• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.16 no.6
• /
• pp.2115-2130
• /
• 2022

With the development of over-the-top (OTT) services, the demand for content is increasing, and you can easily and conveniently acquire various content in the online environment. As a result, copyrighted content can be easily copied and distributed, resulting in serious copyright infringement. Some special forms of online service providers (OSP) use filtering-based technologies to protect copyrights, but illegal uploaders use methods that bypass traditional filters. Uploading with a title that bypasses the filter cannot use a similar search method to detect illegal content. In this paper, we propose a technique for profiling the Heavy Uploader by normalizing the bypassed content title and efficiently detecting illegal content. First, the word is extracted from the normalized title and converted into a bit-array to detect illegal works. This Bloom Filter method has a characteristic that there are false positives but no false negatives. The false positive rate has a trade-off relationship with processing performance. As the false positive rate increases, the processing performance increases, and when the false positive rate decreases, the processing performance increases. We increased the detection rate by directly comparing the word to the result of increasing the false positive rate of the Bloom Filter. The processing time was also as fast as when the false positive rate was increased. Afterwards, we create a function that includes information about overall piracy and identify clustering-based heavy uploaders. Analyze the behavior of heavy uploaders to find the first uploader and detect the source site.

• Journal of the Korea Society for Simulation
• /
• v.19 no.4
• /
• pp.139-149
• /
• 2010

Internet was designed for network scalability and best-effort service which makes all hosts connected to Internet to be vulnerable against attack. Many papers have been proposed about attack detection algorithms against the attack using IP spoofing and DoS/DDoS attack. Purpose of DoS/DDoS attack is achieved in short period after the attack begins. Therefore, DoS/DDoS attack should be detected as soon as possible. Attack detection algorithms using false alarm rates consist of the false negative rate and the false positive rate. Moreover, they are important metrics to evaluate the attack detections. In this paper, we analyze the performance of the attack detection algorithms using the impact of false negative rate and false positive rate variation to the normal traffic and the attack traffic by simulations. As the result of this, we find that the number of passed attack packets is in the proportion to the false negative rate and the number of passed normal packets is in the inverse proportion to the false positive rate. We also analyze the limits of attack detection due to the relation between the false negative rate and the false positive rate. Finally, we propose a solution to minimize the limits of attack detection algorithms by defining the network state using the ratio between the number of packets classified as attack packets and the number of packets classified as normal packets. We find the performance of attack detection algorithm is improved by passing the packets classified as attacks.

• IEIE Transactions on Smart Processing and Computing
• /
• v.4 no.3
• /
• pp.163-168
• /
• 2015

Many IP address lookup approaches employ Bloom filters to obtain a high-speed search performance. Especially, it has been recently studied that the search performance of trie-based algorithms can be significantly improved by adding Bloom filters. In such algorithms, the number of trie accesses can be greatly reduced because Bloom filters can determine whether a node exists in a trie without actually accessing the trie. Bloom filters do not have false negatives but have false positives. False positives can lead to unnecessary trie accesses. The false positive rate must thus be reduced to enhance the performance of lookup algorithms applying Bloom filters. One important characteristic of trie-based algorithms is that all the ancestors of a node are also stored. The proposed algorithm utilizes this characteristic in reducing the false positive rate of a Bloom filter without increasing the size of the memory for the Bloom filter. When a Bloom filter produces a positive result for a node of a trie, we propose to check whether the ancestors of the node are also positives. Because Bloom filters have no false negatives, the negatives of any of the ancestors mean that the positive of the node is false. In other words, we propose to use more Bloom filter queries to reduce the false positive rate of a Bloom filter in trie-based algorithms. Simulation results show that querying one ancestor of a node can reduce the false positive rate by up to 67% with exactly the same architecture and the same memory requirement. The proposed approach can be applied to other trie-based algorithms employing Bloom filters.

• Communications for Statistical Applications and Methods
• /
• v.28 no.2
• /
• pp.161-169
• /
• 2021

The two-dimensional confusion matrix used in credit assessment, biostatistics, and many other fields consists of true positive, true negative, false positive, and false negative. Their rates, such as the true positive rate (TPR), true negative rate (TNR), false positive rate, and false negative rate, can be applied to measure its accuracy. In this study, we propose the TPR-TNR plot, a graphical method that can geometrically describe and explain these rates based on the confusion matrix. The proposed TPR-TNR plot consists of two right-angled triangles. We obtain that the TPR and TNR describe the acute angles of right-angled triangles in the plot. These acute angles can be used to determine optimal thresholds corresponding to lots of accuracy measures.

• Journal of KIISE:Information Networking
• /
• v.31 no.2
• /
• pp.171-178
• /
• 2004

Port scanning detection systems should rather satisfy a certain level of the requirement for system performance like a low rate of “False Positive” and “False Negative”, and requirement for convenience for users to be easy to manage the system security with detection systems. However, public domain Real Time Scan Detection Systems have high rate of false detection and have difficulty in detecting various scanning techniques. In addition, as current real time scan detection systems are based on command interface, the systems are poor at user interface and thus it is difficult to apply them to the system security management. Hence, we propose TkRTSD(Tcl/Tk Real Time Scan Detection System) that is able to detect various scan attacks based on port scanning techniques by applying a set of new filter rules, and minimize the rate of False Positive by applying proposed ABP-Rules derived from attacker's behavioral patterns. Also a GUI environment for TkRTSD is implemented by using Tcl/Tk for user's convenience of managing network security.

• Journal of radiological science and technology
• /
• v.44 no.6
• /
• pp.635-643
• /
• 2021

The results of empirical researches on the diagnosis of lung cancer are insufficient, so it is limited to objectively judge the clinical possibility and utilization according to the accuracy of diagnosis. Thus, this study retrospectively analyzed the lung cancer diagnostic performance of PET-MRI (Positron Emission Tomography-Magnetic Resonance Imaging) by using the decision matrix. This study selected and experimented total 165 patients who received both hematological CEA (Carcinoembryonic Antigen) test and hybrid PET-MRI (¹⁸F-FDG, 5.18 MBq/kg / Body TIM coil. VIVE-Dixon). After setting up the result of CEA (positive:>4 ㎍/ℓ. negative:<2.5㎍/ℓ) as golden data, the lung cancer was found in the image of PET-MRI, and then the SUV_max (positive:>4, negative:<1.5) was measured, and then evaluated the correlation and significance of results of relative diagnostic performance of PET-MRI compared to CEA through the statistical verification (t-test, P>0.05). Through this, the PET-MRI was analyzed as 96.29% of sensitivity, 95.23% of specificity, 3.70% of false negative rate, 4.76% of false positive rate, and 95.75% of accuracy. The false negative rate was 1.06% lower than the false positive rate. The PET-MRI that significant accuracy of diagnosis through high sensitivity and specificity, and low false negative rate and false positive rate of lung cancer, could acquire the fusion image of specialized soft tissue by combining the radio-pharmaceuticals with various sequences, so its clinical value and usefulness are regarded as latently sufficient.

• Tuberculosis and Respiratory Diseases
• /
• v.83 no.3
• /
• pp.211-217
• /
• 2020

The gold standard method for diagnosis of tuberculosis is the isolation of Mycobacterium tuberculosis through culture, but there is a probability of cross-contamination in simultaneous cultures of samples causing false-positives. This can result in delayed treatment of the underlying disease and drug side effects. In this paper, we reviewed studies on false-positive cultures of M. tuberculosis. Rate of occurrence, effective factors, and extent of false-positives were analyzed. Ways to identify and reduce the false-positives and management of them are critical for all laboratories. In most cases, false-positive is occurring in cases with only one positive culture but negative direct smear. The three most crucial factors in this regard are inappropriate technician function, contamination of reagents, and aerosol production. Thus, to reduce false-positives, good laboratory practice, as well as use of whole-genome sequencing or genotyping of all positive culture samples with a robust, extra pure method and rapid response, are essential for minimizing the rate of false-positives. Indeed, molecular approaches and epidemiological surveillance can provide a valuable tool besides culture to identify possible false positives.

• The Korean Journal of Nuclear Medicine
• /
• v.27 no.1
• /
• pp.81-87
• /
• 1993

Retrospective analysis of cholescintigraphy and ultrasonography was done in 76 patients with clinically suspected acute cholecystitis to assess the relative value of the two modalities. Excluding the Patients with obstructive jaundice, the overall results of cholescintigraphy(sensitivity 100%, specificity 95%, false positive rate 5%, false negative rate 0%, accuracy 97%) are nearly identical with or rather superior to those of the ultrasonography(sensitivity 94%, specificity 100%, false positive rate 0%, false negative rate 5%, accuracy 97%). We recommend the cholescintigraphy as the initial modality in patients with clinically suspected acute cholecystitis, and ultrasonography can be used in jaundiced patients to exclude the possibility of the false positive of cholescintigraphy.

• The Korean Journal of Cytopathology
• /
• v.7 no.2
• /
• pp.111-121
• /
• 1996

Fine needle aspiration cytology(FNAC) is preferred because of simplicity, safety, and reliability in the evaluation of patients with thyroid nodule or hyperplasia. However, there are a few limitations such as false-negative or false-positive cases and non-diagnostic material. To evaluate the usefulness of FNAC in thyroid lesions, we reviewed 704 FNAC cases of thyroid nodules from 1988 to 1994 at Soonchunhyang University Hospital. The results are as follows. 1. Among 704 FNAC cases of thyroid gland, 571(81.1%) cases were benign, 12(1.7%) were suspicious, 71(10.1%) were malignancy, and 50(7.1%) were material insufficiency. The cytologic diagnoses of the benign lesions included 168 cases of follicular neoplasm, 139 cases of adenomatous goiter, 162 cases of follicular lesion such as follicular neoplasm or adenomatous goiter, 61 cases of Hashimoto's thyroiditis, 13 cases of subacute thyroiditis, and 28 cases of colloidal nodule or benign nodule. The malignant lesions included 68 cases of papillary carcinona, two medullary carcinomas and a case of metastatic colon cancer. 2. The average number of cytologic smear slides was $4.12{\pm}1.81$ in material insufficiency and $5.63{\pm}1.79$ in diagnostic cases. This difference was statistically significant(p<0.00001). 3. Histological assessment of 150 cases revealed 2 false negative and 1 false positive cases. The false negative cases were a case of marked sclerosis in papillary carcinoma and an occult case of papillary carcinoma. The false positive case resulted from pseudo-ground glass nuclei due to marked dry artifact. 4. Comparison between the FNAC and the histologic diagnosis revealed that FNAC had a sensitivity of 93.5%, a specificity of 99.2%, a false negative rate of 6.6%, a false positive rate of 0.8%, and an overall diagnostic accuracy of 98.0%. Therefore, FNAC of thyroid gland is a very reliable diagnostic method with excellent accuracy rate.

• Communications for Statistical Applications and Methods
• /
• v.17 no.5
• /
• pp.679-688
• /
• 2010

Lee (2010) developed a confidence interval for the difference of binomial proportions in two doubly sampled data subject to false-positive errors. The confidence interval seems to be adequate for a general double sampling model subject to false-positive misclassification. However, in many applications, the false-positive error rates could be the same. On this note, the construction of asymptotic confidence interval is considered when the false-positive error rates are common. The coverage behaviors of nine likelihood based confidence intervals are examined. It is shown that the confidence interval based Rao score with the expected information has good performance in terms of coverage probability and expected width.