• 한국시뮬레이션학회논문지
• /
• 제13권1호
• /
• pp.51-63
• /
• 2004

Current distributed systems are attacked from the outside as well as in which new intrusions are occurred. In particular there is a growing but largely unnoticed intrusion threat due to the emerging middleware technologies such as CORBA, WAP, XML support, and enterprise application integrators. In order to cope with these attacks, intrusion tolerance technology is introduced. Intrusion tolerance technology means that it can provide services normally although attacks are occurred into system. There are intrusion tolerance architectures such as ITUA, HACQIT, SITAR, and so on as a part of DARPA project. In this paper, we analyze and discuss existing intrusion tolerance architectures with respect to intrusion tolerance technology. Also, we extract intrusion tolerant requirements, which are required to develop ,intrusion tolerant system. We propose UML-IT(Intrusion Tolerance) profiles and specify intrusion tolerant software by applying UML-IT profiles.

• 한국컴퓨터정보학회논문지
• /
• 제24권5호
• /
• pp.149-156
• /
• 2019

The existing subtract image based intrusion detection system for CCTV digital images has a problem that it can not distinguish intruders from moving backgrounds that exist in the natural environment. In this paper, we tried to solve the problems of existing system by designing real - time intrusion detection system for CCTV digital image by combining subtract image based intrusion detection method and background learning artificial neural network technology. Our proposed system consists of three steps: subtract image based intrusion detection, background artificial neural network learning stage, and background artificial neural network evaluation stage. The final intrusion detection result is a combination of result of the subtract image based intrusion detection and the final intrusion detection result of the background artificial neural network. The step of subtract image based intrusion detection is a step of determining the occurrence of intrusion by obtaining a difference image between the background cumulative average image and the current frame image. In the background artificial neural network learning, the background is learned in a situation in which no intrusion occurs, and it is learned by dividing into a detection window unit set by the user. In the background artificial neural network evaluation, the learned background artificial neural network is used to produce background recognition or intrusion detection in the detection window unit. The proposed background learning intrusion detection system is able to detect intrusion more precisely than existing subtract image based intrusion detection system and adaptively execute machine learning on the background so that it can be operated as highly practical intrusion detection system.

• 스마트미디어저널
• /
• 제8권3호
• /
• pp.17-22
• /
• 2019

Signature-based intrusion systems use intrusion detection rules for detecting intrusion. However, writing intrusion detection rules is difficult and requires considerable knowledge of various fields. Attackers may modify previous attempts to escape intrusion detection rules. In this paper, we deal with the problem of detecting modified attacks based on previous intrusion detection rules. We show a simple method of reporting approximate occurrences of at least one of the network intrusion detection rules, based on q-grams and the longest increasing subsequences. Experimental results showed that our approach could detect modified attacks, modeled with edit operations.

• 한국전자통신학회논문지
• /
• 제11권6호
• /
• pp.619-626
• /
• 2016

침입 탐지 모델은 침입 행위가 발생할 때 침입을 탐지하기 위해 사용하는 모델로서 침입 패턴을 잘 표현하기 위해서는 먼저 침입 패턴의 유형에 대해 분석하고 각 유형별로 침입 패턴에 대한 표현 방법을 제공할 수 있어야 한다. 특히 하나의 호스트 레벨의 침입뿐만 아니라 다중 호스트를 이용한 네트워크 레벨의 침입을 탐지하기 위해서는 이러한 다중 침입의 유형을 정의하고 다중 침입에 대한 표현 방법을 제공해야 한다. 본 논문에서는 침입 탐지 시스템의 안전성에 대한 검증 방법을 제공하는 다중 침입 탐지 모델을 제안하고 제안한 모델의 안전성을 검증하며 다른 모델들과 비교 평가한다.

• 디지털산업정보학회논문지
• /
• 제8권1호
• /
• pp.81-87
• /
• 2012

Intrusion Detection System that protects system safely is necessary as network technology is developed rapidly and application division is wide. Intrusion Detection System among others can construct system without participation of other severs. But it has weakness that big load in system happens and it has low efficient because every traffics are inspected in case that mass traffic happen. In this study, Distributed Intrusion Detection System based on protocol is proposed to reduce traffic of intrusion detection system and provide stabilized intrusion detection technique even though mass traffic happen. It also copes to attack actively by providing automatic update of using rules to detect intrusion in sub Intrusion Detection System.

• 한국정보처리학회논문지
• /
• 제6권5호
• /
• pp.1332-1341
• /
• 1999

Rapid expansion of network and increment of computer system access cause computer security to be an important issue. Hence, the researches in intrusion detection system(IDS)are active to reduce the risk from hackers. Considering IDS, we propose a new IDS model(DABIDS : Distributed Agent Based Intelligent intrusion Detection System) based on distributed intrusion detecting agents. The DABIDS dynamically collects intrusion behavior knowledge from each agents when some doubtable behaviors of users are detected and make new agents codes using intrusion scenario data base, and broadcast the detector codes to the distributed intrusion detecting agent of all node. This DABIDS can efficiently solve the problem to reduce the overhead for training detecting agent for intrusion behavior patterns.

• 인터넷정보학회논문지
• /
• 제5권2호
• /
• pp.57-67
• /
• 2004

본 논문에서는 네트워크 침입 탐지 시스템의 성능과 탐지 정확성을 높일 수 있는 침입 탐지 시스템의 구조를 제시한다. 네트워크를 통한 침입은 보통 여러 단계의 침입 동작으로 이루어 진다. 각 침입 동작은 특정 침입 신호로 탐지할 수 있다. 그러나 침입이 아닌 보통의 동작도 침입 행위와 같은 신호를 나타낼 수 있다. 따라서 특정 침입 신호로 침입을 판단하는 것은 잘못된 판단을 내릴 수 있게 된다. 제시하는 시스템은 침입을 구성하는 각 단계의 신호들 간의 신호 상관성을 이용한다. 따라서 제시하는 시스템의 침입에 대한 판단은 높은 신뢰성을 가질 수 있다. 또한 알려진 침입에 대한 변형도 잘 탐지할 수 있다.

• 전기전자학회논문지
• /
• 제26권4호
• /
• pp.622-627
• /
• 2022

본 논문에서는 공격 횟수와 공격 유형을 모두 고려하여 차량 내 네트워크에서 해킹을 탐지하는 침입 탐지 시스템의 성능을 개선하는 기법을 제안한다. 침입 탐지 시스템에서 침입을 정상으로 잘못 인식하는 FNR(False Negative Rate)과 정상을 침입으로 잘못 인식하는 FPR(False Positive Rate)은 모두 차량의 안전에 큰 영향을 미친다. 본 논문에서는 일정 홧수 이상 공격으로 탐지된 데이터 프레임을 자동적으로 공격으로 처리하며, 자동 공격으로 판단하는 방법도 공격 유형에 따라 다르게 적용함으로서 FNR과 FPR을 모두 개선하는 침입 탐지 기법을 제안하였다. 시뮬레이션 결과 제안하는 기법은 DoS(Denial of Service) 공격과 Spoofing 공격에서 FNR과 FPR을 효과적으로 개선할 수 있었다.

• 한국정보시스템학회지:정보시스템연구
• /
• 제15권4호
• /
• pp.211-224
• /
• 2006

This study investigates the application of data mining techniques such as artificial neural networks, rough sets, and induction teaming to the intrusion detection systems. To maximize the effectiveness of data mining for intrusion detection systems, we introduced the asymmetric costs with false positive errors and false negative errors. And we present a method for intrusion detection systems to utilize the asymmetric costs of errors in data mining. The results of our empirical experiment show our intrusion detection model provides high accuracy in intrusion detection. In addition the approach using the asymmetric costs of errors in rough sets and neural networks is effective according to the change of threshold value. We found the threshold has most important role of intrusion detection model for decreasing the costs, which result from false negative errors.

• Journal of Information Processing Systems
• /
• 제1권1호
• /
• pp.9-13
• /
• 2005

Computer security has become a critical issue with the rapid development of business and other transaction systems over the Internet. The application of artificial intelligence, machine learning and data mining techniques to intrusion detection systems has been increasing recently. But most research is focused on improving the classification performance of a classifier. Selecting important features from input data leads to simplification of the problem, and faster and more accurate detection rates. Thus selecting important features is an important issue in intrusion detection. Another issue in intrusion detection is that most of the intrusion detection systems are performed by off-line and it is not a suitable method for a real-time intrusion detection system. In this paper, we develop the real-time intrusion detection system, which combines an on-line feature extraction method with the Least Squares Support Vector Machine classifier. Applying the proposed system to KDD CUP 99 data, experimental results show that it has a remarkable feature extraction and classification performance compared to existing off-line intrusion detection systems.