번의 판단만으로 연결(connection)을 차단시키지 않고, trust라는 개념을 도입하여 trust의 값에 따라서 사용자에게 차등 서비스를 제공하는 기법을 제안한다. 즉, trust를 이용하는 기법은 각 사용자를 한번에 공격자인지 일반 사용자인지 결정하지 않고, 한 번 더 검사하여 false-positive의 발생빈도를 감소시키는 기법이다.

• Journal of Multimedia Information System
• /
• v.5 no.3
• /
• pp.189-194
• /
• 2018

In this paper, we propose the drowsiness detection method for car driver. This paper determines whether or not the driver's eyes are closed using the depth and infrared videos. The proposed method has the advantage to detect drowsiness without being affected by illumination. The proposed method detects a face in the depth picture by using the fact that the nose is closest to the camera. The driver's eyes are detected by using the extraction of harr-like feature within the detected face region. This method considers to be drowsiness if eyes are closed for a certain period of time. Simulation results show the drowsiness detection performance for the proposed method.

• IEMEK Journal of Embedded Systems and Applications
• /
• v.17 no.1
• /
• pp.41-49
• /
• 2022

This paper proposes a novel lane detection algorithm based on inverse perspective transformation and machine learning in lightweight embedded system. The inverse perspective transformation method is presented for obtaining a bird's-eye view of the scene from a perspective image to remove perspective effects. This method requires only the internal and external parameters of the camera without a homography matrix with 8 degrees of freedom (DoF) that maps the points in one image to the corresponding points in the other image. To improve the accuracy and speed of lane detection in complex road environments, machine learning algorithm that has passed the first classifier is used. Before using machine learning, we apply a meaningful first classifier to the lane detection to improve the detection speed. The first classifier is applied in the bird's-eye view image to determine lane regions. A lane region passed the first classifier is detected more accurately through machine learning. The system has been tested through the driving video of the vehicle in embedded system. The experimental results show that the proposed method works well in various road environments and meet the real-time requirements. As a result, its lane detection speed is about 3.85 times faster than edge-based lane detection, and its detection accuracy is better than edge-based lane detection.

• Journal of Sensor Science and Technology
• /
• v.21 no.1
• /
• pp.39-45
• /
• 2012

Recently the convergence of healthcare technology is used for daily life healthcare monitoring. Cardiac arrhythmia is presented by the state of the heart irregularity. Abnormal heart's electrical signal pathway or heart's tissue disorder could be the cause of cardiac arrhythmia. Fatal arrhythmia could put patient's life at risk. Therefore arrhythmia detection is very important. Previous studies on the detection of arrhythmia in various ECG analysis and classification methods had been carried out. In this paper, an ECG signal processing techniques to detect abnormal ECG based on DTW minimum accumulation distance through the template matching for normalized data and variable threshold method for ECG R-peak detection. Signal processing techniques able to determine the occurrence of normal ECG and abnormal ECG. Abnormal ECG detection algorithm using DTW minimum accumulation distance method is performed using MITBIH database for performance evaluation. Experiment result shows the average percentage accuracy of using the propose method for Rpeak detection is 99.63 % and abnormal detection is 99.60 %.

• Research in Plant Disease
• /
• v.16 no.2
• /
• pp.125-128
• /
• 2010

Bacterial black spot disease of prune fruit (Prunus salicina cv. formosa) has outbroke around major prune production area, Gimcheon, Euiseong and Gunwi in Gyungbuk province and has caused severe economic loss. Integrons PCR primer was designed along with sample pre-incubation and nested PCR method to enhance detection sensitivity for early detection of bacteria in fields. Designed integrons PCR primer successfully detected Xanthomonas arboricola pv. pruni from field collected samples, fruit, leaf, branch and even in raindrop collected from prune orchard. Pre-incubation along with nested PCR enhanced sensitivity to detect X. arboricola pv. pruni from seemingly healthy looking, symptomless branches. Designed integrons PCR can be used in prune nursery fields and in plant quarantine practice for the detection of X. arboricola pv. pruni.

• Journal of Korea Multimedia Society
• /
• v.16 no.6
• /
• pp.678-688
• /
• 2013

Different Different from a single attack, in DDoS Attacks, the botnets that are distributed on network initiate attacks against the target server simultaneously. In such cases, it is difficult to take an action while denying the access of packets that are regarded as DDoS since normal user's convenience should also be considered at the target server. Taking these considerations into account, the DDoS botnet detection system that can reduce the strain on the target server by detecting DDoS attacks on each user network basis, and then lets the network administrator to take actions that reduce overall scale of botnets, has been implemented in this study. The DDoS botnet detection system proposed by this study implemented the program which detects attacks based on the database composed of faults and abnormalities collected through analyzation of hourly attack traffics. The presence of attack was then determined using the threshold of current traffic calculated with the standard deviation and the mean number of packets. By converting botnet-based detection method centering around the servers that become the targets of attacks to the network based detection, it was possible to contemplate aggressive defense concept against DDoS attacks. With such measure, the network administrator can cut large scale traffics of which could be referred as the differences between DDoS and DoS attacks, in advance mitigating the scale of botnets. Furthermore, we expect to have an effect that can considerably reduce the strain imposed on the target servers and the network loads of routers in WAN communications if the traffic attacks can be blocked beforehand in the network communications under the router equipment level.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.5 no.7
• /
• pp.1301-1307
• /
• 2001

Video retrieval system must offer representation frame list to do to do play from point that user wants. Representation frame list can get though cut detection point exactly. This paper dismembers frame to fixed block to cut detection point, and compare same block histogram cost of next time frame. If result that compare does not exceed thresold, detect next frame to cutting.

• ETRI Journal
• /
• v.42 no.3
• /
• pp.433-445
• /
• 2020

A denial-of-service (DoS) attack is a serious attack that targets web applications. According to Imperva, DoS attacks in the application layer comprise 60% of all the DoS attacks. Nowadays, attacks have grown into application- and business-layer attacks, and vulnerability-analysis tools are unable to detect business-layer vulnerabilities (logic-related vulnerabilities). This paper presents the business-layer dynamic application security tester (BLDAST) as a dynamic, black-box vulnerability-analysis approach to identify the business-logic vulnerabilities of a web application against DoS attacks. BLDAST evaluates the resiliency of web applications by detecting vulnerable business processes. The evaluation of six widely used web applications shows that BLDAST can detect the vulnerabilities with 100% accuracy. BLDAST detected 30 vulnerabilities in the selected web applications; more than half of the detected vulnerabilities were new and unknown. Furthermore, the precision of BLDAST for detecting the business processes is shown to be 94%, while the generated user navigation graph is improved by 62.8% because of the detection of similar web pages.