• Journal of Internet of Things and Convergence
• /
• v.7 no.3
• /
• pp.69-74
• /
• 2021

With the recent development of biometric authentication technology, the user authentication techniques using biometric authentication are increasing. Various problems arised in certification techniques that use various existing methods such as ID/PW. Therefore, recently, a method of improving security by introducing biometric authentication as secondary authentication has been used. In this thesis, proposal of the user authentication system that can detect user identification and anomalies using ECGs that are extremely difficult to falsify through the electrical biometric signals from the heart among various biometric authentication devices is studied. The system detects user anomalies by comparing ECG data received from a wrist-mounted wearable device-type ECG measurement tool with identification and ECG data stored in blockchain form on the database and identifying the user's location through a beacon system.

• Journal of Convergence for Information Technology
• /
• v.10 no.8
• /
• pp.15-22
• /
• 2020

The 4th industrial revolution and the rapid change in the data environment revealed technical limitations in the existing relational database(RDB). As a new analysis method for unstructured data in all fields such as IDC/finance/insurance, interest in graph database(GDB) technology is increasing. The graph database is an efficient technique for expressing interlocked data and analyzing associations in a wide range of networks. This study extended the existing RDB to the GDB model and applied machine learning algorithms (pattern recognition, clustering, path distance, core extraction) to detect new abnormal signs. As a result of the performance analysis, it was confirmed that the performance of abnormal behavior(about 180 times or more) was greatly improved, and that it was possible to extract an abnormal symptom pattern after 5 steps that could not be analyzed by RDB.

• Electronics and Telecommunications Trends
• /
• v.20 no.1 s.91
• /
• pp.22-32
• /
• 2005

기존의 사이버 공격은 특정 호스트나 서버를 목표로 하여 정보의 탈취 및 변경 등에 집중되었으나, 현재는 직접 혹은 간접적으로 과다 트래픽을 유발하여 네트워크 서비스를 마비시키는 방향으로 그 경향이변하고 있다. 이런 사이버 공격을 방지하여 네트워크의 안정적인 서비스의 제공을 위해서는 공격 징후나 이상 징후를 탐지하고 네트워크 차원에서 이에 대한 대응 방안을 결정하여 이를 네트워크 상에 강제할 수 있는 체계적인 보안 관리가 이루어져야 한다. 또한 네트워크 각 운용 주체별로 개별 보안 상황에 대해 적용할 보안 정책이 다르므로 이를 모델링하고 적용할 수 있는 방법이 제공되어야 한다. 본 논문에서는 정책 기반 네트워크 보안 관리 기능을 수행하기 위해 필요한 공격 및 이상 징후의 탐지, 그에 대한 대응과 이런 일련의 작업에 보안 정책을 강제하기 위한 보안 정책관련 연구 동향에 대해 다루도록한다.

• Journal of Internet Computing and Services
• /
• v.21 no.5
• /
• pp.109-118
• /
• 2020

Recently, people are spending a lot of time inside their homes because of various diseases. It is difficult to ask others for help in the case of a single-person household that is injured in the house or infected with a disease and needs help from others. In this study, an algorithm is proposed to detect emergency event, which are situations in which single-person households need help from others, such as injuries or disease infections, in their homes. It proposes vision pattern detection algorithms using home CCTVs, audio pattern detection algorithms using artificial intelligence speakers, activity pattern detection algorithms using acceleration sensors in smartphones, and dust pattern detection algorithms using air purifiers. However, if it is difficult to use due to security issues of home CCTVs, it proposes a fusion method combining audio, activity and dust pattern sensors. Each algorithm collected data through YouTube and experiments to measure accuracy.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.5
• /
• pp.939-946
• /
• 2013

This paper proposes normal behavior profiling methods for anomaly detection in IEC 61850 based substation network. Signature based security solutions, currently used primarily, are inadequate for APT attack using zero-day vulnerabilities. Recently, some researches about anomaly detection in control network are ongoing. However, there are no published result for IEC 61850 substation network. Our proposed methods includes 3-phase preprocessing for MMS/GOOSE packets and normal behavior profiling using one-class SVM algorithm. These approaches are beneficial to detect APT attacks on IEC 61850 substation network.

• Proceedings of the Korean Information Science Society Conference
• /
• 2004.10a
• /
• pp.442-444
• /
• 2004

서비스 거부 공격은 그 피해의 규모에 비해 방어하기가 무척 어려우며 충분히 대비를 한다 해도 알려지지 않은 새로운 서비스 거부 공격 기법에 피해를 입을 위험성이 항상 존재한다. 또한 최근 나타나고 있는 서비스 거부 공격 기법은 시스템 자원을 고갈시키는 분산 서비스 거부 공격(DDoS)에서 네트워크의 대역폭을 고갈시킴으로서 주요 네트워크 장비를 다운시키는 분산 반사 서비스 거부 공격(DRDoS)으로 진화하고 있다 이러한 공격 기법은 네트워크 트래픽의 이상 징후로서만 탐지될 뿐 개별 패킷으로는 탐지가 불가능하여 공격 징후는 알 수 있으되 자동화된 대응이 어려운 특징이 있다. 본 논문에서는 이미 알려진 공격뿐 아니라 새로운 서비스 거부 공격 패킷을 탐지하기 위하여, 패턴 분류 문제에 있어서 우수한 성능을 보이는 것으로 알려져 있는 Support Vector Machine(SVM)을 사용한 실험을 진행하였다. 테스트 결과. 학습된 공격 패킷에 대해서는 정확한 구분이 가능했으며 학습되지 않은 새로운 공격에 대해서도 탐지가 가능함을 보여주었다.

• Convergence Security Journal
• /
• v.21 no.3
• /
• pp.13-23
• /
• 2021

The attacker's techniques and tools are becoming intelligent and sophisticated. Existing Anti-Virus cannot prevent security accident. So the security threats on the endpoint should also be considered. Recently, EDR security solutions to protect endpoints have emerged, but they focus on visibility. There is still a lack of detection and responsiveness. In this paper, we use real-world EDR event logs to aggregate knowledge-based MITRE ATT&CK and autoencoder-based anomaly detection techniques to detect anomalies in order to screen effective analysis and analysis targets from a security manager perspective. After that, detected anomaly attack signs show the security manager an alarm along with log information and can be connected to legacy systems. The experiment detected EDR event logs for 5 days, and verified them with hybrid analysis search. Therefore, it is expected to produce results on when, which IPs and processes is suspected based on the EDR event log and create a secure endpoint environment through measures on the suspicious IP/Process.

• Proceedings of the Korea Inteligent Information System Society Conference
• /
• 2007.11a
• /
• pp.514-519
• /
• 2007

컴퓨터 네트워크 모니터링에 의한 보안장비는 많은 트래픽 자료를 분석하여, 이상유무를 판단하고, 대응해야 한다. 기존의 보안장비들은 이미 알려진 패턴에 대한 규칙을 이용하는 오용탐지방법(misuse detection)과 의미를 파악하기 어려운 많은 자료들을 제시하고 있는데 머물고 있다. 보다 나은 보안을 위해서는 정상적인 동작에서 벗어나는 이상징후를 탐지하여 침입을 탐지하는 이상탐지방법(anomaly detection)의 채용이 필요하고, 보안장비에서 제시되는 많은 트래픽 자료들은 보안전문가의 전문적인 분석이 필요하다. 본 연구에서는 데이터마이닝 기법을 이용한 이상탐지방법과 보안전문가의 전문적인 보안지식에 의한 분석, 대응, 관리를 위한 지식처리 기법을 사용할 수 있는 지능형 IPS(intrusion Detection System) 프레임워크를 제안한다.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.16 no.6
• /
• pp.287-294
• /
• 2016

APT attack aimed at the interruption of information and communication facilities and important information leakage of companies. it performs an attack using zero-day vulnerabilities, social engineering base on collected information, such as IT infra, business environment, information of employee, for a long period of time. Fragmentary response to cyber threats such as malware signature detection methods can not respond to sophisticated cyber-attacks, such as APT attacks. In this paper, we propose a cyber intrusion detection model for countermeasure of APT attack by utilizing heterogeneous system log into big-data. And it also utilizes that merging pattern-based detection methods and abnormality detection method.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.34 no.2
• /
• pp.281-288
• /
• 2024

The sixth generation(6G) wireless communication technology is advancing toward ultra-high speed, ultra-high bandwidth, and hyper-connectivity. With the development of communication technologies, the formation of a hyper-connected society is rapidly accelerating, expanding from the IoT(Internet of Things) to the IoE(Internet of Everything). However, at the same time, security threats targeting IoT devices have become widespread, and there are concerns about security incidents such as unauthorized access and information leakage. As a result, the need for security-enhancing solutions is increasing. In this paper, we implement an autoencoder-based anomaly detection model utilizing real-time collected network traffics in respond to IoT security threats. Considering the difficulty of capturing IoT device traffic data for each attack in real IoT environments, we use an unsupervised learning-based autoencoder and implement 6 different autoencoder models based on the use of noise in the training data and the dimensions of the latent space. By comparing the model performance through experiments, we provide a performance evaluation of the anomaly detection model for detecting abnormal network traffic.