• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.13 no.4
• /
• pp.151-159
• /
• 2003

Internet as being generalized, intrusion detection system is needed to protect computer system from intrusions synthetically. We propose an intrusion detection method to identify and control the contradiction on self-explanation that happen at profiling process of anomaly detection methodology. Because many patterns can be created on profiling process with association method, we present effective application plan through clustering for rules. Finally, we propose similarity function to decide whether anomaly action or not for user pattern using clustered pattern database.

• Journal of KIISE
• /
• v.41 no.12
• /
• pp.1035-1049
• /
• 2014

This paper presents a new method to detect attack patterns in security-critical systems, based on a new notion of Behavior Ontology. Generally security-critical systems are large and complex, and they are subject to be attacked in every possible way. Therefore it is very complicated to detect various attacks through a semantic structure designed to detect such attacks. This paper handles the complication with Behavior Ontology, where patterns of attacks in the systems are defined as a sequences of actions on the class ontology of the systems. We define the patterns of attacks as sequences of actions, and the attack patterns can then be abstracted in a hierarchical order, forming a lattice, based on the inclusion relations. Once the behavior ontology for the attack patterns is defined, the attacks in the target systems can be detected both semantically and hierarchically in the ontology structure. When compared to other attack models, the behavior ontology analysis proposed in this paper is found to be very effective and efficient in terms of time and space.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2000.04a
• /
• pp.40-44
• /
• 2000

최근의 네트워크를 통한 침입과 유형은 갈수록 다양화되고 있으며, 지능적으로 변하고 있다. 그러나 외부의 침입자뿐만 아니라 내부의 권한 오용으로 인한 침입의 탐지도 중요시되고 있으며, 그에 따른 운영체제와 네트워크 분야의 보안에 관한 연구 또한 활발히 진행되어 어느 정도의 성과를 얻고 있다. 그러나 데이터베이스의 보안은 데이터베이스 관리시스템에 거의 의존하고 있는 실정이다. 본 논문에서는 사용자의 정상행위를 효과적으로 모델링하기 위해서 데이터마이닝 기법인 연관규칙과 순차패턴을 이용하여 사용자의 정상행위 패턴을 추출하였다. 결과적으로 외부침입자 및 내부의 권한 오용자에 대한 비정상행위를 효과적으로 판정할 수 있다.

• Journal of Convergence for Information Technology
• /
• v.11 no.4
• /
• pp.55-63
• /
• 2021

Recently, the incidence rate of malicious codes is over tens of thousands of cases, and it is known that it is almost impossible to detect/respond all of them. This study proposes a method for detecting multiple behavior patterns based on a graph database as a new method for dealing with malicious codes. Traditional dynamic analysis techniques and has applied a method to design and analyze graphs of representative associations malware pattern(process, PE, registry, etc.), another new graph model. As a result of the pattern verification, it was confirmed that the behavior of the basic malicious pattern was detected and the variant attack behavior(at least 5 steps), which was difficult to analyze in the past. In addition, as a result of the performance analysis, it was confirmed that the performance was improved by about 9.84 times or more compared to the relational database for complex patterns of 5 or more steps.

• The Transactions of the Korea Information Processing Society
• /
• v.7 no.8
• /
• pp.2411-2420
• /
• 2000

Far detecting variaus camputer intrusians effectively, many researches have develaped the misuse based intrusian detectian systems. Recently, warks related ta anamaly detectian, which have impraved the drawback .of misuse detectian technique, have been under focus. In this paper, a new clustering algarithm based an support constraint far generating user's narmal activity patterns in the anamaly detectian can praposed. It can grant a user's activity .observed recently ta mare weight than that .observed in the past. In order that a user's anamaly can be analyzed in variaus angles, a user's activity is classified by many measures, and far each .of them user's narmal patterns can be generated. by using the proposed algarithm. As a result, using generated narmal patterns, user's anamaly can be detected easily and effectively.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.25 no.4
• /
• pp.603-610
• /
• 2021

In this paper, we extract the user's power consumption patterns, and model the optimal consumption patterns by applying the user's environment and emotion. Based on the comparative analysis of these two patterns, we present an efficient power consumption method through changes in the user's power consumption behavior. To extract significant consumption patterns, vector standardization and binary data transformation methods are used, and learning about the ensemble's ensemble with k-means clustering is applied, and applying the support factor according to the value of k. The optimal power consumption pattern model is generated by applying forced and emotion-based control based on the learning results for ensemble aggregates with relatively low average consumption. Through experiments, we validate that it can be applied to a variety of windows through the number or size adjustment of clusters to enable forced and emotion-based control according to the user's intentions by identifying the correlation between the number of clusters and the consistency ratios.

• Proceedings of the Korean Information Science Society Conference
• /
• 2001.10a
• /
• pp.724-726
• /
• 2001

본 논문에서는 컴퓨터 바이러스의 자기 복제 특성을 용한 바이러스 탐지 및 복구 방안을 제안한다. 바이러스의 행동 패턴은 바이러스의 종류 만큼 다양하지만 파일 바이러스의 경우, 자기 복제 행동 패턴은 대부분의 바이러스가 유사하다. 파일 바이러스가 시스템 감염시키기 위해서는 기생할 실행파일을 열고, 자기 자신을 그 실행 파일에 복사해야 한다. 이와 같은 자기 복제 행위를 통해 바이러스가 광범위하게 선과될 때 피 피해도 커지게 된다. 바이러스치 자기 복제 특성을 감안하여 본 연구에서 제안하는 바이러스 탐지 알고리즘은 다음과 같은 득징을 가진다. 첫째, 바이러스의 자기복세 행동 패턴은 파일 입출력 이벤트로 표현하여 바이러스의 행동 패턴으로 일반화시켰다. 둘째, 바이러스의 1차 감염행위는 허용하고 2차 이후 감염 행위부터 탐지하고, 탐지되기 이전에 감염되었던, 파일들을 복구한다. 이는 일반적인 바이러스들이 자기 복제를 지속적으로 수행한다는 점에 착안하여 false-positive 오류를 줄이기 위한 것이다. 본 고에서 제안하는 방법을 사용함으로써 특정 문자열에 의한 바이러스 탐지 및 복구 방법의 단점을 보안할 수 있을 것으로 기대된다.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.7 no.3
• /
• pp.544-551
• /
• 2003

Internet as being generalized, intrusion detection system is needed to protect computer system from intrusions synthetically. We propose a criterion on profiling for intrusion detection system using anomaly detection. We present the cause of false positive on profiling and propose anomaly method to control this. Finally, we propose similarity function to decide whether anomaly action or not for user pattern using pattern database.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2003.05c
• /
• pp.1579-1582
• /
• 2003

점차 네트워크상의 침입 시도가 증가되고 다변화되어 침입탐지에 많은 어려움을 주고 있다. 시스템에 새로운 침입에 대한 탐지능력과 다량의 감사데이터의 효율적인 분석을 위해 데이터마이닝 기법이 적용된다. 침입탐지 방법 중 비정상행위 탐지는 모델링된 정상행위에서 벗어나는 행위들을 공격행위로 간주하는 기법이다. 비정상행위 탐지에서 정상행위 모델링을 하기 위해 연관규칙이나 빈발에피소드가 적용되었다. 그러나 이러한 기법들에서는 시간요소를 배제하거나 패턴들의 발생순서만을 다루기 때문에 정확하고 유용한 정보를 제공할 수 없다. 따라서 이 논문에서는 이 문제를 해결할 수 있는 시간연관규칙과 분류규칙을 이용한 비정상행위 탐지 모델을 제안하였다. 즉, 발생되는 패턴의 주기성과 달력표현을 이용, 유용한 시간지식표현을 갖는 시간연관규칙을 이용해 정상행위 프로파일을 생성하였고 이 프로파일에 의해 비정상행위로 간주되는 규칙들을 발견하고 보다 정확한 비정상행위 판별 여부를 결정하기 위해서 분류기법을 적용하였다.

• Journal of KIISE:Software and Applications
• /
• v.41 no.8
• /
• pp.586-597
• /
• 2014

The next generation mobile computing technology is recently attracting attention that smartphone and wearable device imbedded with various sensors are being deployed in the world. Existing activity and posture recognition research can be divided into two different ways considering feature of one's movement. While activity recognition focuses on catching distinct pattern according to continuous movement, posture recognition focuses on sudden change of posture and body orientation. There is a lack of research constructing a system mixing two separate patterns which could be applied in real world. In this paper, we propose a method to use both smartphone and wearable device to recognize activity and posture in the same time. To use smartphone and wearable sensor data together, we designed a pre-processing method and constructed recognition model mixing signal vector magnitude and orientation pattern features of vertical and horizontal. We considered cycling, fast/slow walking and running activities, and postures such as standing, sitting, and laying down. We confirmed the performance and validity by experiment, and proved the feasibility in real world.