• 전력전자학회논문지
• /
• 제27권2호
• /
• pp.100-105
• /
• 2022

This paper applies the arc detection algorithm to prevent the false detection in photo voltaic series arc detection circuit, which is required not only to detect the series arc quickly, but also not falsely detect the arc for the non-arc noise. For this purpose, this study proposes a rapid and preventive false detection method of single peak noise and short noise signals. First, to prevent false detection by single peak noise, Discrete wavelet transform (DWT)-based characteristic parameters are applied to determine the shape and the amplitude of the noise. In addition, arc fault detection within a few milliseconds is performed with the DWT iterative algorithm to quickly prevent false detection for short noise signals, considering the continuity of serial arc noise. Thus, the method operates not only to detect series arc, but also to avoid false arc detection for peak and short noises. The proposed algorithm is applied to real-time serial arc detection circuit based on the TMS320F28335 DSP. The serial arc detection and peak noise filtering performances are verified in the built simulated arc test facility. Furthermore, the filtering performance of short noise generated through DC switch operation is confirmed.

• 정보처리학회논문지C
• /
• 제13C권3호
• /
• pp.295-302
• /
• 2006

침입탐지 시스템은 실시간으로 공격행위에 대하여 다량의 경보를 기록한다. 이들 경보 중에는 실제 공격 경보뿐만 아니라 공격으로 잘못 탐지하여 발생된 오 경보들도 있다. 오 경보는 침입탐지 시스템의 효율성을 저하시키는 주요요인이 되므로, 이 논문에서는 오경보 분석을 위한 프레임워크를 제안한다. 또한 지속적으로 증가하는 오 경보를 분석하기 위해 점진적 데이터 마이닝 기법을 적용한다. 제안한 오경보 분석 프레임워크는 GUI, DB Manager, Alert Preprocessor, False Alarm Analyzer로 구성되어 있다. 우리는 실험을 통해 증가하는 오경보를 분석하고, 분석된 오경보 규칙을 침입탐지 시스템에 적용하여 오 경보가 감소됨을 확인하였다.

• 대한원격탐사학회:학술대회논문집
• /
• 대한원격탐사학회 2004년도 Proceedings of ISRS 2004
• /
• pp.716-718
• /
• 2004

The false alarm data in intrusion detection systems are divided into false positive and false negative. The false positive makes bad effects on the performance of intrusion detection system. And the false negative makes bad effects on the efficiency of intrusion detection system. Recently, the most of works have been studied the data mining technique for analysis of alert data. However, the false alarm data not only increase data volume but also change patterns of alert data along the time line. Therefore, we need a tool that can analyze patterns that change characteristics when we look for new patterns. In this paper, we focus on the false positives and present a framework for analysis of false alarm pattern from the alert data. In this work, we also apply incremental data mining techniques to analyze patterns of false alarms among alert data that are incremental over the time. Finally, we achieved flexibility by using dynamic support threshold, because the volume of alert data as well as included false alarms increases irregular.

• International Journal of Fuzzy Logic and Intelligent Systems
• /
• 제6권2호
• /
• pp.173-177
• /
• 2006

This paper investigates the asymmetric costs of false errors to enhance the detection systems performance. The proposed method utilizes the network model to consider the cost ratio of false errors. By comparing false positive errors with false negative errors this scheme achieved better performance on the view point of both security and system performance objectives. The results of our empirical experiment show that the network model provides high accuracy in detection. In addition, the simulation results show that effectiveness of probe detection is enhanced by considering the costs of false errors.

• Journal of the Korean Society for Industrial and Applied Mathematics
• /
• 제17권1호
• /
• pp.47-54
• /
• 2013

This work deals with automatic motion detection for with surveillance tracking that aims to provide high-lighting movable objects which is discriminated from moving backgrounds such as moving trees, etc. For this aim, we perform a false background region detection together with an initial foreground detection. The false background detection detects the moving backgrounds, which become eliminated from the initial foreground detection. This false background detection is done by performing the bimodal segmentation on a deformed image, which is constructed using the information of the dominant colors in the background.

• 한국정보과학회논문지:정보통신
• /
• 제31권2호
• /
• pp.171-178
• /
• 2004

포트 스캐닝 탐지 시스템은 “False Positive”(실제 공격이 아닌데 공격이라고 탐지, 오탐지)와 “False Negative”(실제 공격인데 공격이 아니라고 탐지, 미탐지)가 낮아야 하는 등의 시스템 성능에 관한 요구사항과, 해당 탐지 시스템을 활용한 보안관리가 용이해야 하는 등의 사용자 친화적인 요구사항을 만족할 필요가 있다. 그러나 공개되어 있는 실시간 스캔 탐지 시스템은 False Positive가 높고 다양한 스캔 기법에 대한 탐지가 잘 이루어지지 않고 있다. 또한 실시간 스캔 탐지 시스템의 대부분이 명령어 기반으로 이루어져 있기 때문에 이률 활용하여 시스템 보안 관리를 수행하는데 많은 어려움이 있다. 따라서 본 논문에서는 새로운 필터 룰 집합의 적용에 의해 포트 스캐닝 기법 기반의 다양한 공격을 탐지 할 수 있고, 공격자의 행동 패턴으로부터 유도된 ABP-Rule의 적용에 의해 False Positive를 최소화할 수 있는 실시간 스캔 탐지 시스템(TkRTSD)을 제안한다. 또한 Tcl/Tk를 이용하여 GUI환경을 구축함으로써 사용자가 쉽게 보안관리를 할 수 있는 사용자 친화적인 탐지 시스템을 제안한다.

• International Journal of Fuzzy Logic and Intelligent Systems
• /
• 제8권4호
• /
• pp.316-321
• /
• 2008

Advanced computer network technology enables computers to be connected in an open network environment. Despite the growing numbers of security threats to networks, most intrusion detection identifies security attacks mainly by detecting misuse using a set of rules based on past hacking patterns. This pattern matching has a high rate of false positives and can not detect new hacking patterns, which makes it vulnerable to previously unidentified attack patterns and variations in attack and increases false negatives. Intrusion detection and analysis technologies are thus required. This paper investigates the asymmetric costs of false errors to enhance the performances the detection systems. The proposed method utilizes the network model to consider the cost ratio of false errors. By comparing false positive errors with false negative errors, this scheme achieved better performance on the view point of both security and system performance objectives. The results of our empirical experiment show that the network model provides high accuracy in detection. In addition, the simulation results show that effectiveness of anomaly traffic detection is enhanced by considering the costs of false errors.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제6권7호
• /
• pp.1874-1893
• /
• 2012

An approach to detect abnormal activities based on reputations created individually by each node is vulnerable to a false accusation since intrusion detection in ad-hoc networks is done in a distributed and cooperative manner. Detection of false accusation is considered important because the efficiency or survivability of the network can be degraded severely if normal nodes were excluded from the network by being considered as abnormal ones in the intrusion detection process. In this paper, we propose an improved reputation-based intrusion detection technique to efficiently detect and manage false accusations in ad-hoc networks. Additionally, we execute simulations of the proposed technique to analyze its performance and feasibility to be implemented in a real environment.

• Journal of Communications and Networks
• /
• 제12권1호
• /
• pp.74-85
• /
• 2010

For the purpose of compromising hosts, attackers including infected hosts initially perform a portscan using IP addresses in order to find vulnerable hosts. Considerable research related to portscan detection has been done and many algorithms have been proposed and implemented in the network intrusion detection system (NIDS). In order to distinguish portscanners from remote hosts, most portscan detection algorithms use a fixed threshold that is manually managed by the network manager. Because the threshold is a constant, even though the network environment or the characteristics of traffic can change, many false positives and false negatives are generated by NIDS. This reduces the efficiency of NIDS and imposes a high processing burden on a network management system (NMS). In this paper, in order to address this problem, we propose an automatic portscan detection system using an fast increase slow decrease (FISD) scheme, that will automatically and adaptively set the threshold based on statistical data for traffic during prior time periods. In particular, we focus on reducing false positives rather than false negatives, while the threshold is adaptively set within a range between minimum and maximum values. We also propose a new portscan detection algorithm, rate of increase in the number of failed connection request (RINF), which is much more suitable for our system and shows better performance than other existing algorithms. In terms of the implementation, we compare our scheme with other two simple threshold estimation methods for an adaptive threshold setting scheme. Also, we compare our detection algorithm with other three existing approaches for portscan detection using a real traffic trace. In summary, we show that FISD results in less false positives than other schemes and RINF can fast and accurately detect portscanners. We also show that the proposed system, including our scheme and algorithm, provides good performance in terms of the rate of false positives.

• 정보보호학회논문지
• /
• 제16권6호
• /
• pp.111-121
• /
• 2006

인터넷이 빠르게 성장함에 따라 네트워크 공격기법이 변화되고 새로운 공격 형태가 나타나고 있다. 네트워크상에서 알려진 침입의 탐지는 효율적으로 수행되고 있으나 알려지지 않은 침입에 대해서는 오탐지(false negative)나 과탐지(false positive)가 너무 높게 나타난다. 또한, 네트워크상에서 지속적으로 처리되는 대량의 패킷에 대하여 실시간적인 탐지와 새로운 침입 유형에 대한 대응방법과 인지능력에 한계가 있다. 따라서 다양한 대량의 트래픽에 대해서 탐지율을 높이고 과탐지를 감소할 수 있는 방법이 필요하다. 본 논문에서는 네트워크 기반의 이상 침입 탐지 시스템에서 과탐지를 감소하고, 침입 탐지 능력을 향상시키기 위하여 다차원 연관 규칙 마이닝과 수정된 부정 선택 알고리즘(Negative Selection Algorithm)을 결합한 다중 레벨 이상 침입 탐지 기술을 제안한다. 제안한 알고리즘의 성능 평가를 위하여 기존의 이상 탐지 알고리즘과 제안된 알고리즘을 수행하여, 각각의 과탐지율을 평가, 제시하였다.