• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.4
• /
• pp.617-629
• /
• 2020

In order to overcome the limitations of the rule-based intrusion detection system due to changes in Internet computing environments, the emergence of new services, and creativity of attackers, network anomaly detection (NAD) using machine learning and deep learning technologies has received much attention. Most of these existing machine learning and deep learning technologies for NAD use supervised learning methods to learn a set of training data set labeled 'normal' and 'attack'. This paper presents the feasibility of the unsupervised learning AutoEncoder(AE) to NAD from data sets collecting of secured network traffic without labeled responses. To verify the performance of the proposed AE mode, we present the experimental results in terms of accuracy, precision, recall, f1-score, and ROC AUC value on the NSL-KDD training and test data sets. In particular, we model a reference AE through the deep analysis of diverse AEs varying hyper-parameters such as the number of layers as well as considering the regularization and denoising effects. The reference model shows the f1-scores 90.4% and 89% of binary classification on the KDDTest+ and KDDTest-21 test data sets based on the threshold of the 82-th percentile of the AE reconstruction error of the training data set.

• Journal of the Korea Society of Computer and Information
• /
• v.25 no.4
• /
• pp.29-35
• /
• 2020

In this paper, we propose a new structured entity recognition DeNERT model. Recently, the field of natural language processing has been actively researched using pre-trained language representation models with a large amount of corpus. In particular, the named entity recognition, which is one of the fields of natural language processing, uses a supervised learning method, which requires a large amount of training dataset and computation. Reinforcement learning is a method that learns through trial and error experience without initial data and is closer to the process of human learning than other machine learning methodologies and is not much applied to the field of natural language processing yet. It is often used in simulation environments such as Atari games and AlphaGo. BERT is a general-purpose language model developed by Google that is pre-trained on large corpus and computational quantities. Recently, it is a language model that shows high performance in the field of natural language processing research and shows high accuracy in many downstream tasks of natural language processing. In this paper, we propose a new named entity recognition DeNERT model using two deep learning models, DQN and BERT. The proposed model is trained by creating a learning environment of reinforcement learning model based on language expression which is the advantage of the general language model. The DeNERT model trained in this way is a faster inference time and higher performance model with a small amount of training dataset. Also, we validate the performance of our model's named entity recognition performance through experiments.

• Database Research
• /
• v.34 no.3
• /
• pp.137-147
• /
• 2018

A key to a well-performing human activity recognition (HAR) system through machine learning technique is the availability of a substantial amount of labeled data. Collecting sufficient labeled data is an expensive and time-consuming task. To build a HAR system in a new environment (i.e., the target domain) with very limited labeled data, it is unfavorable to naively exploit the data or trained classifier model from the existing environment (i.e., the source domain) as it is due to the domain difference. While traditional machine learning approaches are unable to address such distribution mismatch, transfer learning approach leverages the utilization of knowledge from existing well-established source domains that help to build an accurate classifier in the target domain. In this work, we propose a transfer learning approach to create an accurate HAR classifier with very limited data through the multitask neural network. The classifier loss function minimization for source and target domain are treated as two different tasks. The knowledge transfer is performed by simultaneously minimizing the loss function of both tasks using a single neural network model. Furthermore, we utilize the unlabeled data in an unsupervised manner to help the model training. The experiment result shows that the proposed work consistently outperforms existing approaches.

• KIPS Transactions on Software and Data Engineering
• /
• v.12 no.8
• /
• pp.355-364
• /
• 2023

As advanced cyber threats continue to increase in recent years, it is difficult to detect new types of cyber attacks with existing pattern or signature-based intrusion detection method. Therefore, research on anomaly detection methods using data learning-based artificial intelligence technology is increasing. In addition, supervised learning-based anomaly detection methods are difficult to use in real environments because they require sufficient labeled data for learning. Research on an unsupervised learning-based method that learns from normal data and detects an anomaly by finding a pattern in the data itself has been actively conducted. Therefore, this study aims to extract a latent vector that preserves useful sequence information from sequence log data and develop an anomaly detection learning model using the extracted latent vector. Word2Vec was used to create a dense vector representation corresponding to the characteristics of each sequence, and an unsupervised autoencoder was developed to extract latent vectors from sequence data expressed as dense vectors. The developed autoencoder model is a recurrent neural network GRU (Gated Recurrent Unit) based denoising autoencoder suitable for sequence data, a one-dimensional convolutional neural network-based autoencoder to solve the limited short-term memory problem that GRU can have, and an autoencoder combining GRU and one-dimensional convolution was used. The data used in the experiment is time-series-based NGIDS (Next Generation IDS Dataset) data, and as a result of the experiment, an autoencoder that combines GRU and one-dimensional convolution is better than a model using a GRU-based autoencoder or a one-dimensional convolution-based autoencoder. It was efficient in terms of learning time for extracting useful latent patterns from training data, and showed stable performance with smaller fluctuations in anomaly detection performance.

• Nuclear Engineering and Technology
• /
• v.56 no.4
• /
• pp.1501-1512
• /
• 2024

Plasma disruption in tokamak experiments is a challenging issue that causes damage to the device. Reliable prediction methods are needed, but the lack of full understanding of plasma disruption limits the effectiveness of physics-driven methods. Data-driven methods based on supervised learning are commonly used, and they rely on labelled training data. However, manual labelling of disruption precursors is a time-consuming and challenging task, as some precursors are difficult to accurately identify. The mainstream labelling methods assume that the precursor onset occurs at a fixed time before disruption, which leads to mislabeled samples and suboptimal prediction performance. In this paper, we present disruption prediction methods based on anomaly detection to address these issues, demonstrating good prediction performance on J-TEXT and EAST. By evaluating precursor onset times using different anomaly detection algorithms, it is found that labelling methods can be improved since the onset times of different shots are not necessarily the same. The study optimizes precursor labelling using the onset times inferred by the anomaly detection predictor and test the optimized labels on supervised learning disruption predictors. The results on J-TEXT and EAST show that the models trained on the optimized labels outperform those trained on fixed onset time labels.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.11 no.2
• /
• pp.517-524
• /
• 2010

Recently, the size of online texts and textual information is increasing explosively, and the automated classification has a great potential for handling data such as news materials and images. Text classification system is based on supervised learning which needs laborous work by human expert. The main goal of this paper is to reduce the manual intervention, required for the task. The other goal is to increase accuracy to be high. Most of the documents have high complexity in contents and the high similarities in their described style. So, the classification results are not satisfactory. This paper shows the implementation of classification system based on ETOM+RPost algorithm and classification progress using SPAM data. In experiments, we verified our system with right-training documents and wrong-training documents. The experimental results show that our system has high accuracy and stability in all situation as 16% improvement in accuracy.

• Journal of KIISE:Software and Applications
• /
• v.32 no.8
• /
• pp.693-703
• /
• 2005

Given the local traders with pattern-based multi-predictors of stock prices, we study a method of dynamic asset allocation to maximize the trading performance. To optimize the proportion of asset allocated to each recommendation of the predictors, we design an asset allocation strategy called meta policy in the reinforcement teaming framework. We utilize both the information of each predictor's recommendations and the ratio of the stock fund over the total asset to efficiently describe the state space. The experimental results on Korean stock market show that the trading system with the proposed meta policy outperforms other systems with fixed asset allocation methods. This means that reinforcement learning can bring synergy effects to the decision making problem through exploiting supervised-learned predictors.

• Journal of Intelligence and Information Systems
• /
• v.15 no.4
• /
• pp.23-36
• /
• 2009

Network intrusion detection have been continuously improved by using data mining techniques. There are two kinds of methods in intrusion detection using data mining-supervised learning with class label and unsupervised learning without class label. In this paper we have studied the way of improving network intrusion detection accuracy by using LBG clustering algorithm which is one of unsupervised learning methods. The K-means method, that starts with random initial centroids and performs clustering based on the Euclidean distance, is vulnerable to noisy data and outliers. The nonuniform binary split algorithm uses binary decomposition without assigning initial values, and it is relatively fast. In this paper we applied the EM(Expectation Maximization) based LBG algorithm that incorporates the strength of two algorithms to intrusion detection. The experimental results using the KDD cup dataset showed that the accuracy of detection can be improved by using the LBG algorithm.

• The KIPS Transactions:PartB
• /
• v.9B no.1
• /
• pp.119-128
• /
• 2002

This paper proposes an efficient recognition method of car license plate from the car images by using both the dynamical thresholding and the neural network with enhanced learning algorithm. The car license plate is extracted by the dynamical thresholding based on the structural features and the density rates. Each characters and numbers from the p]ate is also extracted by the contour tracking algorithm. The enhanced neural network is proposed for recognizing them, which has the algorithm of combining the modified ART1 and the supervised learning method. The proposed method has applied to the real-world car images. The simulation results show that the proposed method has better the extraction rates than the methods with information of the gray brightness and the RGB, respectively. And the proposed method has better recognition performance than the conventional backpropagation neural network.

• Journal of the Institute of Electronics and Information Engineers
• /
• v.54 no.8
• /
• pp.81-88
• /
• 2017

This paper proposes a method of detecting rain regions from a single image. More specifically, a way of training the deep convolutional neural network based on the collected rain and non-rain patches is presented in a supervised manner. It is also shown that the proposed rain detection method based on deep convolutional neural network can provide better performance than the conventional rain detection method based on dictionary learning. Moreover, it is confirmed that the application of the proposed rain detection for rain removal can lead to some improvement in detail representation on the low-frequency regions of the rain-removed images. Additionally, this paper introduces the rain transfer method that inserts rain patterns into original images, thereby producing rain effects on the resulting images. The proposed rain transfer method could be used to augment rain patterns while constructing rain database.