• 전자공학회논문지 IE
• /
• v.48 no.2
• /
• pp.61-70
• /
• 2011

IEEE 802.11 wireless network supports control frames like RTS/CTS(Request To Send / Clear To Send). Because they is defend to frame collection problems. It helps to solve the frame collection problem but decreases the throughput rate. Also, control frame makes False Node Problem. This problem is makes to other wireless nodes don't work and don't find channels in the same cell and near cells. We proposed a reformed new control frame for efficiency throughput rate and solution of False Node Problem. New control frame is to have added to 4 bytes of channel detection ability at the RTS frames. Channel detection ability supported to check channel at the wireless node start to transmit data frame, We expect that channel detection ability make prevent False Node Problem for increase to access number to channel. We perform comparative analysis in terms of delay(sec) and load(bits/sec) with reform RTS/CTS method which proves the efficiency of the proposed method.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.16 no.6
• /
• pp.111-121
• /
• 2006

As Internet lastly grows, network attack techniques are transformed and new attack types are appearing. The existing network-based intrusion detection systems detect well known attack, but the false-positive or false-negative against unknown attack is appearing high. In addition, The existing network-based intrusion detection systems is difficult to real time detection against a large network pack data in the network and to response and recognition against new attack type. Therefore, it requires method to heighten the detection rate about a various large dataset and to reduce the false-positive. In this paper, we propose method to reduce the false-positive using multi-level detection algorithm, that is combine the multidimensional Apriori algorithm and the modified Negative Selection algorithm. And we apply this algorithm in intrusion detection and, to be sure, it has a good performance.

• Journal of the Korea Society for Simulation
• /
• v.18 no.3
• /
• pp.83-90
• /
• 2009

Since wireless sensor networks are deployed in open environments, an attacker can physically capture some sensor nodes. Using information of compromised nodes, an attacker can launch false data injection attacks that report nonexistent events. False data can cause false alarms and draining the limited energy resources of the forwarding nodes. In order to detect and discard such false data during the forwarding process, various security solutions have been proposed. But since they are prevention-based solutions that involve additional operations, they would be energy-inefficient if the corresponding attacks are not launched. In this paper, we propose a detection method that can detect false data injection attacks without extra overheads. The proposed method is designed based on the signature of false data injection attacks that has been derived through simulation. The proposed method detects the attacks based on the number of reporting nodes, the correctness of the reports, and the variation in the number of the nodes for each event. We show the proposed method can detect a large portion of attacks through simulation.

• Journal of the Korea Society of Computer and Information
• /
• v.14 no.5
• /
• pp.65-75
• /
• 2009

The development of IT technology, Internet popularity is increasing geometrically. However, as its side effect, the intrusion behaviors such as information leakage for key system and infringement of computation network etc are also increasing fast. The attack traffic detection method which is suggested in this study utilizes the Snort, traditional NIDS, filters the packet with false positive among the detected attack traffics using Nmap information. Then, it performs the secondary filtering using nessus vulnerability information and finally performs correlation analysis considering appropriateness of management system, severity of signature and security hole so that it could reduce false positive alarm message as well as minimize the errors from false positive and as a result, it raised the overall attack detection results.

• Review of KIISC
• /
• v.13 no.1
• /
• pp.22-31
• /
• 2003

NIDS(Network Intrusion Detection System)은 실시간에 침입을 탐지하는 방안을 제시하는 시스템이지만 침입에 대한 탐지보다 더 많은 false positives 정보를 발생시키고 있다. 많은 false positives로부터 실제 침입을 찾아내는 것은 NIDS를 효율적으로 운영하기 위해서 필요한 새로운 일이 되고 있다. 본 논문은 NIDS에서의 false positive를 줄이기 위한 동적인 중요도 계산 모델을 제시한다. 제안된 방법은 공격의 4가지 특성(공격 의도, 공격자의 지식정도, 공격의 영향 그리고 공격의 성공 가능성)을 이용한다. 만약 공격자가 공격의 의도가 크거나 많은 지식을 가지고 있다면, 보통의 경우보다 공격에 성공할 확률이 높다. 또한 공격의 대상이 특정 공격에 취약하거나 특정 공격이 대상 시스템에 미칠 영향이 큰 경우에는 더욱더 중요한 공격이 된다고 할 수 있다. 이런 4가지의 특성을 이용하여 제시한 본 논문은 결과는 상당히 많은 부분에 대한 false positives를 줄이는 효과를 가지고 왔으며, 또한 공격에 대한 중요도의 정확성을 향상시켜서 NIDS의 관리를 쉽게 할 수 있도록 한다.

• ETRI Journal
• /
• v.35 no.1
• /
• pp.80-88
• /
• 2013

A passive infrared or pyroelectric infrared (PIR) sensor is mainly used to sense the existence of moving objects in an indoor environment. However, in an outdoor environment, there are often outbreaks of false alarms from environmental changes and other sources. Therefore, it is difficult to provide reliable detection outdoors. In this paper, two algorithms are proposed to reduce false alarms and provide trustworthy quality to surveillance systems. We gather PIR signals outdoors, analyze the collected data, and extract the target features defined as window energy and alarm duration. Using these features, we model target and false alarms, from which we propose two target decision algorithms: window energy detection and alarm duration detection. Simulation results using real PIR signals show the performance of the proposed algorithms.

• IE interfaces
• /
• v.21 no.1
• /
• pp.33-42
• /
• 2008

To analyze tens of thousands of alarms triggered by the intrusion detections systems (IDS) a day has been very time-consuming, requiring human administrators to stay alert for all time. But most of the alarms triggered by the IDS prove to be the false positives. If alarms could be correctly classified into the false positive and the false negative, then we could alleviate most of the burden of human administrators and manage the IDS far more efficiently. Therefore, we present a new approach based on attribute-oriented induction (AOI) to classify alarms into the false positive and the false negative. The experimental results show the proposed approach performs very well.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.6 no.7
• /
• pp.1874-1893
• /
• 2012

An approach to detect abnormal activities based on reputations created individually by each node is vulnerable to a false accusation since intrusion detection in ad-hoc networks is done in a distributed and cooperative manner. Detection of false accusation is considered important because the efficiency or survivability of the network can be degraded severely if normal nodes were excluded from the network by being considered as abnormal ones in the intrusion detection process. In this paper, we propose an improved reputation-based intrusion detection technique to efficiently detect and manage false accusations in ad-hoc networks. Additionally, we execute simulations of the proposed technique to analyze its performance and feasibility to be implemented in a real environment.

• Communications for Statistical Applications and Methods
• /
• v.17 no.5
• /
• pp.679-688
• /
• 2010

Lee (2010) developed a confidence interval for the difference of binomial proportions in two doubly sampled data subject to false-positive errors. The confidence interval seems to be adequate for a general double sampling model subject to false-positive misclassification. However, in many applications, the false-positive error rates could be the same. On this note, the construction of asymptotic confidence interval is considered when the false-positive error rates are common. The coverage behaviors of nine likelihood based confidence intervals are examined. It is shown that the confidence interval based Rao score with the expected information has good performance in terms of coverage probability and expected width.

• Journal of Satellite, Information and Communications
• /
• v.8 no.4
• /
• pp.1-5
• /
• 2013

CR(Cognitive Radio) technology is maximized frequency reuse using unused frequency band. Conventional cooperative spectrum sensing has fixed false alarms. so all cooperative user has equal threshold. This problem is caused degradation of detection probability. so we propose and analysis the system model that false alarm differential setting through CSI(channel state information) for resonable threshold. Simulation results show improvement of detection probability.