• Journal of the Korea Society of Computer and Information
• /
• v.28 no.11
• /
• pp.81-87
• /
• 2023

Intrusion detection systems that learn metadata of network packets have been proposed recently. However these approaches require time to analyze packets to generate metadata for model learning, and time to pre-process metadata before learning. In addition, models that have learned specific metadata cannot detect intrusion by using original packets flowing into the network as they are. To address the problem, this paper propose a natural language processing-based intrusion detection system that detects intrusions by learning the packet payload as a single sentence without an additional conversion process. To verify the performance of our approach, we utilized the UNSW-NB15 and Transformer models. First, the PCAP files of the dataset were labeled, and then two Transformer (BERT, DistilBERT) models were trained directly in the form of sentences to analyze the detection performance. The experimental results showed that the binary classification accuracy was 99.03% and 99.05%, respectively, which is similar or superior to the detection performance of the techniques proposed in previous studies. Multi-class classification showed better performance with 86.63% and 86.36%, respectively.

• Convergence Security Journal
• /
• v.2 no.2
• /
• pp.109-121
• /
• 2002

As the development of information technology and thus the growth of security incidents, there has been increasing demand on developing a system for centralized security management, also known as Enterprise Security Management(ESM), uniting functions of various security systems such as firewall, intrusion detection system, virtual private network and so on. Unfortunately, however, developers have been suffering with a lack of related standard. Although ISTF recently announced firewall system and intrusion detection system log format, it still needs for truly efficient ESM further development of the related standard including event and control messaging. This paper analyses ISTF standard and further suggests an additional event and control messaging standard for firewall and intrusion detection systems. It is expected that this effort would be helpful for the development of ESM and further related standard.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.7 no.7
• /
• pp.1721-1736
• /
• 2013

Black and gray hole attack is one kind of routing disturbing attacks and can bring great damage to the network. As a result, an efficient algorithm to detect black and gray attack is important. This paper demonstrate an adaptive approach to detecting black and gray hole attacks in ad hoc network based on a cross layer design. In network layer, we proposed a path-based method to overhear the next hop's action. This scheme does not send out extra control packets and saves the system resources of the detecting node. In MAC layer, a collision rate reporting system is established to estimate dynamic detecting threshold so as to lower the false positive rate under high network overload. We choose DSR protocol to test our algorithm and ns-2 as our simulation tool. Our experiment result verifies our theory: the average detection rate is above 90% and the false positive rate is below 10%. Moreover, the adaptive threshold strategy contributes to decrease the false positive rate.

• International Journal of Computer Science & Network Security
• /
• v.21 no.7
• /
• pp.159-168
• /
• 2021

Detecting cyber-attacks using machine learning or deep learning is being studied and applied widely in network intrusion detection systems. We noticed that the application of deep learning algorithms yielded many good results. However, because each deep learning model has different architecture and characteristics with certain advantages and disadvantages, so those deep learning models are only suitable for specific datasets or features. In this paper, in order to optimize the process of detecting cyber-attacks, we propose the idea of building a new deep learning network model based on the association and combination of individual deep learning models. In particular, based on the architecture of 2 deep learning models: Convolutional Neural Network (CNN) and Long Short Term Memory (LSTM), we combine them into a combined deep learning network for detecting cyber-attacks based on network traffic. The experimental results in Section IV.D have demonstrated that our proposal using the CNN-LSTM deep learning model for detecting cyber-attacks based on network traffic is completely correct because the results of this model are much better than some individual deep learning models on all measures.

• KNOM Review
• /
• v.23 no.2
• /
• pp.18-28
• /
• 2020

With the development of the virtual community, the benefits that IT technology provides to people in fields such as healthcare, industry, communication, and culture are increasing, and the quality of life is also improving. Accordingly, there are various malicious attacks targeting the developed network environment. Firewalls and intrusion detection systems exist to detect these attacks in advance, but there is a limit to detecting malicious attacks that are evolving day by day. In order to solve this problem, intrusion detection research using machine learning is being actively conducted, but false positives and false negatives are occurring due to imbalance of the learning dataset. In this paper, a Random Oversampling method is used to solve the unbalance problem of the UNSW-NB15 dataset used for network intrusion detection. And through experiments, we compared and analyzed the accuracy, precision, recall, F1-score, training and prediction time, and hardware resource consumption of the models. Based on this study using the Random Oversampling method, we develop a more efficient network intrusion detection model study using other methods and high-performance models that can solve the unbalanced data problem.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2003.12a
• /
• pp.53-59
• /
• 2003

정보통신 인프라의 발달과 인터넷을 통한 멀티미디어 서비스 및 대용량 데이터의 처리 증가는 조직의 네트워크 환경의 고속화를 가져왔다. 이러한 네트워크 환경의 변화는 조직으로 유입되는 비정상적인 행위/사건을 감시하는 네트워크 기반 침입탐지시스템(Network-based intrusion detection system, NIDS)의 필요조건의 변화를 동반한다. 즉, 기존 NIDS 연구는 비정상적인 행위/사건의 정확한 판단과 이에 대한 대응기술에 초점이 맞추어졌으나, 최근에는 이와 더불어 고속 네트워크 환경에서의 NIDS 성능저하를 최소화하기 위한 가용성 화보 기술에 대해 연구가 활발히 진행되고 있다. 따라서 본 논문에서는 고속 네트워크 환경에서 NIDS의 정상적인 운영을 위해 성능에 절대적인 영향을 미치는 요소를 결정하고, 각 요소별 효율적인 설계 원리를 제시한다.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.14 no.2
• /
• pp.11-17
• /
• 2018

IDS/IPS and networked computer systems are playing an increasingly important role in our society. They have been the targets of a malicious attacks that actually turn into intrusions. That is why computer security has become an important concern for network administrators. Recently, various Detection/Prevention System schemes have been proposed based on various technologies. However, the techniques, which have been applied in many systems is useful for existing intrusion patterns on standard-only systems. Therefore, probe detection of private clouds using BlockChain has become a major security protection technology to detection potential attacks. In addition, BlockChain and Probe detection need to take into account the relationship between the various factors. We should develop a new probe detection technology that uses BlockChain to fine new pattern detection probes in cloud service security in the end. In this paper, we propose a probe detection using Fuzzy Cognitive Map(FCM) and Self Adaptive Module(SAM) based on service security using BlockChain technology.

• Journal of Internet Computing and Services
• /
• v.22 no.2
• /
• pp.29-39
• /
• 2021

As damages to individuals, private sectors, and businesses increase due to newly occurring cyber attacks, the underlying network security problem has emerged as a major problem in computer systems. Therefore, NIDS using machine learning and deep learning is being studied to improve the limitations that occur in the existing Network Intrusion Detection System. In this study, a deep learning-based NIDS model study is conducted using the Convolution Neural Network (CNN) algorithm. For the image classification-based CNN algorithm learning, a discrete algorithm for continuity variables was added in the preprocessing stage used previously, and the predicted variables were expressed in a linear relationship and converted into easy-to-interpret data. Finally, the network packet processed through the above process is mapped to a square matrix structure and converted into a pixel image. For the performance evaluation of the proposed model, NSL-KDD, a representative network packet data, was used, and accuracy, precision, recall, and f1-score were used as performance indicators. As a result of the experiment, the proposed model showed the highest performance with an accuracy of 85%, and the harmonic mean (F1-Score) of the R2L class with a small number of training samples was 71%, showing very good performance compared to other models.

• Convergence Security Journal
• /
• v.9 no.4
• /
• pp.21-27
• /
• 2009

In the environment of development of network bandwidth and intrusion technology there is limit to the pattern analysis of all massed packets through the existing pattern matching method by the intrusion detection system. To detect the packets efficiently when they are received fragmented, it has been presented the matching method only the pattern of packets consisting with the operation system such as Esnort. Pattern matching performance is improved through the use of NMAP, the basic mechanism od Esnort, by scanning the operation system of the same network system and appling pattern match selectively scanned information and the same operation system as the received packets. However, it can be appeared the case of disregarding the receivied packets depending on the diversity of the kind of operation systems and recognition mistake of operation system of nmap. In this paper, we present and verify the improved intrusion detection system shortening the pattern matching time by the creation of hashy table through the pattern hash of intrusion detection system independently with the users system environment .in the state of flux.

• Proceedings of the Korean Institute of Intelligent Systems Conference
• /
• 2002.12a
• /
• pp.243-248
• /
• 2002

빠르게 변해 가는 정보화사회에서 침입 탐지 시스템은 정밀성과 적웅성, 그리고 확장성을 필요로 한다. 또한 복잡한 Network 환경에서 중요하고 기밀성이 유지되어야 할 리소스를 보호하기 위해, 더욱 구조적이고 지능적인 IDS(Intrusion Detection System)개발의 필요성이 요구되고 있다. 본 연구는 이를 위한, 지능적인 IDS를 위해 침입패턴을 생성하기 위한 모델을 도출함에 목적이 있다. 침입 패턴은 방대한 양의 데이터를 갖게 되고, 이를 정확하고 효율적으로 관리하기 위해서 데이터마이닝의 주요 2분야인 Link analysis와 Sequence analysis를 이용하여 정확하고 신뢰성 있는 침입규칙을 생성하기 위한 모델을 도출해낸다 이 모델은 "Time Based Traffic Model", "Host Based Traffic Model", "Content Model"로 각각 상이한 침입 패턴을 생성하게 된다. 이 모델을 이용하면 좀더 효율적이고 안정적으로 패턴을 생성 할 수 있다, 즉 지능형 시스템기반의 침입 탐지 모델을 구현할 수 있다. 이러한 모델로 생성한 규칙은 침입데이터를 대표하는 규칙이 되고, 이는 비정상 사용자와 정상 사용자를 분류하게 된다 모델에 사용된 데이터는 KDD컨테스트의 데이터를 이용하였다. 사용된 데이터는 KDD컨테스트의 데이터를 이용하였다.