• Title/Summary/Keyword: network log analysis

Search Result 129, Processing Time 0.026 seconds

Design for Zombie PCs and APT Attack Detection based on traffic analysis (트래픽 분석을 통한 악성코드 감염PC 및 APT 공격탐지 방안)

  • Son, Kyungho;Lee, Taijin;Won, Dongho
    • Journal of the Korea Institute of Information Security & Cryptology
    • /
    • v.24 no.3
    • /
    • pp.491-498
    • /
    • 2014
  • Recently, cyber terror has been occurred frequently based on advanced persistent threat(APT) and it is very difficult to detect these attacks because of new malwares which cannot be detected by anti-virus softwares. This paper proposes and verifies the algorithms to detect the advanced persistent threat previously through real-time network monitoring and combinatorial analysis of big data log. In the future, APT attacks can be detected more easily by enhancing these algorithms and adapting big data platform.

An Analysis of Network Structure in Housing Markets: the Case of Apartment Sales Markets in the Capital Region (주택시장의 네트워크 구조 분석: 수도권 아파트 매매시장의 사례)

  • Jeong, Jun Ho
    • Journal of the Economic Geographical Society of Korea
    • /
    • v.17 no.2
    • /
    • pp.280-295
    • /
    • 2014
  • This paper analyzes the topological structure of housing market networks with an application of minimal spanning tree method into apartment sales markets in the Capital Region over the period 2003.7-2014.3. The characteristics of topological network structure gained from this application to some extent share with those found in equity markets, although there are some differences in their intensities and degrees, involving a hierarchical structure in networks, an existence of communities or modules in networks, a contagious diffusion of log-return rate across nodes over time, an existence of correlation breakdown due to the time-dependent structure of networks and so on. These findings could be partially attributed to the facts that apartments as a quasi-financial asset have been strongly overwhelmed by speculative motives over the period investigated and they can be regarded as a housing commodity with the highest level of liquidity in Korea.

  • PDF

Context-based Social Network Configuration Method between Users (컨텍스트 기반 사용자 간 소셜 네트워크 구성 방법)

  • Han, Jong-Hyun;Woo, Woon-Tack
    • 한국HCI학회:학술대회논문집
    • /
    • 2009.02a
    • /
    • pp.11-14
    • /
    • 2009
  • In this paper, we propose the method configuring social networks among users based on users' context and profile. Recently, many researchers are concerned about social networks related with collaborative systems. In case of the existing researches, however, it is difficult to configure social networks dynamically because they are based on static data types, such as log and profile of users. The proposed method uses not only user profiles but also context reflecting users' behavior dynamically. It computes the similarity among users' behavior contexts using hierarchical structure of context domain knowledge model. And it calculates relationships between contexts by given weight factors of category of context model. In order to verify usefulness of the method, we conduct an experiment on configuring social network according to change of user context. We expect that it makes dynamic analysis of relationship of users possible.

  • PDF

Construction of an Hybrid Firewall for School Networks and Implementation of a Graphical Interface for Access Control Rules (학교망을 위한 혼합방화벽 구축 및 접근제어 규칙을 위한 그래픽 인터페이스 구현)

  • Park, Chan-Jung
    • The Journal of Korean Association of Computer Education
    • /
    • v.3 no.2
    • /
    • pp.67-75
    • /
    • 2000
  • Due to the advantages of Internet, many teachers use Internet as an educational tool and due to the computerized works in schools, the usages of the Internet increase. However, because of the openness of the Internet, the sensitive data of an organization are exposed to outsiders and the Internet-based working has some problems such as the corruptions of instructional data or on-line assessment results. The need for protecting a school network from outsiders increases but the school networks with firewalls rarely exist. In this paper, in order to solve the security problem of a school network, we construct a hybrid firewall for school networks. In addition, we implement a graphical user interface for teachers to set up the access control rules of a hybrid firewall easily. The interface also provides the facilities such as log analysis, a real-time monitor for network traffics, and the statistic on traffics.

  • PDF

Implementation of an Integrated Access Control Rule Script Language and Graphical User Interface for Hybrid Firewalls (혼합형 침입차단시스템을 위한 통합 접근제어 규칙기술 언어 및 그래픽 사용자 인터페이스 구현)

  • 박찬정
    • Journal of the Korea Institute of Information Security & Cryptology
    • /
    • v.9 no.1
    • /
    • pp.57-70
    • /
    • 1999
  • Since a hybrid firewall filters packets at a network layer along with providing gateway functionalities at an application layer, it has a better performance than an If filtering firewall. In addition, it provides both the various kinds of access control mechanisms and transparent services to users. However, the security policies of a network layer are different from those of an application layer. Thus, the user interfaces for managing a hybrid firewalls in a consistent manner are needed. In this paper, we implement a graphical user interface to provide access control mechanisms and management facilities for a hybrid firewall such as log analysis, a real-time monitor for network traffics, and the statisics on traffics. And we also propose a new rule script language for specifying access control rules. By using the script language, users can generate the various forma of access control rules which are adapted by the existing firewalls.

A Digital Secret File Leakage Prevention System via Hadoop-based User Behavior Analysis (하둡 기반의 사용자 행위 분석을 통한 기밀파일 유출 방지 시스템)

  • Yoo, Hye-Rim;Shin, Gyu-Jin;Yang, Dong-Min;Lee, Bong-Hwan
    • Journal of the Korea Institute of Information and Communication Engineering
    • /
    • v.22 no.11
    • /
    • pp.1544-1553
    • /
    • 2018
  • Recently internal information leakage in industries is severely increasing in spite of industry security policy. Thus, it is essential to prepare an information leakage prevention measure by industries. Most of the leaks result from the insiders, not from external attacks. In this paper, a real-time internal information leakage prevention system via both storage and network is implemented in order to protect confidential file leakage. In addition, a Hadoop-based user behavior analysis and statistics system is designed and implemented for storing and analyzing information log data in industries. The proposed system stores a large volume of data in HDFS and improves data processing capability using RHive, consequently helps the administrator recognize and prepare the confidential file leak trials. The implemented audit system would be contributed to reducing the damage caused by leakage of confidential files inside of the industries via both portable data media and networks.

Assessment of Water Distribution and Irrigation Efficiency in Agricultural Reservoirs using SWMM Model (SWMM 모형을 이용한 농업용 저수지 용수분배 모의 및 관개효율 평가)

  • Shin, Ji-Hyeon;Nam, Won-Ho;Bang, Na-Kyoung;Kim, Han-Joong;An, Hyun-Uk;Do, Jong-Won;Lee, Kwang-Ya
    • Journal of The Korean Society of Agricultural Engineers
    • /
    • v.62 no.3
    • /
    • pp.1-13
    • /
    • 2020
  • The management of agricultural water can be divided into management of agricultural infrastructure and operation to determine the timing and quantity of water supply. The target of water management is classified as water-supply facilities, such as reservoirs, irrigation water supply, sluice gate control, and farmland. In the case of agricultural drought, there is a need for water supply capacity in reservoirs and for drought assessment in paddy fields that receive water from reservoirs. Therefore, it is necessary to analyze the water supply amount from intake capacity to irrigation canal network. The analysis of the irrigation canal network should be considered for efficient operation and planning concerning optimized irrigation and water allocation. In this study, we applied a hydraulic analysis model for agricultural irrigation networks by adding the functions of irrigation canal network analysis using the SWMM (Storm Water Management Model) module and actual irrigation water supply log data from May to August during 2015-2019 years in Sinsong reservoir. The irrigation satisfaction of ponding depth in paddy fields was analyzed through the ratio of the number of days the target ponding depth was reached for each fields. This hydraulic model can assist with accurate irrigation scheduling based on its simulation results. The results of evaluating the irrigation efficiency of water supply can be used for efficient water distribution and management during the drought events.

Optimum Design of Soil Nailing Excavation Wall System Using Genetic Algorithm and Neural Network Theory (유전자 알고리즘 및 인공신경망 이론을 이용한 쏘일네일링 굴착벽체 시스템의 최적설계)

  • 김홍택;황정순;박성원;유한규
    • Journal of the Korean Geotechnical Society
    • /
    • v.15 no.4
    • /
    • pp.113-132
    • /
    • 1999
  • Recently in Korea, application of the soil nailing is gradually extended to the sites of excavations and slopes having various ground conditions and field characteristics. Design of the soil nailing is generally carried out in two steps, The First step is to examine the minimum safety factor against a sliding of the reinforced nailed-soil mass based on the limit equilibrium approach, and the second step is to check the maximum displacement expected to occur at facing using the numerical analysis technique. However, design parameters related to the soil nailing system are so various that a reliable design method considering interrelationships between these design parameters is continuously necessary. Additionally, taking into account the anisotropic characteristics of in-situ grounds, disturbances in collecting the soil samples and errors in measurements, a systematic analysis of the field measurement data as well as a rational technique of the optimum design is required to improve with respect to economical efficiency. As a part of these purposes, in the present study, a procedure for the optimum design of a soil nailing excavation wall system is proposed. Focusing on a minimization of the expenses in construction, the optimum design procedure is formulated based on the genetic algorithm. Neural network theory is further adopted in predicting the maximum horizontal displacement at a shotcrete facing. Using the proposed procedure, various effects of relevant design parameters are also analyzed. Finally, an optimized design section is compared with the existing design section at the excavation site being constructed, in order to verify a validity of the proposed procedure.

  • PDF

A study on vulnerability analysis and incident response methodology based on the penetration test of the power plant's main control systems (발전소 주제어시스템 모의해킹을 통한 취약점 분석 및 침해사고 대응기법 연구)

  • Ko, Ho-Jun;Kim, Huy-Kang
    • Journal of the Korea Institute of Information Security & Cryptology
    • /
    • v.24 no.2
    • /
    • pp.295-310
    • /
    • 2014
  • DCS (Distributed Control System), the main control system of power plants, is an automated system for enhancing operational efficiency by monitoring, tuning and real-time operation. DCS is becoming more intelligent and open systems as Information technology are evolving. In addition, there are a large amount of investment to enable proactive facility management, maintenance and risk management through the predictive diagnostics. However, new upcoming weaponized malware, such as Stuxnet designed for disrupting industrial control system(ICS), become new threat to the main control system of the power plant. Even though these systems are not connected with any other outside network. The main control systems used in the power plant usually have been used for more than 10 years. Also, this system requires the extremely high availability (rapid recovery and low failure frequency). Therefore, installing updates including security patches is not easy. Even more, in some cases, installing security updates can break the warranty by the vendor's policy. If DCS is exposed a potential vulnerability, serious concerns are to be expected. In this paper, we conduct the penetration test by using NESSUS, a general-purpose vulnerability scanner under the simulated environment configured with the Ovation version 1.5. From this result, we suggest a log analysis method to detect the security infringement and react the incident effectively.

Design and Performance Analysis of Hybrid Receiver based on System Level Simulation in Backhaul System (백홀 시스템에서 시스템 레벨 시뮬레이션 기반 하이브리드 수신기 설계 및 성능 분석)

  • Moon, Sangmi;Chu, Myeonghun;Kim, Hanjong;Kim, Daejin;Hwang, Intae
    • Journal of the Institute of Electronics and Information Engineers
    • /
    • v.52 no.11
    • /
    • pp.3-11
    • /
    • 2015
  • An advanced receiver which can manage inter-cell interference is required to cope with the explosively increasing mobile data traffic. 3rd Generation Partnership Project (3GPP) has discussed network assisted interference cancellation and suppression (NAICS) to improve signal-to-noise-plus-interference ratio (SINR) and receiver performance by suppression or cancellation of interference signal from inter-cells. In this paper, we propose the advanced receiver based on soft decision to reduce the interference from neighbor cell in LTE-Advanced downlink system. The proposed receiver can suppress and cancel the interference by calculating the unbiased estimation value of interference signal using minimum mean square error (MMSE) or interference rejection combing (IRC) receiver. The interference signal is updated using soft information expressed by log-likelihood ratio (LLR). We perform the system level simulation based on 20MHz bandwidth of 3GPP LTE-Advanced downlink system. Simulation results show that the proposed receiver can improve SINR, throughput, and spectral efficiency of conventional system.