• 정보보호학회논문지
• /
• 제18권1호
• /
• pp.49-57
• /
• 2008

본 논문에서는 구조적으로 분산 침입탐지시스템의 구조를 계승하면서 동시에 홈네트워크의 환경을 최대한 고려하여 HNHDIDS(Home Network Hierarchical Distributed Intrusion Detection System)로 명명된 새로운 계층적 분산 침입탐지 시스템을 제안한다. 제안된 시스템은 단일 클래스 support vector machine(support vector data description)과 지역적 에이전트(agent)들을 계층적으로 결합한 구조로써, 홈네트워크의 환경을 위하여 최적화되었다. 만족스러운 침입 탐지율과 안전한 FNR(false negative rate) 수치 등을 실험을 통하여 확인함으로써 제안된 시스템이 홈네트워크 환경에 적합함을 검증하였다.

• 한국지능정보시스템학회:학술대회논문집
• /
• 한국지능정보시스템학회 1999년도 춘계공동학술대회-지식경영과 지식공학
• /
• pp.307-313
• /
• 1999

This paper reviews and assesses the analogy between the human immune system and network intrusion detection systems. The promising results from a growing number of proposed computer immune models for intrusion detection motivate this work. The paper begins by briefly introducing existing intrusion detection systems (IDS's). A set of general requirements for network-based IDS's and the design goals to satisfy these requirements are identified by a careful examination of the literature. An overview of the human immune system is presented and its salient features that can contribute to the design of competent network-based IDS's are analysed. The analysis shows that the coordinated actions of several sophisticated mechanisms of the human immune system satisfy all the identified design goals. Consequently, the paper concludes that the design of a network-based IDS based on the human immune system is promising for future network-based IDS's

• 융합보안논문지
• /
• 제1권1호
• /
• pp.57-68
• /
• 2001

컴퓨터망의 확대 및 컴퓨터 이용의 급격한 증가에 따른 부작용으로 컴퓨터 보안 문제가 중요하게 대두되고 있다. 이에 따라 침입자로부터 침입을 줄이기 위한 침입탐지시스템에 관한 연구가 활발하다. 본 논문은 멀티레벨에서 감사자료를 수집하고, 필터링하여 오용행위 탐지기법에 대한 선천성면역, 비정상행위 탐지기법에 대한 후천성 면역을 사용한 하이브리드 침입탐지 시스템이다. 다중호스트 기반에서 감사자료를 하나의 시스템으로 모아서 탐지하므로 하나의 호스트에서 탐지한 침입보다 여러 호스트에서 탐지가 가능하며, 비정상행위 탐지 기법에서 탐지한 침입은 오용행위 탐지 기법에서 신속하게 탐지할 수 있는 면역력을 가진 침입탐지 시스템의 설계 및 구현한다.

• 디지털산업정보학회논문지
• /
• 제8권2호
• /
• pp.59-65
• /
• 2012

Emergency medical information center performs role of medical direction about disease consult and pre-hospital emergency handling scheme work to people. Emergency medical information system plays a major role to be decreased mortality and disability of emergency patient by providing information of medical institution especially when emergency patient has appeared. But, various attacks as a hacking have been happened in Emergency medical information system recently. In this paper, we proposed security structure which can protect the system securely by detecting attacks from outside effectively. Intrusion detection was performed using rule based detection technique according to protocol for every packet to detect attack and intrusion was reported to control center if intrusion was detected also. Intrusion detection was performed again using decision tree for packet which intrusion detection was not done. We experimented effectiveness using attacks as TCP-SYN, UDP flooding and ICMP flooding for proposed security structure in this paper.

• 대한전자공학회:학술대회논문집
• /
• 대한전자공학회 2006년도 하계종합학술대회
• /
• pp.207-208
• /
• 2006

Intrusion detection technology is highlighted in order to establish a safe information-oriented environment. Intrusion detection system can be categorized into anomaly detection and misuse detection according to intrusion detection pattern. In this paper, we propose an architecture to make up for the defect of conventional anomaly intrusion detection. This architecture reduces additional resource consumption and cost by placing the agent in the strategic location in Internet.

• ETRI Journal
• /
• 제37권3호
• /
• pp.502-511
• /
• 2015

Intrusion detection plays a key role in detecting attacks over networks, and due to the increasing usage of Internet services, several security threats arise. Though an intrusion detection system (IDS) detects attacks efficiently, it also generates a large number of false alerts, which makes it difficult for a system administrator to identify attacks. This paper proposes automatic fuzzy rule generation combined with a Wiener filter to identify attacks. Further, to optimize the results, simplified swarm optimization is used. After training a large dataset, various fuzzy rules are generated automatically for testing, and a Wiener filter is used to filter out attacks that act as noisy data, which improves the accuracy of the detection. By combining automatic fuzzy rule generation with a Wiener filter, an IDS can handle intrusion detection more efficiently. Experimental results, which are based on collected live network data, are discussed and show that the proposed method provides a competitively high detection rate and a reduced false alarm rate in comparison with other existing machine learning techniques.

• 한국데이타베이스학회:학술대회논문집
• /
• 한국데이타베이스학회 1999년도 춘계공동학술대회: 지식경영과 지식공학
• /
• pp.307-313
• /
• 1999

This paper reviews and assesses the analogy between the human immune system and network intrusion detection systems. The promising results from a growing number of proposed computer immune models for intrusion detection motivate this work. The paper begins by briefly introducing existing intrusion detection systems (IDS's). A set of general requirements for network-based IDS's and the design goals to satisfy these requirements are identified by a careful examination of the literature. An overview of the human immune system is presented and its salient features that can contribute to the design of competent network-based IDS's are analysed. The analysis shows that the coordinated actions of several sophisticated mechanisms of the human immune system satisfy all the identified design goals. Consequently, the paper concludes that the design of a novel network-based IDS based on the human immune system is promising for future network-based IDS's

• 한국정보과학회논문지:정보통신
• /
• 제33권2호
• /
• pp.113-130
• /
• 2006

초고속 인터넷 망이 빠른 속도로 구축이 되고, 네트워크에 대한 해커나 침입자들의 수가 급증함에 따라, 실시간 고속 패킷 처리가 가능한 네트워크 침입 탐지 시스템이 요구되고 있다. 본 논문에서는 일반적으로 소프트웨어 방식으로 구현된 침입 탐지 시스템을 고속의 패킷 처리에 뛰어난 성능을 가지고 있는 네트워크 프로세서를 이용하여 재설계 및 구현하였다. 제한된 자원과 기능을 가지는 다중 처리 프로세서(Multi-processing Processor)로 구성된 네트워크 프로세서에서 고성능 침입 탐지 시스템을 실현하기 위하여, 최적화된 자료구조와 알고리즘을 설계하였다. 그리고 더욱 효율적으로 침입 탐지 엔진을 스케줄링(scheduling)하기 위한 침입 탐지 엔진 할당 기법을 제안하였으며, 구현과 성능 분석을 통하여 제안된 기법의 적절성을 검증하였다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제12권10호
• /
• pp.5079-5099
• /
• 2018

Regarding to the huge number of connections and the large flow of data on the Internet, Intrusion Detection System (IDS) has a difficulty to detect attacks. Moreover, irrelevant and redundant features influence on the quality of IDS precisely on the detection rate and processing cost. Feature Selection (FS) is the important technique, which gives the issue for enhancing the performance of detection. There are different works have been proposed, but a map for understanding and constructing a state of the FS in IDS is still need more investigation. In this paper, we introduce a survey of feature selection algorithms for intrusion detection system. We describe the well-known approaches that have been proposed in FS for IDS. Furthermore, we provide a classification with a comparative study between different contribution according to their techniques and results. We identify a new taxonomy for future trends and existing challenges.

• Journal of applied mathematics & informatics
• /
• 제30권5_6호
• /
• pp.847-864
• /
• 2012

In recent years, using computer networks (wired and wireless networks) has been widespread in many applications. As computer networks become increasingly complex, the accompanied potential threats also grow to be more sophisticated and as such security has become one of the major concerns in them. Prevention methods alone are not sufficient to make them secure; therefore, detection should be added as another defense before an attacker can breach the system. Intrusion Detection Systems (IDSs) have become a key component in ensuring systems and networks security. An IDS monitors network activities in order to detect malicious actions performed by intruders and then initiate the appropriate countermeasures. In this paper, we present a survey and taxonomy of intrusion detection systems and then evaluate and compare them.