• Title/Summary/Keyword: real-time IDS

Search Result 65, Processing Time 0.019 seconds

Anomaly Intrusion Detection using Fuzzy Membership Function and Neural Networks (퍼지 멤버쉽 함수와 신경망을 이용한 이상 침입 탐지)

  • Cha, Byung-Rae
    • The KIPS Transactions:PartC
    • /
    • v.11C no.5
    • /
    • pp.595-604
    • /
    • 2004
  • By the help of expansion of computer network and rapid growth of Internet, the information infrastructure is now able to provide a wide range of services. Especially open architecture - the inherent nature of Internet - has not only got in the way of offering QoS service, managing networks, but also made the users vulnerable to both the threat of backing and the issue of information leak. Thus, people recognized the importance of both taking active, prompt and real-time action against intrusion threat, and at the same time, analyzing the similar patterns of in-trusion already known. There are now many researches underway on Intrusion Detection System(IDS). The paper carries research on the in-trusion detection system which hired supervised learning algorithm and Fuzzy membership function especially with Neuro-Fuzzy model in order to improve its performance. It modifies tansigmoid transfer function of Neural Networks into fuzzy membership function, so that it can reduce the uncertainty of anomaly intrusion detection. Finally, the fuzzy logic suggested here has been applied to a network-based anomaly intrusion detection system, tested against intrusion data offered by DARPA 2000 Intrusion Data Sets, and proven that it overcomes the shortcomings that Anomaly Intrusion Detection usually has.

Tweet Acquisition System by Considering Location Information and Tendency of Twitter User (트위터 사용자의 위치정보와 성향을 고려한 트윗 수집 시스템)

  • Choi, Woosung;Yim, Junyeob;Hwang, Byung-Yeon
    • Spatial Information Research
    • /
    • v.22 no.3
    • /
    • pp.1-8
    • /
    • 2014
  • While SNS services such as Twitter or Facebook are rapidly growing, research for the SNS analysis has been concerned. Especially, twitter reacts to social issues in real-time so that it is used to get useful experimental data for researchers of social science or information retrieval. However, it is still lack of research on the methodology to collect data. Therefore, this paper suggests the tweet acquisition system by considering tendency of twitter user oriented location-based event and political social event. First the system acquires tweets including information of location and keyword about event and secure IDs for acquisition of political social event. Then we plan ID-analyzer to classify the tendency of users. In addition for measuring reliability of ID-analyzer, it acquires and analyzes the tweet by using high-ranked ID. In analyses result, top-ranked ID shows 88.8% reliability, 2nd-ranked ID shows 76.05% and ID-analyzer shows 77.5%, it shortens collection time by using minority ID.

Automatic Recognition of Symbol Objects in P&IDs using Artificial Intelligence (인공지능 기반 플랜트 도면 내 심볼 객체 자동화 검출)

  • Shin, Ho-Jin;Jeon, Eun-Mi;Kwon, Do-kyung;Kwon, Jun-Seok;Lee, Chul-Jin
    • Plant Journal
    • /
    • v.17 no.3
    • /
    • pp.37-41
    • /
    • 2021
  • P&ID((Piping and Instrument Diagram) is a key drawing in the engineering industry because it contains information about the units and instrumentation of the plant. Until now, simple repetitive tasks like listing symbols in P&ID drawings have been done manually, consuming lots of time and manpower. Currently, a deep learning model based on CNN(Convolutional Neural Network) is studied for drawing object detection, but the detection time is about 30 minutes and the accuracy is about 90%, indicating performance that is not sufficient to be implemented in the real word. In this study, the detection of symbols in a drawing is performed using 1-stage object detection algorithms that process both region proposal and detection. Specifically, build the training data using the image labeling tool, and show the results of recognizing the symbol in the drawing which are trained in the deep learning model.

Detection of Complaints of Non-Face-to-Face Work before and during COVID-19 by Using Topic Modeling and Sentiment Analysis (동적 토픽 모델링과 감성 분석을 이용한 COVID-19 구간별 비대면 근무 부정요인 검출에 관한 연구)

  • Lee, Sun Min;Chun, Se Jin;Park, Sang Un;Lee, Tae Wook;Kim, Woo Ju
    • The Journal of Information Systems
    • /
    • v.30 no.4
    • /
    • pp.277-301
    • /
    • 2021
  • Purpose The purpose of this study is to analyze the sentiment responses of the general public to non-face-to-face work using text mining methodology. As the number of non-face-to-face complaints is increasing over time, it is difficult to review and analyze in traditional methods such as surveys, and there is a limit to reflect real-time issues. Approach This study has proposed a method of the research model, first by collecting and cleansing the data related to non-face-to-face work among tweets posted on Twitter. Second, topics and keywords are extracted from tweets using LDA(Latent Dirichlet Allocation), a topic modeling technique, and changes for each section are analyzed through DTM(Dynamic Topic Modeling). Third, the complaints of non-face-to-face work are analyzed through the classification of positive and negative polarity in the COVID-19 section. Findings As a result of analyzing 1.54 million tweets related to non-face-to-face work, the number of IDs using non-face-to-face work-related words increased 7.2 times and the number of tweets increased 4.8 times after COVID-19. The top frequently used words related to non-face-to-face work appeared in the order of remote jobs, cybersecurity, technical jobs, productivity, and software. The words that have increased after the COVID-19 were concerned about lockdown and dismissal, and business transformation and also mentioned as to secure business continuity and virtual workplace. New Normal was newly mentioned as a new standard. Negative opinions found to be increased in the early stages of COVID-19 from 34% to 43%, and then stabilized again to 36% through non-face-to-face work sentiment analysis. The complaints were, policies such as strengthening cybersecurity, activating communication to improve work productivity, and diversifying work spaces.

Security of Ethernet in Automotive Electric/Electronic Architectures (차량 전자/전기 아키텍쳐에 이더넷 적용을 위한 보안 기술에 대한 연구)

  • Lee, Ho-Yong;Lee, Dong-Hoon
    • The Journal of the Institute of Internet, Broadcasting and Communication
    • /
    • v.16 no.5
    • /
    • pp.39-48
    • /
    • 2016
  • One of the major trends of automotive networking architecture is the introduction of automotive Ethernet. Ethernet is already used in single automotive applications (e.g. to connect high-data-rate sources as video cameras), it is expected that the ongoing standardization at IEEE (IEEE802.3bw - 100BASE-T1, respectively IEEE P802.3bp - 1000BASE-T1) will lead to a much broader adoption in future. Those applications will not be limited to simple point-to-point connections, but may affect Electric/Electronic(EE) Architectures as a whole. It is agreed that IP based traffic via Ethernet could be secured by application of well-established IP security protocols (e.g., IPSec, TLS) combined with additional components like, e.g., automotive firewall or IDS. In the case of safety and real-time related applications on resource constraint devices, the IP based communication is not the favorite option to be used with complicated and performance demanding TLS or IPSec. Those applications will be foreseeable incorporate Layer-2 based communication protocols as, e.g., currently standardized at IEEE[13]. The present paper reflects the state-of-the-art communication concepts with respect to security and identifies architectural challenges and potential solutions for future Ethernet Switch-based EE-Architectures. It also gives an overview and provide insights into the ongoing security relevant standardization activities concerning automotive Ethernet. Furthermore, the properties of non-automotive Ethernet security mechanisms as, e.g., IEEE 802.1AE aka. MACsec or 802.1X Port-based Network Access Control, will be evaluated and the applicability for automotive applications will be assessed.

Real-Time Remote Display Technique based on Wireless Mobile Environments (무선 모바일 환경 기반의 실시간 원격 디스플레이 기법)

  • Seo, Jung-Hee;Park, Hung-Bog
    • The KIPS Transactions:PartC
    • /
    • v.15C no.4
    • /
    • pp.297-302
    • /
    • 2008
  • In case of display a lot of information from mobile devices, those systems are being developed that display the information from mobile devices on remote devices such as TV using the mobile devices as remote controllers because it is difficult to display a lot of information on mobile devices due to their limited bandwidth and small screen sizes. A lot of cost is required to design and develop interfaces for these systems corresponding to each of remote display devices. In this paper, a mobile environment based remote display system for displays at real times is proposed for continuous monitoring of status data for unique 'Mote IDs'. Also, remote data are collected and monitored through sensor network devices such as ZigbeX by applying status perception based remote displays at real times through processing ubiquitous computing environment data, and remote display applications at real times are implemented through PDA wireless mobiles. The system proposed in this paper consists of a PDA for remote display and control, mote embedded applications programming for data collections and radio frequency, server modules to analyze and process collected data and virtual prototyping for monitoring and controls by virtual machines. The result of the implementations indicates that this system not only provides a good mobility from a human oriented viewpoint and a good usability of accesses to information but also transmits data efficiently.

Design and Implementation of Anomaly Traffic Control framework based on Linux Netfilter System and CBQ Routing Mechanisms (리눅스 Netfilter시스템과 CBQ 라우팅 기능을 이용한 비정상 트래픽 제어 프레임워크 설계 및 구현)

  • 조은경;고광선;이태근;강용혁;엄영익
    • Journal of the Korea Institute of Information Security & Cryptology
    • /
    • v.13 no.6
    • /
    • pp.129-140
    • /
    • 2003
  • Recently viruses and various hacking tools that threat hosts on a network becomes more intelligent and cleverer, and so the various security mechanisms against them have ken developed during last decades. To detect these network attacks, many NIPSs(Network-based Intrusion Prevention Systems) that are more functional than traditional NIDSs are developed by several companies and organizations. But, many previous NIPSS are hewn to have some weakness in protecting important hosts from network attacks because of its incorrectness and post-management aspects. The aspect of incorrectness means that many NIPSs incorrectly discriminate between normal and attack network traffic in real time. The aspect of post-management means that they generally respond to attacks after the intrusions are already performed to a large extent. Therefore, to detect network attacks in realtime and to increase the capability of analyzing packets, faster and more active responding capabilities are required for NIPS frameworks. In this paper, we propose a framework for real-time intrusion prevention. This framework consists of packet filtering component that works on netfilter in Linux kernel and traffic control component that have a capability of step-by-step control over abnormal network traffic with the CBQ mechanism.

Implementing an Intrusion Detection Message Exchange Library for Realtime Interaction between SDMS-RTIR and Heterogeneous Systems (이기종의 침입탐지 시스템과 SDMS-RTIR의 실시간 상호연동을 지원하는 침입탐지 메시지 교환 라이브러리 구현)

  • Yun, Il-Sun;Lee, Dong-Ryun;Oh, Eun-Sook
    • The KIPS Transactions:PartC
    • /
    • v.10C no.5
    • /
    • pp.565-574
    • /
    • 2003
  • This paper implements an intrusion detection message exchange protocol library (IDMEPL) for SDMS-RTIR, which Korea Information Security Agency (KISA) has developed to hierarchically detect and respond to network vulnerability scan attacks. The IDMEPL, based on the IDMEF and the IAP of the IDWG, enables SDMS-RTIR to interact with other intrusion detection systems (IDS) in realtime, and supports the TLS protocol to prevent security threats in exchanging messages between its server and its agents. Especially, with the protocol selection stage, the IDMEPL can support various protocols such as the IDXP besides the IAP. Furthermore, it can allow for agents to choose an appropriate security protocol for their own network, achieving security stronger than mutual authentication. With the IDMEPL, SDMS-RTIR can receive massive intrusion detection messages from heterogeneous IDSes in large-scale networks and analyze them.

Deep Neural Networks Learning based on Multiple Loss Functions for Both Person and Vehicles Re-Identification (사람과 자동차 재인식이 가능한 다중 손실함수 기반 심층 신경망 학습)

  • Kim, Kyeong Tae;Choi, Jae Young
    • Journal of Korea Multimedia Society
    • /
    • v.23 no.8
    • /
    • pp.891-902
    • /
    • 2020
  • The Re-Identification(Re-ID) is one of the most popular researches in the field of computer vision due to a variety of applications. To achieve a high-level re-identification performance, recently other methods have developed the deep learning based networks that are specialized for only person or vehicle. However, most of the current methods are difficult to be used in real-world applications that require re-identification of both person and vehicle at the same time. To overcome this limitation, this paper proposes a deep neural network learning method that combines triplet and softmax loss to improve performance and re-identify people and vehicles simultaneously. It's possible to learn the detailed difference between the identities(IDs) by combining the softmax loss with the triplet loss. In addition, weights are devised to avoid bias in one-side loss when combining. We used Market-1501 and DukeMTMC-reID datasets, which are frequently used to evaluate person re-identification experiments. Moreover, the vehicle re-identification experiment was evaluated by using VeRi-776 and VehicleID datasets. Since the proposed method does not designed for a neural network specialized for a specific object, it can re-identify simultaneously both person and vehicle. To demonstrate this, an experiment was performed by using a person and vehicle re-identification dataset together.

A Study on Constructing of Security Monitoring Schema based on Darknet Traffic (다크넷 트래픽을 활용한 보안관제 체계 구축에 관한 연구)

  • Park, Si-Jang;Kim, Chul-Won
    • The Journal of the Korea institute of electronic communication sciences
    • /
    • v.8 no.12
    • /
    • pp.1841-1848
    • /
    • 2013
  • In this paper, the plans for improvement of real-time security monitoring accuracy and expansion of control region were investigated through comprehensive and systematic collection and analysis of the anomalous activities that inflow and outflow in the network on a large scale in order to overcome the existing security monitoring system based on stylized detection patterns which could correspond to only very limited cyber attacks. This study established an anomaly observation system to collect, store and analyze a diverse infringement threat information flowing into the darknet network, and presented the information classification system of cyber threats, unknown anomalies and high-risk anomalous activities through the statistics based trend analysis of hacking. If this security monitoring system utilizing darknet traffic as presented in the study is applied, it was indicated that detection of all infringement threats was increased by 12.6 percent compared with conventional case and 120 kinds of new type and varietal attacks that could not be detected in the past were detected.