• 한국컴퓨터정보학회논문지
• /
• 제24권5호
• /
• pp.149-156
• /
• 2019

The existing subtract image based intrusion detection system for CCTV digital images has a problem that it can not distinguish intruders from moving backgrounds that exist in the natural environment. In this paper, we tried to solve the problems of existing system by designing real - time intrusion detection system for CCTV digital image by combining subtract image based intrusion detection method and background learning artificial neural network technology. Our proposed system consists of three steps: subtract image based intrusion detection, background artificial neural network learning stage, and background artificial neural network evaluation stage. The final intrusion detection result is a combination of result of the subtract image based intrusion detection and the final intrusion detection result of the background artificial neural network. The step of subtract image based intrusion detection is a step of determining the occurrence of intrusion by obtaining a difference image between the background cumulative average image and the current frame image. In the background artificial neural network learning, the background is learned in a situation in which no intrusion occurs, and it is learned by dividing into a detection window unit set by the user. In the background artificial neural network evaluation, the learned background artificial neural network is used to produce background recognition or intrusion detection in the detection window unit. The proposed background learning intrusion detection system is able to detect intrusion more precisely than existing subtract image based intrusion detection system and adaptively execute machine learning on the background so that it can be operated as highly practical intrusion detection system.

• 스마트미디어저널
• /
• 제8권3호
• /
• pp.17-22
• /
• 2019

Signature-based intrusion systems use intrusion detection rules for detecting intrusion. However, writing intrusion detection rules is difficult and requires considerable knowledge of various fields. Attackers may modify previous attempts to escape intrusion detection rules. In this paper, we deal with the problem of detecting modified attacks based on previous intrusion detection rules. We show a simple method of reporting approximate occurrences of at least one of the network intrusion detection rules, based on q-grams and the longest increasing subsequences. Experimental results showed that our approach could detect modified attacks, modeled with edit operations.

• 디지털산업정보학회논문지
• /
• 제8권1호
• /
• pp.81-87
• /
• 2012

Intrusion Detection System that protects system safely is necessary as network technology is developed rapidly and application division is wide. Intrusion Detection System among others can construct system without participation of other severs. But it has weakness that big load in system happens and it has low efficient because every traffics are inspected in case that mass traffic happen. In this study, Distributed Intrusion Detection System based on protocol is proposed to reduce traffic of intrusion detection system and provide stabilized intrusion detection technique even though mass traffic happen. It also copes to attack actively by providing automatic update of using rules to detect intrusion in sub Intrusion Detection System.

• Journal of Information Processing Systems
• /
• 제1권1호
• /
• pp.9-13
• /
• 2005

Computer security has become a critical issue with the rapid development of business and other transaction systems over the Internet. The application of artificial intelligence, machine learning and data mining techniques to intrusion detection systems has been increasing recently. But most research is focused on improving the classification performance of a classifier. Selecting important features from input data leads to simplification of the problem, and faster and more accurate detection rates. Thus selecting important features is an important issue in intrusion detection. Another issue in intrusion detection is that most of the intrusion detection systems are performed by off-line and it is not a suitable method for a real-time intrusion detection system. In this paper, we develop the real-time intrusion detection system, which combines an on-line feature extraction method with the Least Squares Support Vector Machine classifier. Applying the proposed system to KDD CUP 99 data, experimental results show that it has a remarkable feature extraction and classification performance compared to existing off-line intrusion detection systems.

• 한국정보시스템학회지:정보시스템연구
• /
• 제15권4호
• /
• pp.211-224
• /
• 2006

This study investigates the application of data mining techniques such as artificial neural networks, rough sets, and induction teaming to the intrusion detection systems. To maximize the effectiveness of data mining for intrusion detection systems, we introduced the asymmetric costs with false positive errors and false negative errors. And we present a method for intrusion detection systems to utilize the asymmetric costs of errors in data mining. The results of our empirical experiment show our intrusion detection model provides high accuracy in intrusion detection. In addition the approach using the asymmetric costs of errors in rough sets and neural networks is effective according to the change of threshold value. We found the threshold has most important role of intrusion detection model for decreasing the costs, which result from false negative errors.

• 한국정보통신학회논문지
• /
• 제24권1호
• /
• pp.138-140
• /
• 2020

As the IoT is applied to home and industrial networks, data generated by the IoT is being processed at the cloud edge. Intrusion detection function is very important because it can be operated by invading IoT devices through the cloud edge. Data delivered to the edge network in the cloud environment is traffic at the application layer. In order to determine the intrusion of the packet transmitted to the IoT, the intrusion should be detected at the application layer. This paper proposes the intrusion detection function at the application layer excluding normal traffic from IoT intrusion detection function. As the proposed method, we obtained the intrusion detection result by decision tree method and explained the detection result for each feature.

• International Journal of Internet, Broadcasting and Communication
• /
• 제13권3호
• /
• pp.42-49
• /
• 2021

As cyber attacks become more intelligent, there is difficulty in detecting advanced attacks in various fields such as industry, defense, and medical care. IPS (Intrusion Prevention System), etc., but the need for centralized integrated management of each security system is increasing. In this paper, we collect big data for intrusion detection and build an intrusion detection platform using deep learning and CNN (Convolutional Neural Networks). In this paper, we design an intelligent big data platform that collects data by observing and analyzing user visit logs and linking with big data. We want to collect big data for intrusion detection and build an intrusion detection platform based on CNN model. In this study, we evaluated the performance of the Intrusion Detection System (IDS) using the KDD99 dataset developed by DARPA in 1998, and the actual attack categories were tested with KDD99's DoS, U2R, and R2L using four probing methods.

• 전기전자학회논문지
• /
• 제26권4호
• /
• pp.622-627
• /
• 2022

본 논문에서는 공격 횟수와 공격 유형을 모두 고려하여 차량 내 네트워크에서 해킹을 탐지하는 침입 탐지 시스템의 성능을 개선하는 기법을 제안한다. 침입 탐지 시스템에서 침입을 정상으로 잘못 인식하는 FNR(False Negative Rate)과 정상을 침입으로 잘못 인식하는 FPR(False Positive Rate)은 모두 차량의 안전에 큰 영향을 미친다. 본 논문에서는 일정 홧수 이상 공격으로 탐지된 데이터 프레임을 자동적으로 공격으로 처리하며, 자동 공격으로 판단하는 방법도 공격 유형에 따라 다르게 적용함으로서 FNR과 FPR을 모두 개선하는 침입 탐지 기법을 제안하였다. 시뮬레이션 결과 제안하는 기법은 DoS(Denial of Service) 공격과 Spoofing 공격에서 FNR과 FPR을 효과적으로 개선할 수 있었다.

• 한국전자통신학회논문지
• /
• 제11권6호
• /
• pp.619-626
• /
• 2016

침입 탐지 모델은 침입 행위가 발생할 때 침입을 탐지하기 위해 사용하는 모델로서 침입 패턴을 잘 표현하기 위해서는 먼저 침입 패턴의 유형에 대해 분석하고 각 유형별로 침입 패턴에 대한 표현 방법을 제공할 수 있어야 한다. 특히 하나의 호스트 레벨의 침입뿐만 아니라 다중 호스트를 이용한 네트워크 레벨의 침입을 탐지하기 위해서는 이러한 다중 침입의 유형을 정의하고 다중 침입에 대한 표현 방법을 제공해야 한다. 본 논문에서는 침입 탐지 시스템의 안전성에 대한 검증 방법을 제공하는 다중 침입 탐지 모델을 제안하고 제안한 모델의 안전성을 검증하며 다른 모델들과 비교 평가한다.

• International Journal of Computer Science & Network Security
• /
• 제24권4호
• /
• pp.179-191
• /
• 2024

With the advancement of modern technology, cyber-attacks are always rising. Specialized defense systems are needed to protect organizations against these threats. Malicious behavior in the network is discovered using security tools like intrusion detection systems (IDS), firewall, antimalware systems, security information and event management (SIEM). It aids in defending businesses from attacks. Delivering advance threat feeds for precise attack detection in intrusion detection systems is the role of cyber-threat intelligence (CTI) in the study is being presented. In this proposed work CTI feeds are utilized in the detection of assaults accurately in intrusion detection system. The ultimate objective is to identify the attacker behind the attack. Several data sets had been analyzed for attack detection. With the proposed study the ability to identify network attacks has improved by using machine learning algorithms. The proposed model provides 98% accuracy, 97% precision, and 96% recall respectively.