• Proceedings of the Korean Information Science Society Conference
• /
• 2010.06c
• /
• pp.463-468
• /
• 2010

본 논문은 본 연구팀이 행동패턴 분석을 위하여 개발한 BPP(Behavior Pattern Prediction)알고리즘의 가중치(weight) 속성을 객관적으로 수식화 하는 방법과 가중치와 행동 프로파일을 이용하여 정상/비정상 행동여부를 판단하는 ABA(Abnormal Behavior Analysis) 알고리즘을 제안한다. 가중치는 거주자의 방과 행동 사이의 연관성을 나타내며 가중치가 제한된 범위 내에서 증가 할수록 행동에 대한 관심이 크다. 구축한 사용자 프로파일의 주요 구성 요소로는 행동이 지속된 시간 과 행동 발생 횟수이다. ABA 알고리즘은 가중치와 행동 발생 횟수, 행동 지속시간과의 상관분석 결과를 참조 하였으며, 이산 가중치 데이터를 분석하여 비정상적인 행동을 탐지한다.

• Journal of the Korean Academy of Child and Adolescent Psychiatry
• /
• v.3 no.1
• /
• pp.97-105
• /
• 1992

Present study investigated the relationship between children's psychiatric disorders and their mothers' psychological problems. Ninety-one psychiatric outpatients from a children's hospital were classified into three diagnostic groups - internalizing symptom group(n=35), externalizing symptom group(n=35), and developmental disorder group(n=21) - based on their psychiatric problems. A normal control group was formed by matching on the age and education of mothers. Mothers' MMPI profiles which were classified into five types - normal, depression, anxiety disorder, somatization disorder, and personality disorder - were examined in relation with children's diagnoses. The profiles of the mothers in the normal control group were mostly normal, while depressive profiles were dominant among those of the clinical groups regardless of the children's diagnoses. Therefore, the data implied association between children's psychiatric problems and their mothers' psychological problems. A possibility of negative reciprocal interactions between children and their mothers was discussed. It was also suggested that further research need to examine the specific effects of children's psychiatric problems on the psychological adjustment of their mothers, as well as the effects of parental psychiatric problems on the adjustment of their offsprings.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.6
• /
• pp.1493-1504
• /
• 2016

As cyber threats have been increased over the Internet, the invasions of personal information are constantly occurring. A malicious user can access the Web site as a normal user using leaked personal information and does illegal activities. This paper proposes an effective method which authenticates a genuine user with real-time. The method use the user's profile which is a record of user's behavior created by Membership Analysis(MA) and Markov Chain Model(MCM). In addition to, user's profile is augmented by a Time Weight(TW) which reflects the user's tendency. This method can detect a malicious user who camouflage normal user. Even if it is a genuine user, it can be determined as an abnomal user if the user acts beyond the record profile. The result of experiment showed a high accuracy, 96%, for the correct user.

• Convergence Security Journal
• /
• v.8 no.2
• /
• pp.63-70
• /
• 2008

In order not to make the malwares be easily analyzed, the hackers apply various anti-reversing and obfuscation techniques to the malwares. However, as the more anti-revering techniques are applied to the malwares the more abnormal characteristics in the PE file's header which are not shown in the normal PE file, could be observed. In this letter, a new malware detection technique is proposed based on this observation. For the malware detection, we define the Characteristics Vector(CV) which can represent the characteristics of a PE file's header. In the learning phase, we calculate the average CV(ACV) of malwares(ACVM) and normal files(ACVN). To detect the malwares we calculate the 2 Weighted Euclidean Distances(WEDs) from a file's CV to ACVs and they are used to decide whether the file is a malware or not. The proposed technique is very fast and detection rate is fairly high, so it could be applied to the network based attack detection and prevention devices. Moreover, this technique is could be used to detect the unknown malwares because it does not utilize a signature but the malware's characteristics.

• Journal of the Korea Society of Computer and Information
• /
• v.8 no.1
• /
• pp.103-113
• /
• 2003

Program Behavior Intrusion Detection Technique analyses system calls that called by daemon program or root authority, constructs profiles. and detectes anomaly intrusions effectively. Anomaly detections using system calls are detected only anomaly processes. But this has a Problem that doesn't detect affected various Part by anomaly processes. To improve this problem, the relation among system calls of processes is represented by bayesian probability values. Application behavior profiling by Bayesian Network supports anomaly intrusion informations . This paper overcomes the Problems of various intrusion detection models we Propose effective intrusion detection technique using Bayesian Networks. we have profiled concisely normal behaviors using behavior context. And this method be able to detect new intrusions or modificated intrusions we had simulation by proposed normal behavior profiling technique using UNM data.

• Journal of the Korean Data and Information Science Society
• /
• v.21 no.6
• /
• pp.1125-1136
• /
• 2010

Lately there exist increasing demands for online abnormality monitoring over trajectory stream, which are obtained from moving object tracking devices. This problem is challenging due to the requirement of high speed data processing within limited space cost. In this paper, we present a FADA (Fuzzy Anomaly Detection Algorithm) which constructs normal profile by computing mobility feature information from the GPS (Global Positioning System) logs of mobile devices in MANETs (Mobile Ad-hoc Networks), computes a fuzzy dissimilarity between the current mobility feature information of the mobile device and the mobility feature information in the normal profile, and detects effectively the anomaly behaviors of mobile devices on the basis of the computed fuzzy dissimilarity. The performance of proposed FADA is evaluated through simulation.

• Journal of the Korean Data and Information Science Society
• /
• v.20 no.2
• /
• pp.387-399
• /
• 2009

Mobile wireless networks continue to be plagued by theft of identify and intrusion. Both problems can be addressed in two different ways, either by misuse detection or anomaly-based detection. In this paper, we propose a dissimilarity-based anomaly detection method which can effectively identify abnormal behavior such as mobility patterns of mobile wireless networks. In the proposed algorithm, a normal profile is constructed from normal mobility patterns of mobile nodes in mobile wireless networks. From the constructed normal profile, a dissimilarity is computed by a weighted dissimilarity measure. If the value of the weighted dissimilarity measure is greater than the dissimilarity threshold that is a system parameter, an alert message is occurred. The performance of the proposed method is evaluated through a simulation. From the result of the simulation, we know that the proposed method is superior to the performance of other anomaly detection methods using dissimilarity measures.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2011.11a
• /
• pp.520-522
• /
• 2011

위성으로부터 전송받은 Telemetry 플레이백 데이터 파일들을 적절한 크기로 또는 저장된 시간에 따라 병합하거나 분할할 수 있는 플레이백 파일 병합/분할 프로그램을 구현하였다. 기존에 플레이백 데이터가 정상적으로 수신되었는지를 점검하기 위한 플레이백 데이터 자동 분석 프로그램이 있는데, 기존의 프로그램을 윈도우 기반으로 보다 편리하게 사용할 수 있도록 전체적으로 보완하였고, 여기에 플레이백 파일 병합/분할 기능을 추가하여 전체적으로 하나로 통합하였다. 본 논문은 차세대 저궤도 위성에서 수행되는 데이터 저장 및 전송에 대한 내용과 새롭게 개선된 플레이백 데이터 자동분석 프로그램 및 플레이백 파일 병합/분할 프로그램에 대해 기술한 것이다.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2019.01a
• /
• pp.159-160
• /
• 2019

본 연구에서는 영상 내 도로의 형태와 영상 내 객체들의 속성을 실시간으로 자기 학습하고 영상 전체에서 나타난 객체와 각 도로 차선을 지나는 객체들의 이상 징후를 판별하기 위해 교통 CCTV 영상을 활용한다. 각 도로 구간을 촬영한 교통 영상에서 추출한 이동 객체 로그에서 영상 내 도로 형태와 영상 내 객체들의 속성을 통해 감시 공간을 학습하고 학습된 정상 프로파일 대비 각 차선을 지나는 객체들과 영상 내 객체들의 이상 상황을 실시간에 판별한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2003.05c
• /
• pp.1579-1582
• /
• 2003

점차 네트워크상의 침입 시도가 증가되고 다변화되어 침입탐지에 많은 어려움을 주고 있다. 시스템에 새로운 침입에 대한 탐지능력과 다량의 감사데이터의 효율적인 분석을 위해 데이터마이닝 기법이 적용된다. 침입탐지 방법 중 비정상행위 탐지는 모델링된 정상행위에서 벗어나는 행위들을 공격행위로 간주하는 기법이다. 비정상행위 탐지에서 정상행위 모델링을 하기 위해 연관규칙이나 빈발에피소드가 적용되었다. 그러나 이러한 기법들에서는 시간요소를 배제하거나 패턴들의 발생순서만을 다루기 때문에 정확하고 유용한 정보를 제공할 수 없다. 따라서 이 논문에서는 이 문제를 해결할 수 있는 시간연관규칙과 분류규칙을 이용한 비정상행위 탐지 모델을 제안하였다. 즉, 발생되는 패턴의 주기성과 달력표현을 이용, 유용한 시간지식표현을 갖는 시간연관규칙을 이용해 정상행위 프로파일을 생성하였고 이 프로파일에 의해 비정상행위로 간주되는 규칙들을 발견하고 보다 정확한 비정상행위 판별 여부를 결정하기 위해서 분류기법을 적용하였다.