• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.12 no.4
• /
• pp.1887-1898
• /
• 2018

In this paper, a method to classify insider threat activity is introduced. The internal threats help detecting anomalous activity in the procedure performed by the user in an organization. When an anomalous value deviating from the overall behavior is displayed, we consider it as an inside threat for classification as an inside intimidator. To solve the situation, Markov Chain Model is employed. The Markov Chain Model shows the next state value through an arbitrary variable affected by the previous event. Similarly, the current activity can also be predicted based on the previous activity for the insider threat activity. A method was studied where the change items for such state are defined by a transition probability, and classified as detection of anomaly of the inside threat through values for a probability variable. We use the properties of the Markov chains to list the behavior of the user over time and to classify which state they belong to. Sequential data sets were generated according to the influence of n occurrences of Markov attribute and classified by machine learning algorithm. In the experiment, only 15% of the Cert: insider threat dataset was applied, and the result was 97% accuracy except for NaiveBayes. As a result of our research, it was confirmed that the Markov Chain Model can classify insider threats and can be fully utilized for user behavior classification.

• Journal of the Korea Institute of Military Science and Technology
• /
• v.19 no.2
• /
• pp.236-243
• /
• 2016

This paper presents a threat list acquisition method in an engagement area using the support vector machines (SVM). The proposed method consists of track creation, track estimation, track feature extraction, and threat list classification. To classify the threat track robustly, dynamic track estimation and pattern recognition algorithms are used. Dynamic tracks are estimated accurately by approximating a track movement using position, velocity and time. After track estimation, track features are extracted from the track information, and used to classify threat list. Experimental results showed that the threat list acquisition method in the engagement area achieved about 95 % accuracy rate for whole test tracks when using the SVM classifier. In case of improving the real-time process through further studies, it can be expected to apply the fire control systems.

• The Journal of Korean Institute of Electromagnetic Engineering and Science
• /
• v.30 no.2
• /
• pp.132-140
• /
• 2019

In this paper, we propose a classification method for radar signals depending on the type of threat by applying machine learning to parameter data of radar signals. Currently, the army uses a library of mapping relations between the parameters and the types of threat to recognize threat signals. This approach has certain limitations when classifying signals and recognizing new types of threat or types of threat that do not exist in the current libraries. In this paper, we propose an automatic radar signal classification method depending on the type of threat that uses only parameter data without a library. A convolutional neural network is used as the classifier and machine learning is applied to train the classifier. The proposed method does not use a library, and hence, can classify threat signals that are new or do not exist in the current library.

• The Journal of the Korea Contents Association
• /
• v.17 no.3
• /
• pp.231-237
• /
• 2017

Threat intelligences collected from cyber incident sharing system and security events collected from Security Information & Event Management system are analyzed and coped with expanding malicious code rapidly with the advent of big data. Analytical classification of the threat intelligence in cyber incidents requires various features of cyber observable. Therefore it is necessary to improve classification accuracy of the similarity by using multi-profile which is classified as the same features of cyber observables. We propose a multi-profile ensemble model performed similarity analysis on cyber incident of threat intelligence based on both attack types and cyber observables that can enhance the accuracy of the classification. We see a potential improvement of the cyber incident analysis system, which enhance the accuracy of the classification. Implementation of our suggested technique in a computer network offers the ability to classify and detect similar cyber incident of those not detected by other mechanisms.

• Journal of KIISE:Software and Applications
• /
• v.35 no.3
• /
• pp.189-196
• /
• 2008

To build autonomous agents who can make a decision on behalf of humans in time-critical complex environments, the formulation of operational knowledge base could be essential. This paper proposes the methodology of how to formulate the knowledge base and evaluates it in a practical application domain. We analyze threat data received from the multiple sensors of Aircraft Survivability Equipment(ASE) for Korean helicopters, and integrate the threat data into the inductive model through compilation technique which extracts features of the threat data and relations among them. The compiled protocols of state-action rules can be implemented as the brain of the ASE. They can reduce the amounts of reasoning, and endow the autonomous agents with reactivity and flexibility. We report experimental results that demonstrate the distinctive and predictive patterns of threats in simulated battlefield settings, and show the potential of compilation methods for the successful detection of threat systems.

• The Journal of the Korea Contents Association
• /
• v.7 no.3
• /
• pp.93-100
• /
• 2007

Internet had spread in all fields with the fast speed during the last 10 years. Lately, wireless network is also spreading rapidly. Also, number of times that succeed attack attempt and invasion for wireless network is increasing rapidly TMS system was developed to overcome these threat on wireless network. Existing TMS system supplies active confrontation mechanism on these threats. However, existent TMS has limitation that new form of attack do not filtered efficiently. Therefor this paper proposes a new method that it automatically compute the threat from the imput packets with vector space model and detect anomaly detection of wireless network. Proposed mechanism in this research analyzes similarity degree between packets, and detect something wrong symptom of wireless network and then classify these threats automatically.

• Journal of the Korea Institute of Military Science and Technology
• /
• v.22 no.2
• /
• pp.170-178
• /
• 2019

Classification of radar signals in the field of electronic warfare is a problem of discriminating threat types by analyzing enemy threat radar signals such as aircraft, radar, and missile received through electronic warfare equipment. Recent radar systems have adopted a variety of modulation schemes that are different from those used in conventional systems, and are often difficult to analyze using existing algorithms. Also, it is necessary to design a robust algorithm for the signal received in the real environment due to the environmental influence and the measurement error due to the characteristics of the hardware. In this paper, we propose a radar signal classification method which are not affected by radar signal modulation methods and noise generation by using deep learning techniques.

• Journal of Internet Computing and Services
• /
• v.22 no.3
• /
• pp.27-35
• /
• 2021

With the development of the Internet, various IT technologies such as IoT, Cloud, etc. have been developed, and various systems have been built in countries and companies. Because these systems generate and share vast amounts of data, they needed a variety of systems that could detect threats to protect the critical data contained in the system, which has been actively studied to date. Typical techniques include anomaly detection and misuse detection, and these techniques detect threats that are known or exhibit behavior different from normal. However, as IT technology advances, so do technologies that threaten systems, and these methods of detection. Advanced Persistent Threat (APT) attacks national or companies systems to steal important information and perform attacks such as system down. These threats apply previously unknown malware and attack technologies. Therefore, in this paper, we propose a hybrid intrusion detection system that combines anomaly detection and misuse detection to detect unknown threats. Two detection techniques have been applied to enable the detection of known and unknown threats, and by applying machine learning, more accurate threat detection is possible. In misuse detection, we applied Classification based on Association Rule(CBA) to generate rules for known threats, and in anomaly detection, we used One-Class SVM(OCSVM) to detect unknown threats. Experiments show that unknown threat detection accuracy is about 94%, and we confirm that unknown threats can be detected.

• Proceedings of the KSR Conference
• /
• 2005.11a
• /
• pp.1-6
• /
• 2005

To improve safety management of railway and cope with the factors to threat technical and social safety, we need to establish railway safety management system based on analysis of hazards and assessment of risk for railway system. So we have to conduct PHA(Preliminary Hazard Analysis) first to understand weak points and factors to possibly threat safety using analysis of related data such as past accident/incident data and safety regulation and classification standards of hazards/causes of railway accidents. Therefore in this research, we led types/dangerous events/causes of risks/factors of risks from hazard log developed based on railway accident classification and hazards of railway accident. PHA model for domestic railway system will be used in risk analysis and risk assessment of railway accident.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.34 no.4
• /
• pp.587-596
• /
• 2024

Cyber Attack and Cyber Threat are getting confused and evolved. Therefore, using AI(Artificial Intelligence), which is the most important technology in Fourth Industry Revolution, to build a Cyber Threat Detection System is getting important. Especially, Government's SOC(Security Operation Center) is highly interested in using AI to build SOAR(Security Orchestration, Automation and Response) Solution to predict and build CTI(Cyber Threat Intelligence). In this thesis, We introduce the Cyber Threat Detection System by analyzing Network Traffic and Web Application Firewall(WAF) Log data. Additionally, we apply the well-known TF-IDF(Term Frequency-Inverse Document Frequency) method and AutoML technology to classify Web traffic attack type.