• Journal of KIISE:Databases
• /
• v.34 no.6
• /
• pp.473-482
• /
• 2007

Network-based IDS(Intrusion Detection System) gathers network packet data and analyzes them into attack or normal. They raise alarm when possible intrusion happens. But they often output a large amount of low-level of incomplete alert information. Consequently, a large amount of incomplete alert information that can be unmanageable and also be mixed with false alerts can prevent intrusion response systems and security administrator from adequately understanding and analyzing the state of network security, and initiating appropriate response in a timely fashion. So it is important for the security administrator to reduce the redundancy of alerts, integrate and correlate security alerts, construct attack scenarios and present high-level aggregated information. False alarm rate is the ratio between the number of normal connections that are incorrectly misclassified as attacks and the total number of normal connections. In this paper we propose a false alarm classification model to reduce the false alarm rate using classification analysis of data mining techniques. The proposed model can classify the alarms from the intrusion detection systems into false alert or true attack. Our approach is useful to reduce false alerts and to improve the detection rate of network-based intrusion detection systems.

• Convergence Security Journal
• /
• v.20 no.5
• /
• pp.11-17
• /
• 2020

With the increase in cases of using Bluetooth devices used in the electric vehicle charging systems, security issues are also raised. Although various technical efforts have beed made to enhance security of bluetooth technology, various attack methods exist. In this paper, we propose an intelligent Bluetooth intrusion detection system based on a well-known machine learning method, Hidden Markov Model, for the purpose of detecting intelligently representative Bluetooth attack methods. The proposed approach combines packet types of H4, which is bluetooth transport layer protocol, and the transport directions of the packet firstly to represent the behavior of current traffic, and uses the temporal deployment of these combined types as the final input features for detecting attacks in real time as well as accurate detection. We construct the experimental environment for the data acquisition and analysis the performance of the proposed system against obtained data set.

• Proceedings of the IEEK Conference
• /
• 2002.06e
• /
• pp.43-46
• /
• 2002

This paper deals with a denial of service is about without permission knocking off service, for example through crashing the whole system. Another definition is that denial of service is seeing to that someone don't get what they paid for. The Network Denial of service Attack Detection System designed and implemented through suggested algorithm can detect attacking from the outside among denial of service attacks. It shown that designed system gives the system administrator the opportunity to detect denial of service attack.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.41 no.8
• /
• pp.877-889
• /
• 2016

In this paper, we introduce the basic components of the Cognitive Radio Networks along with possible threats. Specifically, we investigate the SSDF (Spectrum Sensing Data Falsification) attack which is one of the easiest attack to carry out. Despite its simplicity, the SSDF attack needs careful attention in order to build a secure system that resists to it. The proposed scheme utilizes the Anomaly Detection technique to identify malicious users as well as their sensing reports. The simulation results shows that the proposed scheme can effectively detect erroneous sensing reports and thus result in correct detection of the active primary users.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.38C no.11
• /
• pp.1074-1077
• /
• 2013

This paper analyzes the benefit of using directional antennas against eavesdropping attack in millimeter wave (mmWave)-based networks. All devices are equipped with a directional antenna or an omni-directional antenna in a single-hop communications. The probability of a device being detected by an eavesdropper is analyzed based on the exposure region of a device. The relative detection rate is introduced to represent the benefit of using directional antenna. Numerical results show that there exists an optimal number of devices that maximizes the detection probability and it varies according to the parameters such as antenna beamwidth. It shows that the use of directional antenna enables to protect the devices from the detection by an eavesdropper for almost the whole situation in mmWave band communication.

• Journal of the Korea Society of Computer and Information
• /
• v.21 no.1
• /
• pp.73-78
• /
• 2016

In wireless sensor networks, sensors have capabilities of sensing and wireless communication, computing power and collect data such as sound, movement, vibration. Sensors need to communicate wirelessly to send their sensing data to other sensors or the base station and so they are vulnerable to many attacks like garbage packet injection that cannot be prevented by using traditional cryptographic mechanisms. To defend against such attacks, a behavior-based attack detection is used in which some specialized monitoring nodes overhear the communications of their neighbors(normal nodes) to detect illegitimate behaviors. It is desirable that the total sensing area of normal nodes covered by monitoring nodes is as large as possible. The previous researches have focused on selecting the monitoring nodes so as to maximize the number of normal nodes(node coverage), which does not guarantee that the area sensed by the selected normal nodes is maximized. In this study, we have developed an algorithm for selecting the monitoring nodes needed to cover the maximum sensing area. We also have compared experimentally the covered sensing areas computed by our algorithm and the node coverage algorithm.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.17 no.1
• /
• pp.76-89
• /
• 2013

In this paper, we propose a novel optical fault detection scheme for RSA hardware based on Montgomery exponentiation, which can effectively detect optical fault injection during the exponent calculation. To protect the RSA hardware from the optical fault injection attack, we implemented integrity check logic for memory and optical fault detection logic for Montgomery-based multiplier. The proposed scheme is considered to be safe from various type of attack and it can be implemented with no additional operation time and small area overhead which is less than 3%.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2015.04a
• /
• pp.424-427
• /
• 2015

근래 들어 모바일 기기의 시스템을 장악하여 사용자의 기밀 정보를 빼내는 악성 행위의 한 방법으로 Code Reuse Attack (CRA)이 널리 사용되고 있다. 이와 같은 CRA를 막기 위하여 call-return이 일어날 때마다 이들 address를 비교해 보는 shadow stack과 branch에 대한 몇 가지 규칙을 두어 CRA 를 탐지하는 branch regulation과 같은 방식이 연구되었다. 우리는 shadow stack과 branch regulation을 종합하여 여러 종류의 CRA를 적은 성능 오버헤드로 탐지할 수 있는 CRA Detection System을 만들고자 한다. 이를 위하여 반드시 선행 되어야 할 연구인 바이너리 파일 분석과 meta-data 생성 및 압축 기술을 제안한다. 실험 결과 생성된 meta-data는 압축 기술을 적용하기 전보다 1/2에서 1/3 가량으로 그 크기가 줄어들었으며 CRA Detection System의 탐지가 정상적으로 동작하는 것 또한 확인할 수 있었다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.3
• /
• pp.365-371
• /
• 2021

With the rapid growth in Internet users, web applications are becoming the main target of hackers. Most previous WAFs (Web Application Firewalls) target every single HTTP request packet rather than the overall behavior of the attacker, and are known to be difficult to detect new types of attacks. In this paper, we propose a web attack detection system based on user behavior using machine learning to detect attacks of unknown patterns. In order to define user behavior, we focus on features excluding areas where an attacker can camouflage as a normal user. The experimental results shows that by using the path and query information to define users' behaviors, best results for an accuracy of 99% with Decision forest.

• International Journal of Computer Science & Network Security
• /
• v.23 no.7
• /
• pp.131-140
• /
• 2023

Network security situational awareness systems helps in better managing the security concerns of a network, by monitoring for any anomalies in the network connections and recommending remedial actions upon detecting an attack. An Intrusion Detection System helps in identifying the security concerns of a network, by monitoring for any anomalies in the network connections. We have proposed a CRF based IDS system using genetic search feature selection algorithm for network security situational awareness to detect any anomalies in the network. The conditional random fields being discriminative models are capable of directly modeling the conditional probabilities rather than joint probabilities there by achieving better classification accuracy. The genetic search feature selection algorithm is capable of identifying the optimal subset among the features based on the best population of features associated with the target class. The proposed system, when trained and tested on the bench mark NSL-KDD dataset exhibited higher accuracy in identifying an attack and also classifying the attack category.