• Title/Summary/Keyword: Log File Analysis

Search Result 61, Processing Time 0.025 seconds

A Study on Ransomware Detection Methods in Actual Cases of Public Institutions (공공기관 실제 사례로 보는 랜섬웨어 탐지 방안에 대한 연구)

  • Yong Ju Park;Huy Kang Kim
    • Journal of the Korea Institute of Information Security & Cryptology
    • /
    • v.33 no.3
    • /
    • pp.499-510
    • /
    • 2023
  • Recently, an intelligent and advanced cyber attack attacks a computer network of a public institution using a file containing malicious code or leaks information, and the damage is increasing. Even in public institutions with various information protection systems, known attacks can be detected, but unknown dynamic and encryption attacks can be detected when existing signature-based or static analysis-based malware and ransomware file detection methods are used. vulnerable to The detection method proposed in this study extracts the detection result data of the system that can detect malicious code and ransomware among the information protection systems actually used by public institutions, derives various attributes by combining them, and uses a machine learning classification algorithm. Results are derived through experiments on how the derived properties are classified and which properties have a significant effect on the classification result and accuracy improvement. In the experimental results of this paper, although it is different for each algorithm when a specific attribute is included or not, the learning with a specific attribute shows an increase in accuracy, and later detects malicious code and ransomware files and abnormal behavior in the information protection system. It is expected that it can be used for property selection when creating algorithms.

Design and Implementation of Event Analysis/Arrange Function for Mobile Device Simulator (모바일 디바이스 시뮬레이터용 이벤트 분석 및 배열 기능의 설계 및 구현)

  • Lee, Young-Seok
    • Journal of the Korea Institute of Information and Communication Engineering
    • /
    • v.14 no.6
    • /
    • pp.1429-1434
    • /
    • 2010
  • Generally, the simulator for mobile device tests automatically an application software after instilling again the event, which is saved in log file according to an event generation sequence, into the application software of device. But, the simulator performance for mobile device can be different according to a extraction layer even if the events are same. And, the sequence of events extracted from an application is changeable in the environment that multiple applications are operated concurrently. Therefore, even though the same applications is executed to the same sequence, the generation sequence of events is revised in accordance with the state of mobile device system, and whether the errors occur according to circumstances or not. This kind of application software error is very difficult to perform a debugging operation. In this paper, the execution state of various applications is verifiable through the re-editing of events after analyzing the events which is generated in application, kernel, middleware layer, and the event arrange/editor is designed and implemented to understand efficiently the influence on application, kernel, and middleware layer for events.

Evaluation of the Utility of a Volumetric Modulated Arc Therapy Specific Patient Quality Assurance using Software-based Quality Assurance System (소프트웨어 기반 정도관리 시스템을 이용한 부피세기조절회전치료 환자 별 정도관리의 유용성 평가)

  • Kang, Dong-Jin;Jung, Jae-Yong;Shin, Young-Joo;Min, Jung-Whan;Kim, Yon-Lae;Kwon, Kyung-Tae
    • Journal of radiological science and technology
    • /
    • v.41 no.1
    • /
    • pp.39-45
    • /
    • 2018
  • The purpose of this study is to evaluate the usefulness of a software-based quality assurance system based on Volumetric Modulated Arc Therapy treatment plan. Evaluate treatment plan through the D VH analysis, PTV mean dose ($D_{mean}$) and PTV 95% dose($D_{95}$) compare the MFX based on original treatment plan, Average error rate was $0.9{\pm}0.6%$, $1.0{\pm}0.8%$, respectively. Measuring point dose using phantom and ion chamber, the average error rate between the ionization chamber and MFX was $0.9{\pm}0.7%$, $1.1{\pm}0.7%$ (high dose region), $1.1{\pm}0.9%$, $1.2{\pm}0.7%$ (low dose region). The average gamma though of MFX and $Delta^{4PT}$ is $98.7{\pm}1.2%$, $98.4{\pm}.3%$, respectively. Through this study, A software based QA system that simplifies hardware based QA procedures that involve a lot of time and effort. It can be used as a simple and useful tool in clinical practice.

A Conceptual Framework for an Information Behavior Model Based on the Collaboration Perspective between User and System for Information Retrieval

  • Yangyuen, Wachira;Phetkaew, Thimaporn;Nuntapichai, Siwanath
    • Journal of Information Science Theory and Practice
    • /
    • v.8 no.3
    • /
    • pp.30-46
    • /
    • 2020
  • This research aimed (1) to study and analyze the ability of current information retrieval (IR) systems based on views of information behavior (IB), and (2) to propose a conceptual framework for an IB model based on the collaboration between the system and user, with the intent of developing an IR system that can apply intelligent techniques to enhance system efficiency. The methods in this study consisted of (1) document analysis which included studying the characteristics and efficiencies of the current IR systems and studying the IB models in the digital environment, and (2) implementation of the Delphi technique through an indepth interview method with experts. The research results were presented in three main parts. First, the IB model was categorized into eight stages, different from traditional IB, in the digital environment, which can correspond to all behaviors and be applied to with an IR system. Second, insufficient functions and log file storage hinder the system from effectively understanding and accommodating user behavior in the digital environment. Last, the proposed conceptual framework illustrated that there are stages that can add intelligent techniques to the IR system based on the collaboration perspective between the user and system to boost the users' cognitive ability and make the IR system more user-friendly. Importantly, the conceptual framework for the IB model based on the collaboration perspective between the user and system for IR assisted the ability of information systems to learn, recognize, and comprehend human IB according to individual characteristics, leading to enhancement of interaction between the system and users.

Analysis of the Possibility of Recovering Deleted Flight Records by DJI Drone Model (DJI 드론 모델별 삭제 비행기록 복구 가능성 분석)

  • YeoHoon Yoon;Joobeom Yun
    • Journal of the Korea Institute of Information Security & Cryptology
    • /
    • v.33 no.4
    • /
    • pp.609-619
    • /
    • 2023
  • Recently, crimes using drones, one of the IoT industries have been continuously reported. In particular, drones are characterized by easy access and free movement, so they are used for various crimes such as transporting explosives, transporting drugs, and illegal recording. In order to analyze and investigate these criminal acts, drone forensic research is highly emphasized. Media data, PII, and flight records are digital forensic artifacts that can be acquired from drones, in particluar flight records are important artifacts since they can be used to trace drone activities. Therefore, in this paper, the characteristics of the deleted flight record files of DJI drones are presented and verified using the Phantom3, Phantom4 andMini2 models, two drones with differences in characteristics. Additionally, the recovery level is analyzed using the flight record file characteristics, and lastly, drones with the capacity to recover flight records for each drone model and drone models without it are classified.

A Dynamic Recommendation System Using User Log Analysis and Document Similarity in Clusters (사용자 로그 분석과 클러스터 내의 문서 유사도를 이용한 동적 추천 시스템)

  • 김진수;김태용;최준혁;임기욱;이정현
    • Journal of KIISE:Software and Applications
    • /
    • v.31 no.5
    • /
    • pp.586-594
    • /
    • 2004
  • Because web documents become creation and disappearance rapidly, users require the recommend system that offers users to browse the web document conveniently and correctly. One largely untapped source of knowledge about large data collections is contained in the cumulative experiences of individuals finding useful information in the collection. Recommendation systems attempt to extract such useful information by capturing and mining one or more measures of the usefulness of the data. The existing Information Filtering system has the shortcoming that it must have user's profile. And Collaborative Filtering system has the shortcoming that users have to rate each web document first and in high-quantity, low-quality environments, users may cover only a tiny percentage of documents available. And dynamic recommendation system using the user browsing pattern also provides users with unrelated web documents. This paper classifies these web documents using the similarity between the web documents under the web document type and extracts the user browsing sequential pattern DB using the users' session information based on the web server log file. When user approaches the web document, the proposed Dynamic recommendation system recommends Top N-associated web documents set that has high similarity between current web document and other web documents and recommends set that has sequential specificity using the extracted informations and users' session information.

An accuracy analysis of Cyberknife tumor tracking radiotherapy according to unpredictable change of respiration (예측 불가능한 호흡 변화에 따른 사이버나이프 종양 추적 방사선 치료의 정확도 분석)

  • Seo, jung min;Lee, chang yeol;Huh, hyun do;Kim, wan sun
    • The Journal of Korean Society for Radiation Therapy
    • /
    • v.27 no.2
    • /
    • pp.157-166
    • /
    • 2015
  • Purpose : Cyber-Knife tumor tracking system, based on the correlation relationship between the position of a tumor which moves in response to the real time respiratory cycle signal and respiration was obtained by the LED marker attached to the outside of the patient, the location of the tumor to predict in advance, the movement of the tumor in synchronization with the therapeutic device to track real-time tumor, is a system for treating. The purpose of this study, in the cyber knife tumor tracking radiation therapy, trying to evaluate the accuracy of tumor tracking radiation therapy system due to the change in the form of unpredictable sudden breathing due to cough and sleep. Materials and Methods : Breathing Log files that were used in the study, based on the Respiratory gating radiotherapy and Cyber-knife tracking radiosurgery breathing Log files of patients who received herein, measured using the Log files in the form of a Sinusoidal pattern and Sudden change pattern. it has been reconstituted as possible. Enter the reconstructed respiratory Log file cyber knife dynamic chest Phantom, so that it is possible to implement a motion due to respiration, add manufacturing the driving apparatus of the existing dynamic chest Phantom, Phantom the form of respiration we have developed a program that can be applied to. Movement of the phantom inside the target (Ball cube target) was driven by the displacement of three sizes of according to the size of the respiratory vertical (Superior-Inferior) direction to the 5 mm, 10 mm, 20 mm. Insert crosses two EBT3 films in phantom inside the target in response to changes in the target movement, the End-to-End (E2E) test provided in Cyber-Knife manufacturer depending on the form of the breathing five times each. It was determined by carrying. Accuracy of tumor tracking system is indicated by the target error by analyzing the inserted film, additional E2E test is analyzed by measuring the correlation error while being advanced. Results : If the target error is a sine curve breathing form, the size of the target of the movement is in response to the 5 mm, 10 mm, 20 mm, respectively, of the average $1.14{\pm}0.13mm$, $1.05{\pm}0.20mm$, with $2.37{\pm}0.17mm$, suddenly for it is variations in breathing, respective average $1.87{\pm}0.19mm$, $2.15{\pm}0.21mm$, and analyzed with $2.44{\pm}0.26mm$. If the correlation error can be defined by the length of the displacement vector in the target track is a sinusoidal breathing mode, the size of the target of the movement in response to 5 mm, 10 mm, 20 mm, respective average $0.84{\pm}0.01mm$, $0.70{\pm}0.13mm$, with $1.63{\pm}0.10mm$, if it is a variant of sudden breathing respective average $0.97{\pm}0.06mm$, $1.44{\pm}0.11mm$, and analyzed with $1.98{\pm}0.10mm$. The larger the correlation error values in both the both the respiratory form, the target error value is large. If the motion size of the target of the sine curve breathing form is greater than or equal to 20 mm, was measured at 1.5 mm or more is a recommendation value of both cyber knife manufacturer of both error value. Conclusion : There is a tendency that the correlation error value between about target error value magnitude of the target motion is large is increased, the error value becomes large in variation of rapid respiration than breathing the form of a sine curve. The more the shape of the breathing large movements regular shape of sine curves target accuracy of the tumor tracking system can be judged to be reduced. Using the algorithm of Cyber-Knife tumor tracking system, when there is a change in the sudden unpredictable respiratory due patient coughing during treatment enforcement is to stop the treatment, it is assumed to carry out the internal target validation process again, it is necessary to readjust the form of respiration. Patients under treatment is determined to be able to improve the treatment of accuracy to induce the observed form of regular breathing and put like to see the goggles monitor capable of the respiratory form of the person.

  • PDF

Development of the Web-based Sports Biomechanics Class (웹기반 운동역학 수업 모형 개발)

  • Lee, Ki-Kwang
    • Korean Journal of Applied Biomechanics
    • /
    • v.12 no.2
    • /
    • pp.307-318
    • /
    • 2002
  • To provide a guideline for the development of a web-based sport biomechanics class in undergraduate program, thirty web sites, searched via search engines in May 2002, were analyzed intensively. In terms of requirement of log-in, only one site of 30 sites required user name and password. Seventeen(57%) sites provided the lecture note, which had various file formats such as 59% if PDF, 29% of HTML, and 12% of PPT. Fourteen(47%) sites provided the assignment and grade information on web. Eleven(37%) sites provided various resource and links which were related in sports biomechanics. Only four(13%) sites provided discussion or online digitizing or kinematic analysis program. Based on above results, a guideline for the development of a virtual classroom for college level sport biomechanics. A web-based sport biomechanics class should be developed with consideration of several functions as follows; homepage design, lecture note, measurement of class attendance, collaborative research system, and web-based data collection and analysis software for biomechanics laboratory.

Utility Analysis on Activating Web-Based Course Support System by Faculty in Universities (웹기반 강의지원시스템에 대한 대학교수의 활용도분석)

  • Kim, Kyung-Woo
    • Journal of the Korea Society of Computer and Information
    • /
    • v.14 no.11
    • /
    • pp.221-232
    • /
    • 2009
  • To purpose of the study was to analyze faculty utility of Web-Based course support system in Universities. Data were collected from log file in server computer, 5,023 faculties and 12,733 courses offered at spring semester of 2009 in the Metropolitan area S, K, D universities were analyzed. Specifically, frequency and percentile of faculties and courses using course management system were analyzed. In addition, the frequencies and percentiles of courses using sub-functions of course management system were analyzed and X2 test used to examine the difference of frequencies of faculties and courses using course system at using announcement, providing instructional material, public bulletin board and free board. Results were as follows. The 62.28% of faculties and 50.3% of courses have used Web-Based course support system. The results of Subfunction utility analysis showed the highest use as 80.4%. in providing instructional material. However, the use of announcement functions and online discussion was more or less low. Results imply that most of faculties and course are using course management system as supplementary system of off-line instruction.

Measurement of Quality Parameters of Honey by Reflectance Spectra

  • Park, Chang-Hyun;Yang, Won-Jun;Sohn, Jae-Hyung;Kim, Jong-Hoon
    • Proceedings of the Korean Society of Near Infrared Spectroscopy Conference
    • /
    • 2001.06a
    • /
    • pp.1530-1530
    • /
    • 2001
  • The objectives of this study were to develop models to predict quality parameters of Korean bee-honeys by visible and NIR spectroscopic technique. Two kinds of bee-honey fronl acacia and polyflower sources were tested in this study. The honeys were harvested in the spring of 2000 and stored in the storage facility at 20$^{\circ}C$ during experiments. Total of 394 samples of honey were analyzed. Reflectance spectra, moisture contents, ash, invert sugar, sucrose, F/G (fructose/glucose) ratio, HMF (hydroxymethyl furfural), and C12/C13 ratio of honeys were measured. The average values for the tested honeys were 19.9% of moisture contents, 0.12% of ash, 68.4% of invert sugar, 5.7% of sucrose, 1.27 of F/G(fructose/glucose) ratio, 14.4 mg/kg of HMF, and -19.1 of C12/C13 ratio. A spectrophotometer, equipped with a single-beam scanning monochromator (NIR Systems, Model 6500, USA) and a horizontal setup module, was used to collect reflectance data from honey. The reflectance spectra were measured in wavelength ranges of 400∼2,498 nm. with 2 nm of interval. Thirty-two repetitive scans were averaged, transformed to log(1/Reflectance), and then were stored in a microcomputer file, forming one spectrum per measurement. A sample cell and reflectance plate were made to hold honey samples constantly. Spectra of honey samples were divided into a calibration set and a validation set. The calibration set was used during model development, and the validation set was used to predict quality parameters from unknown spectra. The PLS(Partial Least Square) models were developed to predict the quality parameters of honeys. The first and the second derivatives of raw spectra were also used to develop the models with proper smoothing gap. The MSC (multiplicative scatter correction) and the SNV & Dtr.(standard normal variate and detranding) preprocessing were applied to all spectra to minimize sample-to-sample light scatter differences. The PLS models showed good relationships between predicted and measured quality parameters of honeys in the wavelength range of 1100∼2200 nm. However, the PLS analysis was not good enough to predict HMF of honeys.

  • PDF