• Journal of Convergence Society for SMB
• /
• v.2 no.2
• /
• pp.1-6
• /
• 2012

In this paper, we propose a detector generation model which is applied to immune system to improve the misuse detection rates in misuse detection models. 10cv method is used to sendmail data which is provided by the DARPA. We experimented and analyzed the misuse detection rate that is either judgment of the normal system call as abnormal system call or judgment of the abnormal system call as normal system call. In the experiment, between detector which was generated by any abnormal system call and temporary detector. I did experiments with a new detector which was removed temporary detector which made a wrong decision for normal system call as an abnormal system call and abnormal system call as a normal system call. The misuse detection rate of detector which is applied to the immune system is greater than the other detector by 0.3%.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2014.11a
• /
• pp.527-529
• /
• 2014

다양한 컴퓨팅 서비스가 등장하고 진화하면서, 서비스를 제공하기 위한 컴퓨팅 시스템은 점점 복잡해지고 있다. 시스템이 복잡해질수록 다양한 취약점들이 발생하고, 실제로 이 취약점들을 악용한 공격도 점점 늘어나고 있다. 수많은 공격들을 막기 위한 보안 솔루션은 크게 네트워크 보안 솔루션과 호스트 보안 솔루션으로 나뉘며, 그 중 네트워크 보안 솔루션은 misuse detection과 anomaly detection으로 크게 분류된다. 안전한 시스템을 구축하기 위해선 유입되는 공격시도를 최대한 많이 발견하고 차단하는 것이 매우 중요한데, 이러한 관점에서 네트워크 보안은 매우 중요하다. 본 논문에서는 네트워크 보안 솔루션의 보안 성능 강화를 위해 misuse detection과 anomaly detection을 융합하여 철저한 패킷 검사를 수행할 수 있는 아키텍처를 제안한다. 그리고 제시한 아키텍처의 한계점을 기술하고 이 문제를 SDN을 활용하여 해결하는 방안도 제시한다.

• Journal of the Korean Institute of Intelligent Systems
• /
• v.12 no.6
• /
• pp.531-536
• /
• 2002

In this paper, we have applied Genetic Algorithms(GAs) to Intrusion Detection System(TDS), and then proposed and simulated the misuse detection model firstly. We have implemented with the KBD contest data, and tried to simulated in the same environment. In the experiment, the set of record is regarded as a chromosome, and GAs are used to produce the intrusion patterns. That is, the intrusion rules are generated. We have concentrated on the simulation and analysis of classification among the Data Mining techniques and then the intrusion patterns are produced. The generated rules are represented by intrusion data and classified between abnormal and normal users. The different rules are generated separately from three models "Time Based Traffic Model", "Host Based Traffic Model", and "Content Model". The proposed system has generated the update and adaptive rules automatically and continuously on the misuse detection method which is difficult to update the rule generation. The generated rules are experimented on 430M test data and almost 94.3% of detection rate is shown.3% of detection rate is shown.

• Convergence Security Journal
• /
• v.11 no.1
• /
• pp.57-69
• /
• 2011

Many heterogeneous Intrusion Detection Systems(IDSs) based in misuse detection technique including the self-developed IDS are now operating in Defense-ESM(Enterprise Security Management System). IDS based on misuse detection may have different capability in the intrusion detection process according to the frequency and quality of its signature update. This makes the integration and collaboration with other IDSs more difficult. In this paper, with the purpose of creating the proper foundation for integration and collaboration between heterogeneous IDSs being operated in Defense-ESM, we propose an effective mechanism that can enable one IDS to propagate its new detection rules to other IDSs and receive updated rules from others. We also prove the performance of rule exchange and application possibility to defense environment through the implementation and experiment.

• Proceedings of the Korea Multimedia Society Conference
• /
• 2002.05d
• /
• pp.951-954
• /
• 2002

최근의 침입탐지시스템(IDS: Intrusion Detection System) 기술동향은 Misuse 방식의 규칙 데이터베이스 변경에 대한 한계성 때문에 Anomaly 방식의 NIDS(Network IDS)에 대한 연구가 고려되고 있다. 현재 국내에서 개발된 기존의 제품들은 대부분 Misuse 방식을 채택하고 있으며, 향후 국제 경쟁력을 갖추기 위해서는 Anomaly 방식의 기술 연구가 필요하다. 본 연구에서는 본 연구실에서 개발한 NIDS를 기반으로 연관 마이닝을 이용한 비정상 탐지 문제, 내부 정보 유출 차단 등에 대한 통합된 시스템 설계 방향을 제시하여 국가기관이나 기업이 보다 안전하게 침입을 관리할 수 있는 IPS(Intrusion Prevention System) 시스템을 설계한다.

• Journal of Internet Computing and Services
• /
• v.22 no.3
• /
• pp.27-35
• /
• 2021

With the development of the Internet, various IT technologies such as IoT, Cloud, etc. have been developed, and various systems have been built in countries and companies. Because these systems generate and share vast amounts of data, they needed a variety of systems that could detect threats to protect the critical data contained in the system, which has been actively studied to date. Typical techniques include anomaly detection and misuse detection, and these techniques detect threats that are known or exhibit behavior different from normal. However, as IT technology advances, so do technologies that threaten systems, and these methods of detection. Advanced Persistent Threat (APT) attacks national or companies systems to steal important information and perform attacks such as system down. These threats apply previously unknown malware and attack technologies. Therefore, in this paper, we propose a hybrid intrusion detection system that combines anomaly detection and misuse detection to detect unknown threats. Two detection techniques have been applied to enable the detection of known and unknown threats, and by applying machine learning, more accurate threat detection is possible. In misuse detection, we applied Classification based on Association Rule(CBA) to generate rules for known threats, and in anomaly detection, we used One-Class SVM(OCSVM) to detect unknown threats. Experiments show that unknown threat detection accuracy is about 94%, and we confirm that unknown threats can be detected.

• Journal of Internet Computing and Services
• /
• v.7 no.3
• /
• pp.119-132
• /
• 2006

The network based security techniques well-known until now have week points to be passive in attacks and susceptible to roundabout attacks so that the misuse detection based intrusion prevention system which enables positive correspondence to the attacks of inline mode are used widely. But because the Misuse detection based Intrusion prevention system is proportional to the detection rules, it causes excessive false alarm and is linked to wrong correspondence which prevents the regular network flow and is insufficient to detect transformed attacks, This study suggests an Intrusion prevention system which uses Support Vector machines(hereinafter referred to as SVM) as one of rule based Intrusion prevention system and Anomaly System in order to supplement these problems, When this compared with existing intrusion prevention system, show performance result that improve about 20% and could through intrusion prevention system that propose false positive minimize and know that can detect effectively about new variant attack.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2001.05a
• /
• pp.680-683
• /
• 2001

As the rapid information communication technique, internet users have been continuously increasing every year, but on the other hand many damages have occurred on the internet because of dysfunction for computer system intrusion. To reduce damages, network and system security mechanism is variously developed by researcher, IDS(Intrusion Detection System) is commercialized to security technique. In this paper we describe for intrusion detection based on network, we design and implement IDS to detect illegal intrusion using misuse detection model. Implemented IDS can detect various intrusion types. When IDS detected illegal intrusion, we implemented for administrator to be possible management and control through mechanisms of alert message transmission, mail transmission, mail at the remote.

• KIPS Transactions on Computer and Communication Systems
• /
• v.5 no.12
• /
• pp.471-480
• /
• 2016

Recently, the damage of cyber attack toward infra-system, national defence and security system is gradually increasing. In this situation, military recognizes the importance of cyber warfare, and they establish a cyber system in preparation, regardless of the existence of threaten. Thus, the study of Intrusion Detection System(IDS) that plays an important role in network defence system is required. IDS is divided into misuse and anomaly detection methods. Recent studies attempt to combine those two methods to maximize advantagesand to minimize disadvantages both of misuse and anomaly. The combination is called Hybrid IDS. Previous studies would not be inappropriate for near real-time network environments because they have computational complexity problems. It leads to the need of the study considering the structure of IDS that have high detection rate and low computational cost. In this paper, we proposed a Hybrid IDS which combines C4.5 decision tree(misuse detection method) and Weighted K-means algorithm (anomaly detection method) hierarchically. It can detect malicious network packets effectively with low complexity by applying mutual information and genetic algorithm based efficient feature selection technique. Also we construct upgraded the the hierarchical structure of IDS reusing feature weights in anomaly detection section. It is validated that proposed Hybrid IDS ensures high detection accuracy (98.68%) and performance at experiment section.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.13 no.5
• /
• pp.91-104
• /
• 2003

A masquerader is someone who pretends to be another user while invading the target user's accounts, directories, or files. The masquerade attack is the most serious computer misuse. Because, in most cases, after securing the other's password, the masquerader enters the computer system. The system such as IDS could not detect or response to the masquerader. The masquerade detection is the effort to find the masquerader automatically. This system will detect the activities of a masquerader by determining that user's activities violate a profile developed for that user with his audit data. From 1988, there are many efforts on this topic, but the success of the offers was limited and the performance was unsatisfactory. In this report we propose efficient masquerade detection system using SVM which create the user profile.