• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제16권6호
• /
• pp.2115-2130
• /
• 2022

With the development of over-the-top (OTT) services, the demand for content is increasing, and you can easily and conveniently acquire various content in the online environment. As a result, copyrighted content can be easily copied and distributed, resulting in serious copyright infringement. Some special forms of online service providers (OSP) use filtering-based technologies to protect copyrights, but illegal uploaders use methods that bypass traditional filters. Uploading with a title that bypasses the filter cannot use a similar search method to detect illegal content. In this paper, we propose a technique for profiling the Heavy Uploader by normalizing the bypassed content title and efficiently detecting illegal content. First, the word is extracted from the normalized title and converted into a bit-array to detect illegal works. This Bloom Filter method has a characteristic that there are false positives but no false negatives. The false positive rate has a trade-off relationship with processing performance. As the false positive rate increases, the processing performance increases, and when the false positive rate decreases, the processing performance increases. We increased the detection rate by directly comparing the word to the result of increasing the false positive rate of the Bloom Filter. The processing time was also as fast as when the false positive rate was increased. Afterwards, we create a function that includes information about overall piracy and identify clustering-based heavy uploaders. Analyze the behavior of heavy uploaders to find the first uploader and detect the source site.

• 한국시뮬레이션학회논문지
• /
• 제19권4호
• /
• pp.139-149
• /
• 2010

인터넷은 확장성과 최선형 라우팅 서비스를 목적으로 설계되었기 때문에 보안상에 취약점을 가진다. 이에 IP spoofing과 DoS/DDoS 공격을 탐지하기 위한 다양한 공격 탐지 방법들이 제안되었다. DoS/DDoS 공격은 공격이 시작되고 짧은 시간 내에 목적을 이루기 때문에 공격 탐지 알고리즘들은 빠른 시간 내에 정확한 탐지를 하는 것이 중요하다. 공격 탐지 알고리즘들은 미탐지율과 오탐지율로 이루어진 오경고율을 가지며 공격 탐지 알고리즘의 성능을 평가하는 중요한 요소가 된다. 본 논문에서는 공격 탐지 알고리즘의 특징을 살펴보고 그 성능을 분석하였다. 공격 탐지 알고리즘의 성능은 미탐지율과 오탐지율을 변화시켰을 시, 공격 트래픽 및 일반 트래픽에 미치는 영향을 시뮬레이션을 통해 각각 분석하였다. 이를 통해 전송되는 공격 패킷의 수는 미탐지율에 비례하며, 전송되는 일반 패킷의 수는 일정 치 이하의 미탐지율과 오탐지율에 반비례하는 것을 확인하였다. 또 공격 탐지 알고리즘의 미탐지율 변화에 따른 오탐지율의 변화를 분석하여 미탐지율과 오탐지율의 관계를 도출하고 공격탐지 알고리즘의 한계를 분석하였다. 이러한 한계를 극복하기 위해 정확한 네트워크 상태를 판단하여 공격 탐지 알고리즘의 한계를 줄이고 성능을 개선하는 방안을 제안하였고 그 결과, 공격 탐지 알고리즘의 성능이 보다 향상됨을 확인하였다.

• IEIE Transactions on Smart Processing and Computing
• /
• 제4권3호
• /
• pp.163-168
• /
• 2015

Many IP address lookup approaches employ Bloom filters to obtain a high-speed search performance. Especially, it has been recently studied that the search performance of trie-based algorithms can be significantly improved by adding Bloom filters. In such algorithms, the number of trie accesses can be greatly reduced because Bloom filters can determine whether a node exists in a trie without actually accessing the trie. Bloom filters do not have false negatives but have false positives. False positives can lead to unnecessary trie accesses. The false positive rate must thus be reduced to enhance the performance of lookup algorithms applying Bloom filters. One important characteristic of trie-based algorithms is that all the ancestors of a node are also stored. The proposed algorithm utilizes this characteristic in reducing the false positive rate of a Bloom filter without increasing the size of the memory for the Bloom filter. When a Bloom filter produces a positive result for a node of a trie, we propose to check whether the ancestors of the node are also positives. Because Bloom filters have no false negatives, the negatives of any of the ancestors mean that the positive of the node is false. In other words, we propose to use more Bloom filter queries to reduce the false positive rate of a Bloom filter in trie-based algorithms. Simulation results show that querying one ancestor of a node can reduce the false positive rate by up to 67% with exactly the same architecture and the same memory requirement. The proposed approach can be applied to other trie-based algorithms employing Bloom filters.

• Communications for Statistical Applications and Methods
• /
• 제28권2호
• /
• pp.161-169
• /
• 2021

The two-dimensional confusion matrix used in credit assessment, biostatistics, and many other fields consists of true positive, true negative, false positive, and false negative. Their rates, such as the true positive rate (TPR), true negative rate (TNR), false positive rate, and false negative rate, can be applied to measure its accuracy. In this study, we propose the TPR-TNR plot, a graphical method that can geometrically describe and explain these rates based on the confusion matrix. The proposed TPR-TNR plot consists of two right-angled triangles. We obtain that the TPR and TNR describe the acute angles of right-angled triangles in the plot. These acute angles can be used to determine optimal thresholds corresponding to lots of accuracy measures.

• 한국정보과학회논문지:정보통신
• /
• 제31권2호
• /
• pp.171-178
• /
• 2004

포트 스캐닝 탐지 시스템은 “False Positive”(실제 공격이 아닌데 공격이라고 탐지, 오탐지)와 “False Negative”(실제 공격인데 공격이 아니라고 탐지, 미탐지)가 낮아야 하는 등의 시스템 성능에 관한 요구사항과, 해당 탐지 시스템을 활용한 보안관리가 용이해야 하는 등의 사용자 친화적인 요구사항을 만족할 필요가 있다. 그러나 공개되어 있는 실시간 스캔 탐지 시스템은 False Positive가 높고 다양한 스캔 기법에 대한 탐지가 잘 이루어지지 않고 있다. 또한 실시간 스캔 탐지 시스템의 대부분이 명령어 기반으로 이루어져 있기 때문에 이률 활용하여 시스템 보안 관리를 수행하는데 많은 어려움이 있다. 따라서 본 논문에서는 새로운 필터 룰 집합의 적용에 의해 포트 스캐닝 기법 기반의 다양한 공격을 탐지 할 수 있고, 공격자의 행동 패턴으로부터 유도된 ABP-Rule의 적용에 의해 False Positive를 최소화할 수 있는 실시간 스캔 탐지 시스템(TkRTSD)을 제안한다. 또한 Tcl/Tk를 이용하여 GUI환경을 구축함으로써 사용자가 쉽게 보안관리를 할 수 있는 사용자 친화적인 탐지 시스템을 제안한다.

• 대한방사선기술학회지:방사선기술과학
• /
• 제44권6호
• /
• pp.635-643
• /
• 2021

The results of empirical researches on the diagnosis of lung cancer are insufficient, so it is limited to objectively judge the clinical possibility and utilization according to the accuracy of diagnosis. Thus, this study retrospectively analyzed the lung cancer diagnostic performance of PET-MRI (Positron Emission Tomography-Magnetic Resonance Imaging) by using the decision matrix. This study selected and experimented total 165 patients who received both hematological CEA (Carcinoembryonic Antigen) test and hybrid PET-MRI (¹⁸F-FDG, 5.18 MBq/kg / Body TIM coil. VIVE-Dixon). After setting up the result of CEA (positive:>4 ㎍/ℓ. negative:<2.5㎍/ℓ) as golden data, the lung cancer was found in the image of PET-MRI, and then the SUV_max (positive:>4, negative:<1.5) was measured, and then evaluated the correlation and significance of results of relative diagnostic performance of PET-MRI compared to CEA through the statistical verification (t-test, P>0.05). Through this, the PET-MRI was analyzed as 96.29% of sensitivity, 95.23% of specificity, 3.70% of false negative rate, 4.76% of false positive rate, and 95.75% of accuracy. The false negative rate was 1.06% lower than the false positive rate. The PET-MRI that significant accuracy of diagnosis through high sensitivity and specificity, and low false negative rate and false positive rate of lung cancer, could acquire the fusion image of specialized soft tissue by combining the radio-pharmaceuticals with various sequences, so its clinical value and usefulness are regarded as latently sufficient.

• Tuberculosis and Respiratory Diseases
• /
• 제83권3호
• /
• pp.211-217
• /
• 2020

The gold standard method for diagnosis of tuberculosis is the isolation of Mycobacterium tuberculosis through culture, but there is a probability of cross-contamination in simultaneous cultures of samples causing false-positives. This can result in delayed treatment of the underlying disease and drug side effects. In this paper, we reviewed studies on false-positive cultures of M. tuberculosis. Rate of occurrence, effective factors, and extent of false-positives were analyzed. Ways to identify and reduce the false-positives and management of them are critical for all laboratories. In most cases, false-positive is occurring in cases with only one positive culture but negative direct smear. The three most crucial factors in this regard are inappropriate technician function, contamination of reagents, and aerosol production. Thus, to reduce false-positives, good laboratory practice, as well as use of whole-genome sequencing or genotyping of all positive culture samples with a robust, extra pure method and rapid response, are essential for minimizing the rate of false-positives. Indeed, molecular approaches and epidemiological surveillance can provide a valuable tool besides culture to identify possible false positives.

• 대한핵의학회지
• /
• 제27권1호
• /
• pp.81-87
• /
• 1993

Retrospective analysis of cholescintigraphy and ultrasonography was done in 76 patients with clinically suspected acute cholecystitis to assess the relative value of the two modalities. Excluding the Patients with obstructive jaundice, the overall results of cholescintigraphy(sensitivity 100%, specificity 95%, false positive rate 5%, false negative rate 0%, accuracy 97%) are nearly identical with or rather superior to those of the ultrasonography(sensitivity 94%, specificity 100%, false positive rate 0%, false negative rate 5%, accuracy 97%). We recommend the cholescintigraphy as the initial modality in patients with clinically suspected acute cholecystitis, and ultrasonography can be used in jaundiced patients to exclude the possibility of the false positive of cholescintigraphy.

• 대한세포병리학회지
• /
• 제7권2호
• /
• pp.111-121
• /
• 1996

Fine needle aspiration cytology(FNAC) is preferred because of simplicity, safety, and reliability in the evaluation of patients with thyroid nodule or hyperplasia. However, there are a few limitations such as false-negative or false-positive cases and non-diagnostic material. To evaluate the usefulness of FNAC in thyroid lesions, we reviewed 704 FNAC cases of thyroid nodules from 1988 to 1994 at Soonchunhyang University Hospital. The results are as follows. 1. Among 704 FNAC cases of thyroid gland, 571(81.1%) cases were benign, 12(1.7%) were suspicious, 71(10.1%) were malignancy, and 50(7.1%) were material insufficiency. The cytologic diagnoses of the benign lesions included 168 cases of follicular neoplasm, 139 cases of adenomatous goiter, 162 cases of follicular lesion such as follicular neoplasm or adenomatous goiter, 61 cases of Hashimoto's thyroiditis, 13 cases of subacute thyroiditis, and 28 cases of colloidal nodule or benign nodule. The malignant lesions included 68 cases of papillary carcinona, two medullary carcinomas and a case of metastatic colon cancer. 2. The average number of cytologic smear slides was $4.12{\pm}1.81$ in material insufficiency and $5.63{\pm}1.79$ in diagnostic cases. This difference was statistically significant(p<0.00001). 3. Histological assessment of 150 cases revealed 2 false negative and 1 false positive cases. The false negative cases were a case of marked sclerosis in papillary carcinoma and an occult case of papillary carcinoma. The false positive case resulted from pseudo-ground glass nuclei due to marked dry artifact. 4. Comparison between the FNAC and the histologic diagnosis revealed that FNAC had a sensitivity of 93.5%, a specificity of 99.2%, a false negative rate of 6.6%, a false positive rate of 0.8%, and an overall diagnostic accuracy of 98.0%. Therefore, FNAC of thyroid gland is a very reliable diagnostic method with excellent accuracy rate.

• Communications for Statistical Applications and Methods
• /
• 제17권5호
• /
• pp.679-688
• /
• 2010

Lee (2010) developed a confidence interval for the difference of binomial proportions in two doubly sampled data subject to false-positive errors. The confidence interval seems to be adequate for a general double sampling model subject to false-positive misclassification. However, in many applications, the false-positive error rates could be the same. On this note, the construction of asymptotic confidence interval is considered when the false-positive error rates are common. The coverage behaviors of nine likelihood based confidence intervals are examined. It is shown that the confidence interval based Rao score with the expected information has good performance in terms of coverage probability and expected width.