• Journal of Communications and Networks
• /
• v.14 no.3
• /
• pp.310-318
• /
• 2012

Detecting intrusion attacks accurately and rapidly in wireless networks is one of the most challenging security problems. Intrusion attacks of various types can be detected by the change in traffic flow that they induce. Wireless industrial networks based on the wireless networks for industrial automation-process automation (WIA-PA) standard use a superframe to schedule network communications. We propose an intrusion detection system for WIA-PA networks. After modeling and analyzing traffic flow data by time-sequence techniques, we propose a data traffic prediction model based on autoregressive moving average (ARMA) using the time series data. The model can quickly and precisely predict network traffic. We initialized the model with data traffic measurements taken by a 16-channel analyzer. Test results show that our scheme can effectively detect intrusion attacks, improve the overall network performance, and prolong the network lifetime.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.25 no.5
• /
• pp.628-636
• /
• 2021

This paper contains the implementation and performance evaluation results of a system that collects environmental data at the time when the wild animal intrusion occurred at farms and then predicts future wild animal intrusions through a machine learning-based Vector Autoregression(VAR) model. To collect the data for intrusion prediction, an IoT-based hardware prototype was developed, which was installed on a small farm located near the school and simulated over a long period to generate intrusion events. The intrusion prediction service based on the implemented VAR model provides the date and time when intrusion is likely to occur over the next 30 days. In addition, the proposed system includes the function of providing real-time notifications to the farmers mobile device when wild animals intrusion occurs in the farm, and performance evaluation was conducted to confirm that the average response time was 7.89 seconds.

• Journal of Soil and Groundwater Environment
• /
• v.19 no.4
• /
• pp.23-30
• /
• 2014

Coastal aquifer in Muan, Jeonnam, has experienced heavy seawater intrusion caused by the extraction of a substantial amount of groundwater for the agricultural purpose throughout the year. It was observed that groundwater level dropped below sea level due to heavy pumping during a dry season, which could accelerate seawater intrusion. Therefore, water level needs to be monitored and managed to prevent further seawater intrusion. The purpose of this study is to develop the autoregressive-cross-regressive (ARCR) models that can predict the present or future groundwater level using its own previous values and pumping events. The ARCR model with pumping and water level data of the proceeding five hours (i.e., the model order of five) predicted groundwater level better than that of the model orders of ten and twenty. This was contrary to expectation that higher orders do increase the coefficient of determination ($R^2$) as a measure of the model's goodness. It was found that the ARCR model with order five was found to make a good prediction of next 48 hour groundwater levels after the start of pumping with $R^2$ higher than 0.9.

• Convergence Security Journal
• /
• v.22 no.3
• /
• pp.101-110
• /
• 2022

As the cases of using artificial intelligence in various fields increase, attempts to solve various issues through artificial intelligence in the intrusion detection field are also increasing. However, the black box basis, which cannot explain or trace the reasons for the predicted results through machine learning, presents difficulties for security professionals who must use it. To solve this problem, research on explainable AI(XAI), which helps interpret and understand decisions in machine learning, is increasing in various fields. Therefore, in this paper, we propose an explanatory AI to enhance the reliability of machine learning-based intrusion detection prediction results. First, the intrusion detection model is implemented through XGBoost, and the description of the model is implemented using SHAP. And it provides reliability for security experts to make decisions by comparing and analyzing the existing feature importance and the results using SHAP. For this experiment, PKDD2007 dataset was used, and the association between existing feature importance and SHAP Value was analyzed, and it was verified that SHAP-based explainable AI was valid to give security experts the reliability of the prediction results of intrusion detection models.

• Proceedings of the Korea Water Resources Association Conference
• /
• 2001.05b
• /
• pp.1224-1229
• /
• 2001

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.7 no.5
• /
• pp.978-985
• /
• 2003

The implementation of abnormal behavior detection IDS is more difficult than the implementation of misuse behavior detection IDS because usage patterns are various. Therefore, most of commercial IDS is misuse behavior detection IDS. However, misuse behavior detection IDS cannot detect system intrusion in case of modified intrusion patterns occurs. In this paper, we apply data mining so as to detect intrusion with only audit data related in intrusion among many audit data. The agent in the distributed IDS can collect log data as well as monitoring target system. False positive should be minimized in order to make detection accuracy high, that is, core of intrusion detection system. So We apply data mining algorithm for prediction of modified intrusion pattern in the level of audit data learning.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.16 no.12
• /
• pp.3889-3903
• /
• 2022

To address the problem of low detection accuracy due to training noise caused by mislabeling when Tri-training for network intrusion detection (NID), we propose a Tri-training algorithm based on cross entropy and K-nearest neighbors (TCK) for network intrusion detection. The proposed algorithm uses cross-entropy to replace the classification error rate to better identify the difference between the practical and predicted distributions of the model and reduce the prediction bias of mislabeled data to unlabeled data; K-nearest neighbors are used to remove the mislabeled data and reduce the number of mislabeled data. In order to verify the effectiveness of the algorithm proposed in this paper, experiments were conducted on 12 UCI datasets and NSL-KDD network intrusion datasets, and four indexes including accuracy, recall, F-measure and precision were used for comparison. The experimental results revealed that the TCK has superior performance than the conventional Tri-training algorithms and the Tri-training algorithms using only cross-entropy or K-nearest neighbor strategy.

• Proceedings of the KSRS Conference
• /
• 2005.10a
• /
• pp.301-304
• /
• 2005

For detecting an intrusion based on the anomaly of a user's activities, previous works are concentrated on statistical techniques or frequent episode mining in order to analyze an audit data. But, since they mainly analyze the average behaviour of user's activities, some anomalies can be detected inaccurately. Therefore, we propose an anomaly detection method that utilizes an associative classification for modelling intrusion detection. Finally, we proof that a prediction model built from associative classification method yields better accuracy than a prediction model built from a traditional methods by experimental results.

• Proceedings of the Korea Concrete Institute Conference
• /
• 1997.04a
• /
• pp.254-260
• /
• 1997

Chloride-induced corrosion of reinforcement is one of the main factors which cause the deterioration of concrete structures. Durability and service lives of the concrete sturctures should be predicted in order to minimize the risk of corrosion of reinforcement. The objective of this study is to suggest the basis of analytical methods of predicting the corrosion threhold time of concrete structures. Based on the chemistry and physics of chloride ion transport and corrosion process, chloride intrusion with various exposure conditions, variability of diffusivity and transport of pore water in concrete are taken into consideration in applying finite element formulation to the predicion of corrosion threhold time. The effects of main factors on the prediction of chloride intrusion and corrosion threhold time are examined. In addition, after chloride diffusivities of several mixture proportions with different parameters are measured by chloride diffusion test, the exemplary anayses of corrosion threhold time of those mixture proportions are carried out.

• Journal of Intelligence and Information Systems
• /
• v.18 no.1
• /
• pp.125-141
• /
• 2012

These days, the malicious attacks and hacks on the networked systems are dramatically increasing, and the patterns of them are changing rapidly. Consequently, it becomes more important to appropriately handle these malicious attacks and hacks, and there exist sufficient interests and demand in effective network security systems just like intrusion detection systems. Intrusion detection systems are the network security systems for detecting, identifying and responding to unauthorized or abnormal activities appropriately. Conventional intrusion detection systems have generally been designed using the experts' implicit knowledge on the network intrusions or the hackers' abnormal behaviors. However, they cannot handle new or unknown patterns of the network attacks, although they perform very well under the normal situation. As a result, recent studies on intrusion detection systems use artificial intelligence techniques, which can proactively respond to the unknown threats. For a long time, researchers have adopted and tested various kinds of artificial intelligence techniques such as artificial neural networks, decision trees, and support vector machines to detect intrusions on the network. However, most of them have just applied these techniques singularly, even though combining the techniques may lead to better detection. With this reason, we propose a new integrated model for intrusion detection. Our model is designed to combine prediction results of four different binary classification models-logistic regression (LOGIT), decision trees (DT), artificial neural networks (ANN), and support vector machines (SVM), which may be complementary to each other. As a tool for finding optimal combining weights, genetic algorithms (GA) are used. Our proposed model is designed to be built in two steps. At the first step, the optimal integration model whose prediction error (i.e. erroneous classification rate) is the least is generated. After that, in the second step, it explores the optimal classification threshold for determining intrusions, which minimizes the total misclassification cost. To calculate the total misclassification cost of intrusion detection system, we need to understand its asymmetric error cost scheme. Generally, there are two common forms of errors in intrusion detection. The first error type is the False-Positive Error (FPE). In the case of FPE, the wrong judgment on it may result in the unnecessary fixation. The second error type is the False-Negative Error (FNE) that mainly misjudges the malware of the program as normal. Compared to FPE, FNE is more fatal. Thus, total misclassification cost is more affected by FNE rather than FPE. To validate the practical applicability of our model, we applied it to the real-world dataset for network intrusion detection. The experimental dataset was collected from the IDS sensor of an official institution in Korea from January to June 2010. We collected 15,000 log data in total, and selected 10,000 samples from them by using random sampling method. Also, we compared the results from our model with the results from single techniques to confirm the superiority of the proposed model. LOGIT and DT was experimented using PASW Statistics v18.0, and ANN was experimented using Neuroshell R4.0. For SVM, LIBSVM v2.90-a freeware for training SVM classifier-was used. Empirical results showed that our proposed model based on GA outperformed all the other comparative models in detecting network intrusions from the accuracy perspective. They also showed that the proposed model outperformed all the other comparative models in the total misclassification cost perspective. Consequently, it is expected that our study may contribute to build cost-effective intelligent intrusion detection systems.