• Proceedings of the Korea Information Processing Society Conference
• /
• 2003.05c
• /
• pp.1997-2000
• /
• 2003

False Positive Alert 은 IDS 가 공격이 아닌 것을 공격으로 잘못 판단하는 것이다 이러한 false Positive 는 시스템에 직접적인 피해를 주지는 않으나, 시스템 관리자가 적절한 대처를 하기 어렵게 하므로 IDS의 새로운 문제점으로 대두되고 있다. 본 논문에서는 이러한 false Positive를 줄이기 위해 IDS 에서 나오는 Alert 중 False Positive를 필터링 하는 방법에 대해 제시한다. 공격에 대한 Alert과 False Positive Alert의 시간 패턴을 각각 분석, 학습함으로써 그 후의 Alert의 False Positive 여부를 판별한다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2004.10a
• /
• pp.307-309
• /
• 2004

침입탐지시스템에서 발생되는 오 경보는 false positive 와 false negative 로 구분된다. false positive는 실제적인 공격은 아니지만 공격이라고 오인하여 경보를 발생시켜 시스템의 효율성을 떨어뜨리기 때문에 false positive 패턴에 대한 분석이 필요하다. 오 경보 데이터는 시간이 지남에 따라 데이터의 양뿐만 아니라 데이터 패턴의 특성 또한 변하게 된다 따라서 새로운 데이터가 추가될 때마다 오 경보 데이터의 패턴을 분석할 수 있는 도구가 필요하다. 이 논문에서는 오 경보 데이터로부터 false positive 의 패턴을 분석할 수 있는 프레임워크에 대해서 기술한다. 우리의 프레임워크는 시간이 지남에 따라 변하는 데이터의 패턴 특성을 분석할 수 있도록 하기 위해 점진적 연관규칙 기법을 적용한다. 이 프레임워크를 통해서 false positive 패턴 특성의 변화를 효율적으로 관리 할 수 있다.

• Journal of Korean Tunnelling and Underground Space Association
• /
• v.21 no.3
• /
• pp.419-432
• /
• 2019

Most of deep learning model training was proceeded by supervised learning, which is to train labeling data composed by inputs and corresponding outputs. Labeling data was directly generated manually, so labeling accuracy of data is relatively high. However, it requires heavy efforts in securing data because of cost and time. Additionally, the main goal of supervised learning is to improve detection performance for 'True Positive' data but not to reduce occurrence of 'False Positive' data. In this paper, the occurrence of unpredictable 'False Positive' appears by trained modes with labeling data and 'True Positive' data in monitoring of deep learning-based CCTV accident detection system, which is under operation at a tunnel monitoring center. Those types of 'False Positive' to 'fire' or 'person' objects were frequently taking place for lights of working vehicle, reflecting sunlight at tunnel entrance, long black feature which occurs to the part of lane or car, etc. To solve this problem, a deep learning model was developed by simultaneously training the 'False Positive' data generated in the field and the labeling data. As a result, in comparison with the model that was trained only by the existing labeling data, the re-inference performance with respect to the labeling data was improved. In addition, re-inference of the 'False Positive' data shows that the number of 'False Positive' for the persons were more reduced in case of training model including many 'False Positive' data. By training of the 'False Positive' data, the capability of field application of the deep learning model was improved automatically.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2015.04a
• /
• pp.380-383
• /
• 2015

오용 탐지모델 기반의 침입탐지시스템은 새로운 사이버 공격을 탐지하기 위해 지속적으로 탐지규칙을 생성해야 한다. 공격에 대한 특징을 정확히 식별하지 못하고 탐지규칙을 생성할 경우 많은 false positive를 발생시키며, 이로 인해 침해사고 대응시간이 늦어진다. 본 논문에서는 침입탐지시스템에서 탐지된 이벤트의 true positive와 false positive 데이터를 Keyword Tree의 node에 경로를 지나가는 횟수를 누적하는 값을 포함시킨 자료구조를 기반으로 비교분석하여 false positive를 감소시킬 수 있는 탐지규칙 패턴 생성 기법을 제안한다.

• IEIE Transactions on Smart Processing and Computing
• /
• v.4 no.3
• /
• pp.163-168
• /
• 2015

Many IP address lookup approaches employ Bloom filters to obtain a high-speed search performance. Especially, it has been recently studied that the search performance of trie-based algorithms can be significantly improved by adding Bloom filters. In such algorithms, the number of trie accesses can be greatly reduced because Bloom filters can determine whether a node exists in a trie without actually accessing the trie. Bloom filters do not have false negatives but have false positives. False positives can lead to unnecessary trie accesses. The false positive rate must thus be reduced to enhance the performance of lookup algorithms applying Bloom filters. One important characteristic of trie-based algorithms is that all the ancestors of a node are also stored. The proposed algorithm utilizes this characteristic in reducing the false positive rate of a Bloom filter without increasing the size of the memory for the Bloom filter. When a Bloom filter produces a positive result for a node of a trie, we propose to check whether the ancestors of the node are also positives. Because Bloom filters have no false negatives, the negatives of any of the ancestors mean that the positive of the node is false. In other words, we propose to use more Bloom filter queries to reduce the false positive rate of a Bloom filter in trie-based algorithms. Simulation results show that querying one ancestor of a node can reduce the false positive rate by up to 67% with exactly the same architecture and the same memory requirement. The proposed approach can be applied to other trie-based algorithms employing Bloom filters.

• Journal of KIISE:Information Networking
• /
• v.31 no.2
• /
• pp.171-178
• /
• 2004

Port scanning detection systems should rather satisfy a certain level of the requirement for system performance like a low rate of “False Positive” and “False Negative”, and requirement for convenience for users to be easy to manage the system security with detection systems. However, public domain Real Time Scan Detection Systems have high rate of false detection and have difficulty in detecting various scanning techniques. In addition, as current real time scan detection systems are based on command interface, the systems are poor at user interface and thus it is difficult to apply them to the system security management. Hence, we propose TkRTSD(Tcl/Tk Real Time Scan Detection System) that is able to detect various scan attacks based on port scanning techniques by applying a set of new filter rules, and minimize the rate of False Positive by applying proposed ABP-Rules derived from attacker's behavioral patterns. Also a GUI environment for TkRTSD is implemented by using Tcl/Tk for user's convenience of managing network security.

• Tuberculosis and Respiratory Diseases
• /
• v.83 no.3
• /
• pp.211-217
• /
• 2020

The gold standard method for diagnosis of tuberculosis is the isolation of Mycobacterium tuberculosis through culture, but there is a probability of cross-contamination in simultaneous cultures of samples causing false-positives. This can result in delayed treatment of the underlying disease and drug side effects. In this paper, we reviewed studies on false-positive cultures of M. tuberculosis. Rate of occurrence, effective factors, and extent of false-positives were analyzed. Ways to identify and reduce the false-positives and management of them are critical for all laboratories. In most cases, false-positive is occurring in cases with only one positive culture but negative direct smear. The three most crucial factors in this regard are inappropriate technician function, contamination of reagents, and aerosol production. Thus, to reduce false-positives, good laboratory practice, as well as use of whole-genome sequencing or genotyping of all positive culture samples with a robust, extra pure method and rapid response, are essential for minimizing the rate of false-positives. Indeed, molecular approaches and epidemiological surveillance can provide a valuable tool besides culture to identify possible false positives.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.16 no.6
• /
• pp.2115-2130
• /
• 2022

With the development of over-the-top (OTT) services, the demand for content is increasing, and you can easily and conveniently acquire various content in the online environment. As a result, copyrighted content can be easily copied and distributed, resulting in serious copyright infringement. Some special forms of online service providers (OSP) use filtering-based technologies to protect copyrights, but illegal uploaders use methods that bypass traditional filters. Uploading with a title that bypasses the filter cannot use a similar search method to detect illegal content. In this paper, we propose a technique for profiling the Heavy Uploader by normalizing the bypassed content title and efficiently detecting illegal content. First, the word is extracted from the normalized title and converted into a bit-array to detect illegal works. This Bloom Filter method has a characteristic that there are false positives but no false negatives. The false positive rate has a trade-off relationship with processing performance. As the false positive rate increases, the processing performance increases, and when the false positive rate decreases, the processing performance increases. We increased the detection rate by directly comparing the word to the result of increasing the false positive rate of the Bloom Filter. The processing time was also as fast as when the false positive rate was increased. Afterwards, we create a function that includes information about overall piracy and identify clustering-based heavy uploaders. Analyze the behavior of heavy uploaders to find the first uploader and detect the source site.

• Communications for Statistical Applications and Methods
• /
• v.17 no.5
• /
• pp.679-688
• /
• 2010

Lee (2010) developed a confidence interval for the difference of binomial proportions in two doubly sampled data subject to false-positive errors. The confidence interval seems to be adequate for a general double sampling model subject to false-positive misclassification. However, in many applications, the false-positive error rates could be the same. On this note, the construction of asymptotic confidence interval is considered when the false-positive error rates are common. The coverage behaviors of nine likelihood based confidence intervals are examined. It is shown that the confidence interval based Rao score with the expected information has good performance in terms of coverage probability and expected width.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.10a
• /
• pp.697-699
• /
• 2003

최근의 네트워크 공격의 주류는 DoS (denial-of-service)와 DDoS (distributed DoS) 공격이다. 이러한 공격들은 공격자가 침입 대상 시스템의 자원을 완전히 소모시켜서 시스템이 정상적인 서비스를 할 수 없도록 하는 것이다. 각 시스템의 관리자들은 이러한 침입이나 공격을 막기 위한 방편 중에 하나로 IDS(Intrusion detection system)를 사용하고 있다. 그러나 IDS의 높은 false-positive(정상적인 사용을 공격으로 잘못 판단하는 경우)의 발생빈도는 심각한 문제점 중의 하나는 이다. 이런 false-positive의 발생빈도를 줄이고자 본 논문에서는 한번의 판단만으로 연결(connection)을 차단시키지 않고, trust라는 개념을 도입하여 trust의 값에 따라서 사용자에게 차등 서비스를 제공하는 기법을 제안한다. 즉, trust를 이용하는 기법은 각 사용자를 한번에 공격자인지 일반 사용자인지 결정하지 않고, 한 번 더 검사하여 false-positive의 발생빈도를 감소시키는 기법이다.