• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.31 no.2C
• /
• pp.208-218
• /
• 2006

In this paper, we introduce the creation methods of attack detection model using data mining technologies that can classify the latest attack types, and can detect the modification of existing attacks as well as the novel attacks. Also, we evaluate comparatively these attack detection models in the view of detection accuracy and detection time. As the important factors for creating detection models, there are data, attribute, and detection algorithm. Thus, we used NetFlow data gathered at the real network, and KDD Cup 1999 data for the experiment in large quantities. And for attribute selection, we used a heuristic method and a theoretical method using decision tree algorithm. We evaluate comparatively detection models using a single supervised/unsupervised data mining approach and a combined supervised data mining approach. As a result, although a combined supervised data mining approach required more modeling time, it had better detection rate. All models using data mining techniques could detect the attacks within 1 second, thus these approaches could prove the real-time detection. Also, our experimental results for anomaly detection showed that our approaches provided the detection possibility for novel attack, and especially SOM model provided the additional information about existing attack that is similar to novel attack.

• Proceedings of the KIEE Conference
• /
• 2007.11b
• /
• pp.294-295
• /
• 2007

The importance of security is increased in power industry. Recently Power IT networks are attacked in cyber space and demage of attack become increased. For solving the problems, many research studies for network security enhancement are globally carried out in the world. In this paper, we introduce recent cyber attack cases, efforts for enhancing cyber safeness and put into perspective of potential security areas for power IT areas.

• Proceedings of the Korean Information Science Society Conference
• /
• 2005.11a
• /
• pp.214-216
• /
• 2005

We consider Wireless Sensor Network Security (WSN) and focus our attention to tolerate damage caused by an adversary who has compromised deployed sensor node to modify, block, or inject packets. We adopt a probabilistic secret sharing protocol where secrets shared between two sensor nodes are not exposed to any other nodes. Adapting to WSN characteristics, we incorporate these secrets to establish new pairwise key for node to node authentication and design multipath routing to multiple base stations to defend against HELLO flood attacks. We then analytically show that our defense mechanisms against HELLO flood attack can tolerate damage caused by an intruder.

• International Journal of Aeronautical and Space Sciences
• /
• v.4 no.2
• /
• pp.26-36
• /
• 2003

The objective of this study is to enhance neural-network guidance to consider the impact condition. The optimal impact condition in this study is defined as an head-on attack. Missile impact-angle error, which is a measure of the degree to which the missile is not steering for a head-on attack, can also have an influence on the final miss distance. Therefore midcourse guidance is used to navigate the missile, reducing the deviation angle from head on, given some constraints on the missile g performance. A coordinate transformation is introduced to simplify the three-dimensional guidance law and, consequently, to reduce training data. Computer simulation results show that the neural-network guidance law with the coordinate transformation reduces impact-angle errors effectively.

• Journal of information and communication convergence engineering
• /
• v.8 no.5
• /
• pp.549-553
• /
• 2010

Lim et al. proposed a Hybrid Group Key Management scheme for Hierarchical Self-Organizing Sensor Network in 2008 to provide a secure way to pass down the group key for cluster-based communication. This paper presents two practical attacks on the scheme proposed by Lim et al. by tampering sensor nodes of a cluster to recover necessary secret keys and by exploiting the IDS employed by the scheme. The first attack enables a long-term but slow data fabrication while other attack causes more severe DoS on the access to cluster sensor nodes.

• Journal of information and communication convergence engineering
• /
• v.16 no.3
• /
• pp.148-152
• /
• 2018

Adversarial attacks on artificial intelligence (AI) systems use adversarial examples to achieve the attack objective. Adversarial examples consist of slightly changed test data, causing AI systems to make false decisions on these examples. When used as a tool for attacking AI systems, this can lead to disastrous results. In this paper, we propose an ensemble of degraded convolutional neural network (CNN) modules, which is more robust to adversarial attacks than conventional CNNs. Each module is trained on degraded images. During testing, images are degraded using various degradation methods, and a final decision is made utilizing a one-hot encoding vector that is obtained by summing up all the output vectors of the modules. Experimental results show that the proposed ensemble network is more resilient to adversarial attacks than conventional networks, while the accuracies for normal images are similar.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.8 no.1
• /
• pp.125-137
• /
• 2012

As the Internet use explodes recently, the malicious attacks and hacking for a system connected to network occur frequently. For such reason, lots of intrusion detection system has been developed. Intrusion detection system has abilities to detect abnormal behavior and unknown intrusions also it can detect intrusions by using patterns studied from various penetration methods. Various algorithms are studying now such as the statistical method for detecting abnormal behavior, extracting abnormal behavior, and developing patterns that can be expected. Etc. This study using clustering of data mining and association rule analyzes detecting areas based on two models and helps design detection system which detecting abnormal behavior, unknown attack, misuse attack in a large network.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.5
• /
• pp.873-883
• /
• 2013

Security vulnerability quantification is the method that identify potential vulnerabilities by scoring vulnerabilities themselves and their countermeasures. However, due to the structural feature of smart grid system, it is difficult to apply existing security threat evaluation schemes. In this paper, we propose a network model to evaluate smartgrid security threat for AMI and derive attack scenarios. Additionally, we show that the result of security threat evaluation for proposed network model and attack scenario by applying MTTC scheme.

• Journal of Information Processing Systems
• /
• v.7 no.1
• /
• pp.137-150
• /
• 2011

Mobile ad hoc networks are expected to be widely used in the near future. However, they are susceptible to various security threats because of their inherent characteristics. Malicious flooding attacks are one of the fatal attacks on mobile ad hoc networks. These attacks can severely clog an entire network, as a result of clogging the victim node. If collaborative multiple attacks are conducted, it becomes more difficult to prevent. To defend against these attacks, we propose a novel defense mechanism in mobile ad hoc networks. The proposed scheme enhances the amount of legitimate packet processing at each node. The simulation results show that the proposed scheme also improves the end-to-end packet delivery ratio.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2014.11a
• /
• pp.215-217
• /
• 2014

In Software Defined Network (SDN), data plane and control plane are decoupled. Dummy switches on the data plane simply forward packet based on the flow entries that are stored in its flow table. The flow entries are generated by a centralized controller that acts as a brain of the network. However, the size of flow table is limited and it can conduct a security issue related to Distributed Denial of Service (DDoS). Especially, it related to resource attack that consumes all flow table resource and consumes controller resources. In this paper, we will analyze the impact of flow table limitation to the controller. Then we propose an approach that is called Flow Table Management to handle flow table limitation.