• Title/Summary/Keyword: signature-based detection

Search Result 200, Processing Time 0.029 seconds

Technique for Malicious Code Detection using Stacked Convolution AutoEncoder (적층 콘볼루션 오토엔코더를 활용한 악성코드 탐지 기법)

  • Choi, Hyun-Woong;Heo, Junyoung
    • The Journal of the Institute of Internet, Broadcasting and Communication
    • /
    • v.20 no.2
    • /
    • pp.39-44
    • /
    • 2020
  • Malicious codes cause damage to equipments while avoiding detection programs(vaccines). The reason why it is difficult to detect such these new malwares using the existing vaccines is that they use "signature-based" detection techniques. these techniques effectively detect already known malicious codes, however, they have problems about detecting new malicious codes. Therefore, most of vaccines have recognized these drawbacks and additionally make use of "heuristic" techniques. This paper proposes a technology to detecting unknown malicious code using deep learning. In addition, detecting malware skill using Supervisor Learning approach has a clear limitation. This is because, there are countless files that can be run on the devices. Thus, this paper utilizes Stacked Convolution AutoEncoder(SCAE) known as Semi-Supervisor Learning. To be specific, byte information of file was extracted, imaging was carried out, and these images were learned to model. Finally, Accuracy of 98.84% was achieved as a result of inferring unlearned malicious and non-malicious codes to the model.

Context cognition technology through integrated cyber security context analysis (통합 사이버 보안 상황분석을 통한 관제 상황인지 기술)

  • Nam, Seung-Soo;Seo, Chang-Ho;Lee, Joo-Young;Kim, Jong-Hyun;Kim, Ik-Kyun
    • Smart Media Journal
    • /
    • v.4 no.4
    • /
    • pp.80-85
    • /
    • 2015
  • As the number of applications using the internet the rapidly increasing incidence of cyber attacks made on the internet has been increasing. In the equipment of L3 DDoS attack detection equipment in the world and incomplete detection of application layer based intelligent. Next-generation networks domestic product in high-performance wired and wireless network threat response techniques to meet the diverse requirements of the security solution is to close one performance is insufficient compared to the situation in terms of functionality foreign products, malicious code detection and signature generation research primarily related to has progressed malware detection and analysis of the research center operating in Window OS. In this paper, we describe the current status survey and analysis of the latest variety of new attack techniques and analytical skills with the latest cyber-attack analysis prejudice the security situation.

Context cognition technology through integrated cyber security context analysis (통합 사이버 보안 상황분석을 통한 관제 상황인지 기술)

  • Nam, Seung-Soo;Seo, Chang-Ho;Lee, Joo-Young;Kim, Jong-Hyun;Kim, Ik-Kyun
    • Journal of Digital Convergence
    • /
    • v.13 no.1
    • /
    • pp.313-319
    • /
    • 2015
  • As the number of applications using the internet the rapidly increasing incidence of cyber attacks made on the internet has been increasing. In the equipment of L3 DDoS attack detection equipment in the world and incomplete detection of application layer based intelligent. Next-generation networks domestic product in high-performance wired and wireless network threat response techniques to meet the diverse requirements of the security solution is to close one performance is insufficient compared to the situation in terms of functionality foreign products, malicious code detection and signature generation research primarily related to has progressed malware detection and analysis of the research center operating in Window OS. In this paper, we describe the current status survey and analysis of the latest variety of new attack techniques and analytical skills with the latest cyber-attack analysis prejudice the security situation.

An Email Vaccine Cloud System for Detecting Malcode-Bearing Documents (악성코드 은닉 문서파일 탐지를 위한 이메일 백신 클라우드 시스템)

  • Park, Choon-Sik
    • Journal of Korea Multimedia Society
    • /
    • v.13 no.5
    • /
    • pp.754-762
    • /
    • 2010
  • Nowadays, email-based targeted attacks using malcode-bearing documents have been steadily increased. To improve the success rate of the attack and avoid anti-viruses, attackers mainly employ zero-day exploits and relevant social engineering techniques. In this paper, we propose an architecture of the email vaccine cloud system to prevent targeted attacks using malcode-bearing documents. The system extracts attached document files from email messages, performs behavior analysis as well as signature-based detection in the virtual machine environment, and completely removes malicious documents from the messages. In the process of behavior analysis, the documents are regarded as malicious ones in cases of creating executable files, launching new processes, accessing critical registry entries, connecting to the Internet. The email vaccine cloud system will help prevent various cyber terrors such as information leakages by preventing email based targeted attacks.

Draft Design of 2-Factor Authentication Technique for NFC-based Security-enriched Electronic Payment System (보안 강화를 위한 NFC 기반 전자결제 시스템의 2 팩터 인증 기술의 초안 설계)

  • Cha, ByungRae;Choi, MyeongSoo;Park, Sun;Kim, JongWon
    • Smart Media Journal
    • /
    • v.5 no.2
    • /
    • pp.77-83
    • /
    • 2016
  • Today, the great revolution in all financial industrial such as bank have been progressing through the utilization of IT technology actively, it is called the fintech. In this paper, we draw the draft design of NFC-based electronic payment and coupon system using FIDO framework to apply the 2 factor authentication technique for strength security. In detailed, we will study that the terminal device in front-end will be applied the 2 factor authentication and electric signature, and cloud-based payment gateway in back-end will be applied malicious code detection technique of distributed avoidance type.

TEMPORAL VARIATIONS OF THE GLOBAL SEISMIC PARAMETERS OF HD 49933 OVER A MAGNETIC CYCLE

  • Kim, Ki-Beom;Chang, Heon-Young
    • Journal of The Korean Astronomical Society
    • /
    • v.54 no.4
    • /
    • pp.129-137
    • /
    • 2021
  • It has been established that the acoustic mode parameters of the Sun and Sun-like stars vary over activity cycles. Since the observed variations are not consistent with an activity-related origin, even Sun-like stars showing out-of-phase changes of mode frequencies and amplitudes need to be carefully studied using other observational quantities. In order to test whether the presumed relations between the global seismic parameters are a signature of the stellar activity cycle, we analyze the photometric light curve of HD 49933 for which the first direct detection of an asteroseismic signature for activity-induced variations in a Sun-like star was made, using observations by the CoRoT space telescope. We find that the amplitude of the envelope significantly anti-correlates with both the maximum frequency of the envelope and the width of the envelope unless superflare-like events completely contaminate the light curve. However, even though the photometric proxy for stellar magnetic activity appears to show relations with the global asteroseismic parameters, they are statistically insignificant. Therefore, we conclude that the global asteroseismic parameters can be utilized in cross-checking asteroseismic detections of activity-related variations in Sun-like stars, and that it is probably less secure and effective to construct a photometric magnetic activity proxy to indirectly correlate the global asteroseismic parameters. Finally, we seismically estimate the mass of HD 49933 based on our determination of the large separation of HD 49933 with evolutionary tracks computed by the MESA code and find a value of about 1.2M and a sub-solar metallicity of Z = 0.008, which agrees with the current consensus and with asteroseismic and non-asteroseismic data.

Design of Fault Diagnostic and Fault Tolerant System for Induction Motors with Redundant Controller Area Network

  • Hong, Won-Pyo;Yoon, Chung-Sup;Kim, Dong-Hwa
    • Proceedings of the Korean Institute of IIIuminating and Electrical Installation Engineers Conference
    • /
    • 2004.11a
    • /
    • pp.371-374
    • /
    • 2004
  • Induction motors are a critical component of many industrial processes and are frequently integrated in commercially available equipment. Safety, reliability, efficiency, and performance are some of the major concerns of induction motor applications. Preventive maintenance of induction motors has been a topic great interest to industry because of their wide range application of industry. Since the use of mechanical sensors, such as vibration probes, strain gauges, and accelerometers is often impractical, the motor current signature analysis (MACA) techniques have gained murk popularity as diagnostic tool. Fault tolerant control (FTC) strives to make the system stable and retain acceptable performance under the system faults. All present FTC method can be classified into two groups. The first group is based on fault detection and diagnostics (FDD). The second group is independent of FDD and includes methods such as integrity control, reliable stabilization and simultaneous stabilization. This paper presents the fundamental FDD-based FTC methods, which are capable of on-line detection and diagnose of the induction motors. Therefore, our group has developed the embedded distributed fault tolerant and fault diagnosis system for industrial motor. This paper presents its architecture. These mechanisms are based on two 32-bit DSPs and each TMS320F2407 DSP module is checking stator current, voltage, temperatures, vibration and speed of the motor. The DSPs share information from each sensor or DSP through DPRAM with hardware implemented semaphore. And it communicates the motor status through field bus (CAN, RS485). From the designed system, we get primitive sensors data for the case of normal condition and two abnormal conditions of 3 phase induction motor control system is implemented. This paper is the first step to drive multi-motors with serial communication which can satisfy the real time operation using CAN protocol.

  • PDF

Determination of Amino Acids on Wintertime PM2.5 using HPLC-FLD (HPLC-FLD를 이용한 겨울철 PM2.5 중 아미노산 성분 분석)

  • Park, Da-Jeong;Cho, In-Hwan;Bae, Min-Suk
    • Journal of Korean Society for Atmospheric Environment
    • /
    • v.31 no.5
    • /
    • pp.482-492
    • /
    • 2015
  • Ground-based measurements were conducted from January 6 to 12 of 2015 for understanding characteristics of nitrogen containing carbonaceous aerosols as 16 amino acids at the Mokpo National University, Korea. The detailed amino acid components such as Cystine ($(SCH_2CH(NH_2)CO_2H)_2$) and Methionine ($C_5H_{11}NO_2S$) and their sources were analyzed by High-Performance Liquid Chromatography with Fluorescence Detection (HPLC-FLD) for behavior of secondary products in particulate matter. In addition, organic carbon (OC) and elemental carbon (EC) based on the carbonaceous thermal distribution (CTD), which provides detailed carbon signature characteristics relative to analytical temperature, and water soluble organic carbon (WSOC) by total organic carbon (TOC) analyzer were used to understand the carbon compound behaviors. The backward trajectories were discussed for originations of carbonaceous aerosols as well. Different airmasses were classified with the amino acids and OC thermal signatures. The results can provide to understand the aging process influenced by the long-range transport from East Sea area.

Development of Oil Change Warning Algorithm and Display Device (오일교환경보 알고리즘 및 표시장치 개발)

  • Chun, Sang Myung
    • Tribology and Lubricants
    • /
    • v.30 no.3
    • /
    • pp.168-176
    • /
    • 2014
  • This paper presents an engine oil change warning algorithm based on the test results of a small dip-stick-gage-type engine-oil-deterioration-detection sensor, software to realize the algorithm and a display device to apply the software. The algorithm determines the engine oil deterioration condition from the rate of change in the dielectric constant based on the average measured capacitance at $80^{\circ}C$ after the engine stops. The rate of change in the dielectric constant at the time for oil change correlates with the time that one of recommended warning limits for engine oil physical properties such as TAN (Total Acid Number), TBN (Total Base Number) and viscosity is first reached. At this point, a warning signal for oil change appears on the display device like a smart-phone or individual display device. The frames of smartphone app have three stages. The user can directly input all of the thresholds into the frame of the smartphone app. The screen of the display device comprises one frame for each warning signature with the related message. The user can input the thresholds to the device through a USB cable connected to a personal computer.

A Study of Program Execution Control based on Whitelist (화이트리스트 기반 프로그램 실행 통제 방안 연구)

  • Kim, Chang-hong;Choi, Dae-young;Yi, Jeong-hyun;Kim, Jong-bae
    • Proceedings of the Korean Institute of Information and Commucation Sciences Conference
    • /
    • 2014.10a
    • /
    • pp.346-349
    • /
    • 2014
  • Currently, the growing cyber threat continues, the damage caused by the evolution of malicious code incidents become more bigger. Such advanced attacks as APT using 'zero-day vulnerability' bring easy way to steal sensitive data or personal information. However it has a lot of limitation that the traditional ways of defense like 'access control' with blocking of application ports or signature base detection mechanism. This study is suggesting a way of controlling application activities focusing on keeping integrity of applications, authorization to running programs and changes of files of operating system by hardening of legitimate resources and programs based on 'white-listing' technology which analysis applications' behavior and its usage.

  • PDF