• Journal of the Korea Institute of Military Science and Technology
• /
• v.19 no.1
• /
• pp.57-65
• /
• 2016

Threat evaluation is a process to estimate the threat score which enemy aerial threat poses to defended assets. The objective of threat evaluation is concerned with making an engagement priority list for optimal weapon allocation. Traditionally, the threat evaluation of massive air threats has been carried out by air defence experts, but the human decision making is less effective in real aerial attack situations with massive enemy fighters. Therefore, automation to enhance the speed and efficiency of the human operation is required. The automatic threat evaluation by air defense experts who will perform multi-variable judgment needs formal models to accurately quantify their linguistic evaluation of threat level. In this paper we propose a threat evaluation model by using a fuzzy rule-based inference method. Fuzzy inference is an appropriate method for quantifying threat level and integrating various threat attribute information. The performance of the model has been tested with a simulation that reflected real air threat situation and it has been verified that the proposed model was better than two conventional threat evaluation models.

• Convergence Security Journal
• /
• v.18 no.2
• /
• pp.19-24
• /
• 2018

In this study, for evaluating the cyber threat, we presented a quantitative assessment measures of the threat-level with multiple factors. The model presented in the study is a compound model with the 4 factors; the attack method, the actor, the strength according to the type of the threat, and the proximity to the target. And the threat-level can be quantitatively evaluated with the Fuzzy Inference. The model will take the information in natural language and present the threat-level with quantified data. Therefore an organization can accurately evaluate the cyber threat-level and take it into account for judging threat.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.12 no.4
• /
• pp.1887-1898
• /
• 2018

In this paper, a method to classify insider threat activity is introduced. The internal threats help detecting anomalous activity in the procedure performed by the user in an organization. When an anomalous value deviating from the overall behavior is displayed, we consider it as an inside threat for classification as an inside intimidator. To solve the situation, Markov Chain Model is employed. The Markov Chain Model shows the next state value through an arbitrary variable affected by the previous event. Similarly, the current activity can also be predicted based on the previous activity for the insider threat activity. A method was studied where the change items for such state are defined by a transition probability, and classified as detection of anomaly of the inside threat through values for a probability variable. We use the properties of the Markov chains to list the behavior of the user over time and to classify which state they belong to. Sequential data sets were generated according to the influence of n occurrences of Markov attribute and classified by machine learning algorithm. In the experiment, only 15% of the Cert: insider threat dataset was applied, and the result was 97% accuracy except for NaiveBayes. As a result of our research, it was confirmed that the Markov Chain Model can classify insider threats and can be fully utilized for user behavior classification.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.21 no.4
• /
• pp.15-23
• /
• 2021

In most hacking attacks, hackers intrudes inside for a long period of time and attempts to communicate with the outside using a circumvent connection to achieve purpose. research in response to advanced and intelligent cyber threats has been mainly conducted with signature-based detection and blocking methods, but recently it has been extended to threat hunting methods. attacks from organized hacking groups are advanced persistent attacks over a long period of time, and bypass remote attacks account for the majority. however, even in the intrusion detection system using intelligent recognition technology, it only shows detection performance of the existing intrusion status. therefore, countermeasures against targeted bypass rwjqthrwkemote attacks still have limitations with existing detection methods and threat hunting methods. in this paper, to overcome theses limitations, we propose a model that can detect the targeted circumvent connection remote attack threat of an organized hacking group. this model designed a threat hunting process model that applied the method of verifying the origin IP of the remote circumvent connection, and verified the effectiveness by implementing the proposed method in actual defense information system environment.

• Convergence Security Journal
• /
• v.22 no.1
• /
• pp.19-27
• /
• 2022

With the innovative development of ICT technology, hacking techniques of hackers are also evolving into sophisticated and intelligent hacking techniques. Threat detection research to counter these cyber threats was mainly conducted in a passive way through hacking damage investigation and analysis, but recently, the importance of cyber threat information collection and analysis is increasing. A bot-type automation program is a rather active method of extracting malicious code by visiting a website to collect threat information or detect threats. However, this method also has a limitation in that it cannot prevent hacking damage because it is a method to identify hacking damage because malicious code has already been distributed or after being hacked. Therefore, to overcome these limitations, we propose a model that detects actual threats by acquiring and analyzing threat information while identifying and managing cyber bases. This model is an active and proactive method of collecting threat information or detecting threats outside the boundary such as a firewall. We designed a model for detecting threats using cyber strongholds and validated them in the defense environment.

• The Journal of Korean Institute of Electromagnetic Engineering and Science
• /
• v.20 no.12
• /
• pp.1333-1339
• /
• 2009

A MWR(Missile Warning Radar) of GVES(Ground Vehicle Equipment System) has to effectively decide the threat for a detected target. Linear Approximation Fitting(LAF) and Weighted Linear Approximation Fitting(WLAF) algorithm is proposed as algorithm for a threat decision method. The target is classified into a threat or non-threat using a boundary condition of the angular rate, and the boundary condition is determined using probability model simulation. This paper confirms the performance of proposed threat decision algorithm using measurement.

• Asia pacific journal of information systems
• /
• v.23 no.2
• /
• pp.87-109
• /
• 2013

While many surveys show very positive attitudes on the part of consumers towards eco-friendly products, the market share actually reflecting green IT purchases remains low in most countries. The motivations behind green IT purchase behavior are still obscure. Several studies have addressed the question of green IT diffusion from economic and normative viewpoints in an attempt to interpret IT adoption behavior. This study comes at the question from a different angle, namely negative frame, examining threat and coping behaviors using the Ordered Protection Motivation (OPM) model and threat appraisal theory. The results show that attitudes toward fairness and positive change, which are precedents of threat appraisal, play an important role in determining threat appraisal. Perceived threats in the green IT arena include habit change and ecological change. Appraisal for coping with these threats directly affects initial adoption behaviors regarding available green IT, and then indirectly encourages the purchase of new green IT products.

• Journal of Platform Technology
• /
• v.11 no.2
• /
• pp.15-25
• /
• 2023

This study analyzes the limitations of the insider threat datasets used for insider threat detection research and compares and analyzes the solution-based insider threat data with public insider threat data using a security solution to overcome this. Through this, we design a data format suitable for insider threat detection and implement a system that can safely share insider threat information between different institutions and companies using blockchain technology. Currently, there is no dataset collected based on actual events in the insider threat dataset that is revealed to researchers. Public datasets are virtual synthetic data randomly created for research, and when used as a learning model, there are many limitations in the real environment. In this study, to improve these limitations, a private blockchain was designed to secure information sharing between institutions of different affiliations, and a method was derived to increase reliability and maintain information integrity and consistency through agreement and verification among participants. The proposed method is expected to collect data through an outflow threat collector and collect quality data sets that posed a threat, not synthetic data, through a blockchain-based sharing system, to solve the current outflow threat dataset problem and contribute to the insider threat detection model in the future.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.12 no.7
• /
• pp.3245-3250
• /
• 2011

This study introduces a threat level assessment model adapting Fuzzy theories in order to help make decisions for better covering quantitative factors and qualitative ones together. The threat is classified into three major categories - one resulting from navigational condition, another from target vessel specification and the other from external decision environment. The threat levels by each category are examined by a fuzzy inference, and its corresponding weights are assigned via fuzzy measures. Finally the high level threat measures become integrated via a Choquet Fuzzy Integral method into ultimate threat level indicators.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.5
• /
• pp.873-883
• /
• 2013

Security vulnerability quantification is the method that identify potential vulnerabilities by scoring vulnerabilities themselves and their countermeasures. However, due to the structural feature of smart grid system, it is difficult to apply existing security threat evaluation schemes. In this paper, we propose a network model to evaluate smartgrid security threat for AMI and derive attack scenarios. Additionally, we show that the result of security threat evaluation for proposed network model and attack scenario by applying MTTC scheme.