• The Transactions of the Korea Information Processing Society
• /
• v.6 no.12
• /
• pp.3606-3612
• /
• 1999

System(IDS) hasn't Protection capability for various security attacks perfectly. Because, It is probably affected by IDS's workload caused by treating all kind of the characteristics and attack patterns of system and can't probe all of the attack types being intelligently different with attack patterns. In this paper, we propose a new taxonomy criteria about DoS(denial of service attacks) to make more efficient and new real time probing system. It's started with an idea that most of the goal oriented systems make the state of system operation more unambiguous than general purpose system. A new event caused the state of the system operation to change and classifying a category of the new events may contribute to design the IDS.

• KIPS Transactions on Software and Data Engineering
• /
• v.9 no.12
• /
• pp.411-418
• /
• 2020

In the field of information security, IDS(Intrusion Detection System) is normally classified in two different categories: signature-based IDS and anomaly-based IDS. Many studies in anomaly-based IDS have been conducted that analyze network traffic data generated in cyberspace by machine learning algorithms. In this paper, we studied pre-processing methods to overcome performance degradation problems cashed by rare classes. We experimented classification performance of a Machine Learning algorithm by reconstructing data set based on rare classes and semi rare classes. After reconstructing data into three different sets, wrapper and filter feature selection methods are applied continuously. Each data set is regularized by a quantile scaler. Depp neural network model is used for learning and validation. The evaluation results are compared by true positive values and false negative values. We acquired improved classification performances on all of three data sets.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.17 no.2
• /
• pp.703-711
• /
• 2016

IDS (Intrusion Detection System) is used to detect network attacks through network data analysis. The system requires a high accuracy and detection rate, and low false alarm rate. In addition, the system uses a range of techniques, such as expert system, data mining, and state transition analysis to analyze the network data. The purpose of this study was to compare the performance of two data mining methods for detecting network attacks. They are Support Vector Machine (SVM) and a neural network called Forward Additive Neural Network (FANN). The well-known KDD Cup 99 training and test data set were used to compare the performance of the two algorithms. The accuracy, detection rate, and false alarm rate were calculated. The FANN showed a slightly higher false alarm rate than the SVM, but showed a much higher accuracy and detection rate than the SVM. Considering that treating a real attack as a normal message is much riskier than treating a normal message as an attack, it is concluded that the FANN is more effective in intrusion detection than the SVM.

• Proceedings of the IEEK Conference
• /
• 2002.06c
• /
• pp.185-188
• /
• 2002

This paper proposes a efficient way to use Database that is constructed about attack-pattern. For IDS that activate confrontation, we reconstruct by Layered Attack Tree after constructing attack pattern by Attack Tree. And then this paper has designed IDS that Layered Attack Tree is applied, verified them.

• Journal of the Institute of Electronics Engineers of Korea TE
• /
• v.39 no.1
• /
• pp.77-82
• /
• 2002

IDS has been studied mainly in the field of the detection decision and collecting of audit data. The detection decision should decide whether successive behaviors are intrusions or not , the collecting of audit data needs ability that collects precisely data for intrusion decision. Artificial methods such as rule based system and neural network are recently introduced in order to solve this problem. However, these methods have simple host structures and defects that can't detect changed new intrusion patterns. So, we propose the method using data mining that can retrieve and estimate the patterns and retrieval of user's behavior in the distributed different hosts.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2001.10a
• /
• pp.479-482
• /
• 2001

IDS has been studied mainly in the field of the detection decision and collecting of audit data. The detection decision should decide whether successive behaviors are intrusions or not, the collecting of audit data needs ability that collects precisely data for intrusion decision. Artificial methods such as rule based system and neural network are recently introduced in order to solve this problem. However, these methods have simple host structures and defects that can't detect transformed intrusion patterns. So, we propose the method using data mining that can retrieve and estimate the patterns and retrieval of user's behavior in the distributed different hosts.

• Convergence Security Journal
• /
• v.8 no.4
• /
• pp.31-40
• /
• 2008

Recently, network forensic research which analyzes intrusion-related information for tracing of attackers, has been becoming more popular than disk forensic which analyzes remaining evidences in a system. Analysis and correlation of logs from firewall, IDS(Intrusion Detect System) and web server are important part in network forensic procedures. This work suggests integrated graphical user interface of network forensic for private information leakage detection. This paper shows the necessity of various log information for network forensic and a design of graphical user interface for security managers who need to monitor the leakage of private information.

• The Journal of the Korea institute of electronic communication sciences
• /
• v.19 no.1
• /
• pp.249-256
• /
• 2024

Machine learning-based intrusion detection methodologies require a large amount of uniform learning data for each class to be classified, and have the problem of having to retrain the entire system when adding an attack type to be detected or classified. In this paper, we use feature learning and hierarchical classification methods to solve classification problems and data imbalance problems using relatively little training data, and propose an intrusion detection methodology that makes it easy to add new attack types. The feasibility of the proposed system was verified through experiments using KDD IDS data..

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2003.10a
• /
• pp.542-547
• /
• 2003

A network based intrusion detection system(N-IDS), can detect intruders coming in through packets in real time environment. The ability of capture of packet is the most important factor when we evaluate the performance of the system. The time delay between the time handling one packet capture and next one is variant become of packet handling mechanism. So for N-IDS can not settle this problem because most systems use a single processor. In this thesis, we solve the problem of irregular tine delay with a file socket and multi-thread processing. We designed and implement, the Crasto system. By an accurate observation, the performance testing shows that the Crasto reduces the capture delay time to 1/5 comparing to the existing single process N-IDS, and maintain delay time regularly.

• Convergence Security Journal
• /
• v.12 no.3
• /
• pp.59-65
• /
• 2012

Clouding computing which is developing newly as IT and network technology develops become changed to internet and service environment of company. Especially, it can lend IT resource at low costs and no need to build up infra. Clouding computing environment become popular more and more because various computing environment using virtualization is provided. The attack threat range also becomes wider in proportion to broaden various connection ways and service supply range at these clouding computing. Therefore, intrusion detection system which can protect resource from various attack having malignant attempts is necessary. In this study, we analyzed about characteristic of intrusion detection system at cloud computing environment having big damage than other computing environment when intrusion happen by sharing of resource and virtualization.