• Proceedings of the Korean Information Science Society Conference
• /
• 2002.10e
• /
• pp.145-147
• /
• 2002

본 논문에서는 네트워크 통신으로 생성된 데이터를 분석하여 서버의 부하를 예측함으로 서버의 성능을 향상시킬 수 있는 모너터링 툴을 설계하였다. 현재 리눅스에서 제공되는 서버 부하 정보는 시스템의 총괄적인 정보에 국한하고 있다. 본 논문에서 제한하는 새로운 부하 정보는 per-connection에 관한 것이다. 서버가 per-connection에 대한 정보를 알 수 있다면 각각의 클라이언트에 대한 정보를 알 수 있어 차별적인 서비스를 제공하는 것과 함께 모든 클라이언트에 대한 균등한 대역폭을 보장할 수 있다. 그래서 본 논문은 기존의 모니터링 툴이 제공하지 않는 Per-connection의 데이터를 얻어 분석을 할 수 있는 CoreMon이라는 툴을 설계하였다.

• Annual Conference of KIPS
• /
• 2011.04a
• /
• pp.611-614
• /
• 2011

본 논문에서 우리는 이종사업자망이 연동된 통합망 환경에서 네트워크 성능 저하 구간을 탐색하기 위해 RTCP(Real-time Transport Control Protocol)의 타임스탬프 정보를 이용한 네트워크 구간별 지연 시간을 측정할 수 있는 트래픽 모니터링 방안을 제안한다. 실시간 멀티미디어 서비스(IPTV, VoIP)의 이용이 증가함에 따라 이종망간 연동 환경에서 실시간 서비스에 대한 QoS 관리 방안이 반드시 필요하다. 영상회의, VoIP(Voice over IP) 및 IPTV 서비스와 같은 멀티미디어 서비스는 네트워크 성능(지연, 지연변이 및 패킷 손실)에 매우 민감하기 때문에 연동망 환경에서 서비스 품질이 저하될 경우 어느 네트워크 구간에서 성능 저하가 발생하였는지 탐색하는 것은 매우 중요한 문제이다. 이에 우리는 RTCP 패킷을 이용한 구간별 지연시간 측정 방안을 제안하며 이 방안을 통해 네트워크 성능 저하가 발생한 구간을 탐색하고 정의할 수 있다.

• Annual Conference of KIPS
• /
• 2008.05a
• /
• pp.193-196
• /
• 2008

네트워크 인프라가 급속히 발전하면서 네트워크 상에서 발생되는 트래픽을 관리하기 위해 마이닝 기법을 적용하려는 여러 연구가 활발히 진행되고 있다. 그러나 기존의 방법들은 DBMS를 이용하여 개개의 플로우를 저장 후 분석하는 방식을 채택함으로써 엄청난 부하와 실시간 마이닝을 어렵게 하는 문제점이 있다. 본 논문에서는 제한된 크기의 메모리를 사용하여 실시간으로 발생하는 네트워크 플로우 데이터 중 빈발한 플로우를 추출하는 방법을 제안한다. 오직 빈발하게 발생하는 플오우만을 메모리에서 모니터링 트리를 사용하여 관리함으로써 메모리를 효율적으로 사용한다. 제안 된 방법은 기존의 방법들과 비교할 때 적은 시스템 부하를 주면서 초고대역폭의 트래픽을 실시간으로 모니터링 할 수 있다.

• Annual Conference of KIPS
• /
• 2008.05a
• /
• pp.845-848
• /
• 2008

DNP3.0(Distributed Network Protocol 3.0) 프로토콜은 자동화 처리 시스템 사이에서 Master와 Slave의 개념을 적용한 프로토콜로써 현재 한전 SCADA 시스템의 표준 프로토콜로 선정되어 원방 감시 제어용으로 사용되고 있다. 이 DNP3.0 데이터를 RS-232C를 이용해서 전송 할 때, 각각의 DNP3.0 Layer인 DataLink Layer, Transport Layer 그리고 Application Layer의 분석 모듈을 설계하고 구현하였다.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.14 no.1
• /
• pp.35-43
• /
• 2018

MANET composed of only wireless nodes is increasingly utilized in various fields. However, it is exposed to many security vulnerabilities because it doesn't have any infrastructure and transmits data by using multi-hop method. Therefore, MANET should be applied the intrusion detection technique that can detect efficiently malicious nodes and decrease impacts of various attacks. In this paper, we propose a distributed intrusion detection technique that can detect the various attacks while improving the efficiency of attack detection and reducing the false positive rate. The proposed technique uses the cluster structure to manage the information in the center and monitor the traffic of their neighbor nodes directly in all nodes. We use three parameters for attack detection. We also applied an efficient authentication technique using only key exchange without the help of CA in order to provide integrity when exchanging information between cluster heads. This makes it possible to free the forgery of information about trust information of the nodes and attack nodes. The superiority of the proposed technique can be confirmed through comparative experiments with existing intrusion detection techniques.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.22 no.5
• /
• pp.1116-1125
• /
• 1997

In this paper, the modified UPC(Usage Parameter Control) algorithm is proposed. The proposed UPC algorithm is based on Leakey Bucket algorithm and adds the characteristics of the jumping window algorithm for monitoring the average bit rate. The proposed algorithm let a cell, which is tagged by Leaky Bucket algorithm, pass through the network, if the network does not violate the average bit rate. The measuring method of window mechanism like jumping window. This paper supposes On/Off traffic source model of rthe performance evaluation and analysis of the proposed algorithm. Therefore, as simulation results, the proposed algorithm acquires more reduced results of the cell loss rate and bucket size than the Leaky Bucket algorithm.

• The KIPS Transactions:PartB
• /
• v.9B no.5
• /
• pp.549-554
• /
• 2002

This paper proposes a UQoSM (User Qualify of Service Middleware) framework for multimedia application systems. UQoSM system is extended the existing event service model added to the event monitoring, reflective event filtering and event dispatcher for supporting multimedia application systems. Especially, this paper is concentrated on providing suitable reflective event filtering function for multimedia application service system in order to meet various user requirements under inter-based environment. It means this system provides high QoS to users. In addition, it results in decreasing network traffic as unnecessary event information is filtered from network.

• Nuclear Engineering and Technology
• /
• v.52 no.12
• /
• pp.2687-2698
• /
• 2020

Most of the machine learning-based intrusion detection tools developed for Industrial Control Systems (ICS) are trained on network packet captures, and they rely on monitoring network layer traffic alone for intrusion detection. This approach produces weak intrusion detection systems, as ICS cyber-attacks have a real and significant impact on the process variables. A limited number of researchers consider integrating process measurements. However, in complex systems, process variable changes could result from different combinations of abnormal occurrences. This paper examines recent advances in intrusion detection algorithms, their limitations, challenges and the status of their application in critical infrastructures. We also introduce the discussion on the similarities and conflicts observed in the development of machine learning tools and techniques for fault diagnosis and cybersecurity in the protection of complex systems and the need to establish a clear difference between them. As a case study, we discuss special characteristics in nuclear power control systems and the factors that constraint the direct integration of security algorithms. Moreover, we discuss data reliability issues and present references and direct URL to recent open-source data repositories to aid researchers in developing data-driven ICS intrusion detection systems.

• Journal of The Korean Society For Urban Railway
• /
• v.6 no.4
• /
• pp.279-286
• /
• 2018

Recently, a safety control platform to monitor the safety of train operation in real time and prevent accidents and risks through control is under study. In the initial design, DDS communication method supporting distributed network is adopted for real-time processing of large amount of data according to the integration of existing distributed safety data. However, communication between server and console inside the safety control platform is applied to existing TCP socket communication. In the case of TCP socket communication, it is possible to process data for a small system of a safety control test bed by one-to-one communication. However, if the data is expanded all over the country in the future, it becomes difficult to cope with a case where communication traffic occurs due to vast amount of data. In this paper, we propose DDS communication method to support distributed network between server and console of security control platform, and demonstrate TCP socket and DDS method, and compare throughput and speed. As a result, we have found that the scalability and flexibility are improved in case of applying DDS communication to future systems.

• Journal of KIISE:Information Networking
• /
• v.36 no.3
• /
• pp.173-183
• /
• 2009

We present a real-time monitoring system for detecting anomalous network events using the entropy. The entropy accounts for the effects of disorder in the system. When an abnormal factor arises to agitate the current system the entropy must show an abrupt change. In this paper we deliberately model the Internet to measure the entropy. Packets flowing between these two networks may incur to sustain the current value. In the proposed system we keep track of the value of entropy in time to pinpoint the sudden changes in the value. The time-series data of entropy are transformed into the two-dimensional domains to help visually inspect the activities on the network. We examine the system using network traffic traces containing notorious worms and DoS attacks on the testbed. Furthermore, we compare our proposed system of time series forecasting method, such as EWMA, holt-winters, and PCA in terms of sensitive. The result suggests that our approach be able to detect anomalies with the fairly high accuracy. Our contributions are two folds: (1) highly sensitive detection of anomalies and (2) visualization of network activities to alert anomalies.