• Journal of information and communication convergence engineering
• /
• 제7권1호
• /
• pp.7-12
• /
• 2009

The advanced computer network and Internet technology enables connectivity of computers through an open network environment. Despite the growing numbers of security threats to networks, most intrusion detection identifies security attacks mainly by detecting misuse using a set of rules based on past hacking patterns. This pattern matching has a high rate of false positives and can not detect new hacking patterns, making it vulnerable to previously unidentified attack patterns and variations in attack and increasing false negatives. Intrusion detection and prevention technologies are thus required. We proposed a network based hybrid Probe Intrusion Detection model using Fuzzy cognitive maps (PIDuF) that detects intrusion by DoS (DDoS and PDoS) attack detection using packet analysis. A DoS attack typically appears as a probe and SYN flooding attack. SYN flooding using FCM model captures and analyzes packet information to detect SYN flooding attacks. Using the result of decision module analysis, which used FCM, the decision module measures the degree of danger of the DoS and trains the response module to deal with attacks. For the performance evaluation, the "IDS Evaluation Data Set" created by MIT was used. From the simulation we obtained the max-average true positive rate of 97.064% and the max-average false negative rate of 2.936%. The true positive error rate of the PIDuF is similar to that of Bernhard's true positive error rate.

• 한국전자거래학회지
• /
• 제21권1호
• /
• pp.105-118
• /
• 2016

게임회사는 온라인 게임을 서비스하는 과정에서 공격자의 공격을 자주 받는다. 본 논문에서는 온라인 게임에서 해킹 모듈을 탐지하는 방식 중 하나인 Signature 탐지 방식의 한계점을 분석하고, 이러한 문제점을 보완하기 위한 Scoring Signature 탐지 방식을 제안하고자 한다. Scoring Signature 탐지 방식은 알려지지 않은 해킹 공격에 대한 수집 및 탐지를 가능토록하여 기존의 Signature 탐지 방식보다 20배 이상의 탐지 성과로 나타났다. 이 방식을 기존에 탐지하고 있는 방식과 병행하여 적용하면 해킹 모듈 수집에 대한 번거로움을 최소화하고 미탐지로 인한 게임내의 해킹 모듈 사용도 크게 감소시킬 수 있을 것으로 판단된다.

• Journal of Information Technology Applications and Management
• /
• 제13권4호
• /
• pp.141-153
• /
• 2006

According to supply of super high way internet service, importance of security becomes more emphasizing. Therefore, flawless security solution is needed for blocking information outflow when we send or receive data. large enterprise and public organizations can react to this problem, however, small organization with limited work force and capital can't. Therefore they need to elevate their level of information security by improving their information security system without additional money. No hackings can be done without passing invasion blocking system which installed at the very front of network. Therefore, if we manage.isolation log effective, we can recognize hacking trial at the step of pre-detection. In this paper, it supports information security manager to execute isolation log analysis very effectively. It also provides isolation log analysis module which notifies hacking attack by analyzing isolation log.