• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.11 no.10
• /
• pp.5023-5038
• /
• 2017

Big data is an emerging technology which deals with wide range of data sets with sizes beyond the ability to work with software tools which is commonly used for processing of data. When we consider a huge network, we have to process a large amount of network information generated, which consists of both normal and abnormal activity logs in large volume of multi-dimensional data. Intrusion Detection System (IDS) is required to monitor the network and to detect the malicious nodes and activities in the network. Massive amount of data makes it difficult to detect threats and attacks. Sequential Pattern mining may be used to identify the patterns of malicious activities which have been an emerging popular trend due to the consideration of quantities, profits and time orders of item. Here we propose a sequential pattern mining algorithm with fuzzy logic feature selection and fuzzy weighted support for huge volumes of network logs to be implemented in Apache Hadoop YARN, which solves the problem of speed and time constraints. Fuzzy logic feature selection selects important features from the feature set. Fuzzy weighted supports provide weights to the inputs and avoid multiple scans. In our simulation we use the attack log from NS-2 MANET environment and compare the proposed algorithm with the state-of-the-art sequential Pattern Mining algorithm, SPADE and Support Vector Machine with Hadoop environment.

• Convergence Security Journal
• /
• v.13 no.1
• /
• pp.19-24
• /
• 2013

MANET has a highly dynamic topology because it consists of only mobile nodes. Various attacks using these characteristics exist. Among them, damage of the attacks based flooding such as DoS or DDos is large and traceback of the attack node is not easy. It is because route information by moving of intermediate nodes which pass the data changes frequently. In this paper, we propose table-based traceback technique to perform efficient traceback although route information by moving of nodes changes frequently. Cluster head manages route management table in order to form cluster status table and network topology snapshot for storing the location information of mobile nodes when cluster member nodes change. Also, bloom filter is used to reduce the amount of storing route information. The performance of the proposed technique is confirmed through experiment.

• Journal of the Institute of Electronics Engineers of Korea TC
• /
• v.44 no.3 s.357
• /
• pp.33-40
• /
• 2007

In this paper, low-rate TCP attack as one of shrew attacks is considered and the scaling based dynamic time warping (S-DTW) algorithm is introduced. The low-rate TCP attack can not be detected by the detection method for the previous flooding DoS/DDoS (Denial of Service/Distirbuted Denial of Service) attacks due to its low average traffic rate. It, however, is a periodic short burst that exploits the homogeneity of the minimum retransmission timeout (RTO) of TCP flows and then some pattern matching mechanisms have been proposed to detect it among legitimate input flows. A DTW mechanism as one of detection approaches has proposed to detect attack input stream consisting of many legitimate or attack flows, and shown a depending method as well. This approach, however, has a problem that legitimate input stream may be caught as an attack one. In addition, it is difficult to decide a threshold for separation between the legitimate and the malicious. Thus, the causes of this problem are analyzed through simulation and the scaling by maximum auto-correlation value is executed before computing the DTW. We also discuss the results on applying various scaling approaches and using standard deviation of input streams monitored.

• KIPS Transactions on Computer and Communication Systems
• /
• v.4 no.10
• /
• pp.349-360
• /
• 2015

In recent year, phishing attacks are flooding with services based on the web technology. Phishing is affecting online security significantly day by day with the vulnerability of web pages. To prevent phishing attacks, a lot of anti-phishing techniques has been made with their own advantages and dis-advantages respectively, but the phishing attack has not been eradicated completely yet. In this paper, we have studied phishing in detail and categorize a process of phishing attack in two parts - Landing-phase, Attack-phase. In addition, we propose an phishing detection methodology based on web sites heuristic. To extract web sites features, we focus on URL and source codes of web sites. To evaluate performance of the suggested method, set up an experiment and analyze its results. Our methodology indicates the detection accuracy of 98.9% with random forest algorithm. The evaluation of proof-of-concept reveals that web site features can be used for phishing detection.

• Proceedings of the Korea Contents Association Conference
• /
• 2004.11a
• /
• pp.215-219
• /
• 2004

A rapid development of the network brought increasing of many damage cases by hacker's attack. In recently many network and system resources are damaged by traffic flooding attacks. For this reason, the protection of network resources by analyzing traffic on the network is on the rise. In this paper, algorithm that improves the executing time and detection rate than traffic analysis method using SNMP is proposed and implemented.

• Proceedings of the IEEK Conference
• /
• 2002.07b
• /
• pp.928-931
• /
• 2002

Network based intrusion detection system is a computer network security tool. In this paper, we present an intrusion detection system based on Self-Organizing Maps (SOM) and Resilient Propagation Neural Network (RPROP) for visualizing and classifying intrusion and normal patterns. We introduce a cluster matching equation for finding principal associated components in component planes. We apply data from The Third International Knowledge Discovery and Data Mining Tools Competition (KDD cup'99) for training and testing our prototype. From our experimental results with different network data, our scheme archives more than 90 percent detection rate, and less than 5 percent false alarm rate in one SYN flooding and two port scanning attack types.

• Proceedings of the Korean Institute of Intelligent Systems Conference
• /
• 2003.05a
• /
• pp.197-201
• /
• 2003

해킹을 방지하기 위한 목적으로 개발된 보안 도구들 중 네트워크 취약점을 검색할 수 있도록 만들어진 프로그램들이 있다. 네트워크 취약점을 자동 검색해 주는 보안 관리 도구를 역이용하여 침입하고자 하는 시스템의 보안 취약점 정보를 알아내는데 사용하여, 알아낸 정보들을 가지고 공격 대상을 찾는데 활용하고 있다. 해킹 수법들에는 서비스 거부 공격, 버퍼오버플로우 공격 등이 있다. 따라서, 해커들이 침입하기 위하여 취약점을 알아내려고 의도하는 침입시도들을 탐지하여 침입이 일어나는 것을 사전에 방어할 수 있는 침입시도탐지가 적극적인 예방차원에서 더욱 필요하다. 본 논문에서는 이러한 취약점을 이용하여 침입시도를 하는 사전 공격형태인 서비스 거부 공격 중 TCP 프로토콜을 사용하는 Syn Flooding 공격에 대하여 패킷분석을 통하여 탐지하고 탐지된 경우 실제 침입의 위험수준을 고려하여 시스템관리자가 대처하는 방어수준을 적절히 조절하여 침입의 위험수준에 따른 방어대책이 가능한 침입시도 방지 모델을 제시한다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.11 no.9
• /
• pp.4641-4657
• /
• 2017

Named Data Networking (NDN) has emerged and become one of the most promising architectures for future Internet. However, like traditional IP-based networking paradigm, NDN may not evade some typical network threats such as malicious data aggregates (MDA), which may lead to bandwidth exhaustion, traffic congestion and router overload. This paper firstly analyzes the damage effect of MDA using realistic simulations in large-scale network topology, showing that it is not just theoretical, and then designs a fine-grained MDA mitigation mechanism (MDAM) based on the cooperation between routers via alert messages. Simulations results show that MDAM can significantly reduce the Pending Interest Table overload in involved routers, and bring in normal data-returning rate and data-retrieval delay.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.10a
• /
• pp.715-717
• /
• 2003

DoS (Denial of Service) 공격은 주로 victim 호스트에 대량의 패킷을 보내거나 비정상적인 패킷을 보냄으로써 정상 사용자가 서비스를 이음하지 못하도록 하는 공격을 의미한다. 이러한 DoS 공격을 탐지하기 위해 다양한 기법들이 개발되어 왔으나, 공격의 종류와 방법은 시간이 흐를수록 매우 다양해지고 있어 이를 탐지하는데 한계가 있다. 본 논문에서는 네트워크 패킷의 헤더정보를 감사 자료로 가지고 있는 NIDS (Network-based Intrusion Detection System)에 데이터 마이닝 기법을 적용기켜 이러한 DoS 공격을 탐지할 수 있는 기법을 제안한다. 이 기법을 이용하면 빠르고 자동화된 방법으로 DoS 공격을 탐지할 수 있다. 본 논문에서는 제안 기법을 이용하여 SYN Flooding 공격과 Teardown 공격에 대한 탐지가 가능함을 보인다.

• International Journal of Computer Science & Network Security
• /
• v.22 no.1
• /
• pp.276-282
• /
• 2022

One of the most essential foundations upon which big institutions rely in delivering cloud computing and hosting services, as well as other kinds of multiple digital services, is the security of infrastructures for digital and information services throughout the world. Distributed denial-of-service (DDoS) assaults are one of the most common types of threats to networks and data centers. Denial of service attacks of all types operates on the premise of flooding the target with a massive volume of requests and data until it reaches a size bigger than the target's energy, at which point it collapses or goes out of service. where it takes advantage of a flaw in the Transport Control Protocol's transmitting and receiving (3-way Handshake) (TCP). The current study's major focus is on an architecture that stops DDoS attacks assaults by producing code for DDoS attacks using a cloud controller and calculating Round-Tripe Time (RTT).