• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.34 no.1B
• /
• pp.47-55
• /
• 2009

In recent network intrusion detection systems, regular expressions are used to represent malicious packets. In order to process incoming packets through high speed networks in real time, we should perform hardware-based pattern matching using the configurable device such as FPGAs. However, operating speed of FPGAs is slower than giga-bit speed network and so, multi-byte processing per clock cycle may be needed. In this paper, we propose a hardware architecture of multi-byte based regular expression pattern matching and implement the pattern matching circuit generator. The throughput improvements in four-byte based pattern matching circuit synthesized in FPGA for several Snort rules are $2.62{\sim}3.4$ times.

• Journal of the Korean Institute of Intelligent Systems
• /
• v.16 no.3
• /
• pp.378-382
• /
• 2006

This paper presents an approach to detect premature ventricular contractions(PVC) using the neural network with weighted fuzzy membership functions(NEWFM). NEWFM classifies normal and PVC beats by the trained weighted fuzzy membership functions using wavelet transformed coefficients extracted from the MIT-BIH PVC database. The two most important coefficients are selected by the non-overlap area distribution measurement method to minimize the classification rules that show PVC classification rate of 99.90%. By Presenting locations of the extracted two coefficients based on the R wave location, it is shown that PVC can be detected using only information of the two portions.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2002.05a
• /
• pp.619-622
• /
• 2002

IDS has been studied mainly in the field of the detection derision and collecting of audit data. The detection decision should decide whether successive behaviors are intrusions or not , the collecting of audit data needs ability that collects precisely data for intrusion decision. Artificial methods such as rule based system and neural network are recently introduced in order to solve this problem. However, these methods have simple host structures and defects that can't detect transformed intrusion patterns. So, we propose the method using data mining agent that can retrieve and estimate the patterns and retrieval of user's behavior in the distributed different hosts.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.27 no.3A
• /
• pp.221-230
• /
• 2002

This paper presents a new moving object segmentation algorithm using markov random field. The algorithm is based on signal detection theory. That is to say, motion of moving object is decided by binary decision rule, and false decision is corrected by markov random field model. The procedure toward complete segmentation consists of two steps: motion detection and object segmentation. First, motion detection decides the presence of motion on velocity vector by binary decision rule. And velocity vector is generated by optical flow. Second, object segmentation cancels noise by Bayes rule. Experimental results demonstrate the efficiency of the presented method.

• Annual Conference of KIPS
• /
• 2009.11a
• /
• pp.663-664
• /
• 2009

OWASP에서 발표한 2007년 웹 애플리케이션 취약점 중 하나인 XSS 공격이 사용자 브라우저에서 스크립트를 실행하게 함으로써 사용자의 세션을 가로채거나 웜을 업로드하여 악성코드를 삽입하는 공격이다[2]. 하지만 많은 XSS 방어 기법에서는 단순 스크립트 우회기법과 강제적인 스크립트 차단 방법을 채택하고 있다. 또한 강제적인 XSS 필터 적용으로 과탐지로 인한 정상적인 웹 페이지가 출력 되지 않는 사례가 나타나고 있다. 따라서 본 연구는 효율적인 정규식을 이용하여 XSS 공격 특징을 분석하여 특징점들을 추출하고 이 특징점들을 기반으로 특정한 규칙을 가진 문자열들을 모든 문자가 유효한지 확인할 수 있는 정규식 표현 방법을 이용하여 다양한 응용프로그램에 적용할 수 있는 기술을 연구하고자 한다. 또한 이를 기반으로 포털 사이트와 브라우저에서 제공하는 XSS 필터들과 비교하여 과탐지율 및 오탐지율 서로 비교하여 본 연구가 효율성 면에서 효과가 있는지 우위를 둘 것이며, 브라우저 벤더, 포털 사이트, 개인 PC 등 충분한 시험 평가와 수정을 통해서 응용할 수 있는 계기를 마련할 것이다

• Journal of the Korea Society of Computer and Information
• /
• v.17 no.4
• /
• pp.11-18
• /
• 2012

Deep packet inspection which perform pattern matching to search for malicious patterns in the packet is most computationally intensive task. Hardware-based pattern matching is required for real-time packet inspection in high-speed network. In this paper, we have designed and implemented network intrusion detection hardware as a Microblaze-based SoC using Virtex-6 FPGA, which capture the network input packet, perform hardware-based pattern matching for patterns in the Snort rule, and provide the matching result to the software. We verify the operation of the implemented system using traffic generator and real network traffic. The implemented hardware can be used in network intrusion detection system operated in wire-speed.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.26 no.9
• /
• pp.1259-1265
• /
• 2022

Recently, AI, big data, and IoT technologies are being used in various solutions such as fire detection and gas or dangerous substance detection for safety accident prevention. According to the status of occupational accidents published by the Ministry of Employment and Labor in 2021, the accident rate, the number of injured, and the number of deaths have increased compared to 2020. In this paper, referring to the dataset construction guidelines provided by the National Intelligence Service Agency(NIA), the dataset is directly collected from the field and learned with YOLOv4 to propose a collision risk object detection system through object detection. The accuracy of the dangerous situation rule violation was 88% indoors and 92% outdoors. Through this system, it is thought that it will be possible to analyze safety accidents that occur in industrial sites in advance and use them to intelligent platforms research.

• Journal of IKEEE
• /
• v.9 no.1 s.16
• /
• pp.19-30
• /
• 2005

Packet classification is defined as the action to match the packet with a set of predefined rules. One of classification is to use Ternary Content Addressable Memory hardware search engine that has faster than other algorithmic methods. However, TCAM has some limitations. One of them is that TCAM can not perform range matching efficiently. A range has to be expanded into prefixes to fit the boundary. In general, the number of expansion could be up to 2w-2, where w is the width of the field. For example, if two range fields with 16 bits are used, there could be up to $30\;{\times}\;30\;=\;900$ expansions for a single rule. In this paper, we describe the novel algorithm for converting range matching rules into TCAM entry efficiently. The number of maximum entry is 2w-4 when using the algorithm. Furthermore, it has also benefit about the negation range. In the result of experimentation, the new scheme practically reduces 14 percent in case that searched fields are source port and destination port number.

• Journal of Intelligence and Information Systems
• /
• v.20 no.3
• /
• pp.93-108
• /
• 2014

To support business decision making, interests and efforts to analyze and use transaction data in different perspectives are increasing. Such efforts are not only limited to customer management or marketing, but also used for monitoring and detecting fraud transactions. Fraud transactions are evolving into various patterns by taking advantage of information technology. To reflect the evolution of fraud transactions, there are many efforts on fraud detection methods and advanced application systems in order to improve the accuracy and ease of fraud detection. As a case of fraud detection, this study aims to provide effective fraud detection methods for auction exception agricultural products in the largest Korean agricultural wholesale market. Auction exception products policy exists to complement auction-based trades in agricultural wholesale market. That is, most trades on agricultural products are performed by auction; however, specific products are assigned as auction exception products when total volumes of products are relatively small, the number of wholesalers is small, or there are difficulties for wholesalers to purchase the products. However, auction exception products policy makes several problems on fairness and transparency of transaction, which requires help of fraud detection. In this study, to generate fraud detection rules, real huge agricultural products trade transaction data from 2008 to 2010 in the market are analyzed, which increase more than 1 million transactions and 1 billion US dollar in transaction volume. Agricultural transaction data has unique characteristics such as frequent changes in supply volumes and turbulent time-dependent changes in price. Since this was the first trial to identify fraud transactions in this domain, there was no training data set for supervised learning. So, fraud detection rules are generated using outlier detection approach. We assume that outlier transactions have more possibility of fraud transactions than normal transactions. The outlier transactions are identified to compare daily average unit price, weekly average unit price, and quarterly average unit price of product items. Also quarterly averages unit price of product items of the specific wholesalers are used to identify outlier transactions. The reliability of generated fraud detection rules are confirmed by domain experts. To determine whether a transaction is fraudulent or not, normal distribution and normalized Z-value concept are applied. That is, a unit price of a transaction is transformed to Z-value to calculate the occurrence probability when we approximate the distribution of unit prices to normal distribution. The modified Z-value of the unit price in the transaction is used rather than using the original Z-value of it. The reason is that in the case of auction exception agricultural products, Z-values are influenced by outlier fraud transactions themselves because the number of wholesalers is small. The modified Z-values are called Self-Eliminated Z-scores because they are calculated excluding the unit price of the specific transaction which is subject to check whether it is fraud transaction or not. To show the usefulness of the proposed approach, a prototype of fraud transaction detection system is developed using Delphi. The system consists of five main menus and related submenus. First functionalities of the system is to import transaction databases. Next important functions are to set up fraud detection parameters. By changing fraud detection parameters, system users can control the number of potential fraud transactions. Execution functions provide fraud detection results which are found based on fraud detection parameters. The potential fraud transactions can be viewed on screen or exported as files. The study is an initial trial to identify fraud transactions in Auction Exception Agricultural Products. There are still many remained research topics of the issue. First, the scope of analysis data was limited due to the availability of data. It is necessary to include more data on transactions, wholesalers, and producers to detect fraud transactions more accurately. Next, we need to extend the scope of fraud transaction detection to fishery products. Also there are many possibilities to apply different data mining techniques for fraud detection. For example, time series approach is a potential technique to apply the problem. Even though outlier transactions are detected based on unit prices of transactions, however it is possible to derive fraud detection rules based on transaction volumes.

• Journal of Internet Computing and Services
• /
• v.10 no.2
• /
• pp.1-13
• /
• 2009

Intrusion detection is a process that identifies the attacks and responds to the malicious intrusion actions for the protection of the computer and the network resources. Due to the fast development of the Internet, the types of intrusions become more complex recently and need immediate and correct responses because the frequent occurrences of a new intrusion type rise rapidly. Therefore, to solve these problems of the intrusion detection systems, we propose a sequential pattern miner for analysis of the alert data in order to support intelligent and automatic detection of the intrusion. Sequential pattern mining is one of the methods to find the patterns among the extracted items that are frequent in the fixed sequences. We apply the prefixSpan algorithm to find out the alert sequences. This method can be used to predict the actions of the sequential patterns and to create the rules of the intrusions. In this paper, we propose an extended prefixSpan algorithm which is designed to consider the specific characteristics of the alert data. The extended sequential pattern miner will be used as a part of alert data analyzer of intrusion detection systems. By using the created rules from the sequential pattern miner, the HA(high-level alert analyzer) of PEP(policy enforcement point), usually called IDS, performs the prediction of the sequence behaviors and changing patterns that were not visibly checked.