• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.5
• /
• pp.1043-1057
• /
• 2015

In order to recognize intelligent threats quickly and detect and respond to them actively, major public bodies and private institutions operate and administer an Intrusion Detection Systems (IDS), which plays a very important role in finding and detecting attacks. However, most IDS alerts have a problem that they generate false positives. In addition, in order to detect unknown malicious codes and recognize and respond to their threats in advance, APT response solutions or actions based systems are introduced and operated. These execute malicious codes directly using virtual technology and detect abnormal activities in virtual environments or unknown attacks with other methods. However, these, too, have weaknesses such as the avoidance of the virtual environments, the problem of performance about total inspection of traffic and errors in policy. Accordingly, for the effective detection of intrusion, it is very important to enhance security monitoring, consequentially. This study discusses a plan for the reduction of false positives as a plan for the enhancement of security monitoring. As a result of an experiment based on the empirical data of G, rules were drawn in three types and 11 kinds. As a result of a test following these rules, it was verified that the overall detection rate decreased by 30% to 50%, and the performance was improved by over 30%.

• KIPS Transactions on Computer and Communication Systems
• /
• v.9 no.7
• /
• pp.143-148
• /
• 2020

Recently, web services have been expanded to various areas with the evolution of cloud environment. Whenever a user accesses a web service, the user's log information is stored in the web server. This log information is used as data to analyze the user's web service tendencies and is also used as important data to track the user's system access when a security problem in the system occurs. Currently, most web servers manage user log information in a centralized manner. When user log information is managed in a centralized manner, it is simple in the side of operation, but has a disadvantage of being very vulnerable to external malicious attacks. In the case of centralized management, user log information stored in the web server can be arbitrarily manipulated by external attacks, and in severe cases, the manipulated information can be leaked. In this case, it not only decreases the trust of the web service, but also makes it difficult to trace the source and cause of the attack on the web server. In order to solve these problems, this paper proposes a new method of managing user log information in a cloud environment by applying blockchain technology as an alternative to the existing centralized log management method. The proposed method can manage log information safely from external attacks because user log information is distributed and stored in blockchain on a private network with cloud environment.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.2
• /
• pp.385-395
• /
• 2018

With the development of Internet, cyber attack has become a major threat. To detect cyber attacks, intrusion detection system(IDS) has been widely deployed. But IDS has a critical weakness which is that it generates a large number of false alarms. One of the promising techniques that reduce the false alarms in real time is machine learning. However, there are problems that must be solved to use machine learning. So, many machine learning approaches have been applied to this field. But so far, researchers have not focused on features. Despite the features of IDS alerts are important for performance of model, the approach to feature is ignored. In this paper, we propose new feature set which can improve the performance of model and can be extracted from a single alarm. New features are motivated from security analyst's know-how. We trained and tested the proposed model applied new feature set with real IDS alerts. Experimental results indicate the proposed model can achieve better accuracy and false positive rate than SVM model with ordinary features.

• The magazine of the Korean Society for Advanced Composite Structures
• /
• v.5 no.2
• /
• pp.26-31
• /
• 2014

This invention is purposed to provide an innovative solution for the inside of roof structures, which is cultural assets. The Asian old houses generally have several layered roofs on top of the structures. If a fire has started inside of the roof, it is hard to be extinguished before eliminating all the upper layers of the roof. This invention provides pre constructed embedded pipes, which is flammable and easy to be dissolved by the fire. The material of pipe is composed of rubbers, of which the combustion point is so low that the extinguishing of initial fire is possible without additional fire service. The inside of pipe is filled with halon gas. If the filled gas is consumed after ignited by fire, additional fire extinguishing water is supplied. If the flexible pipes are totally combusted by a big fire, the sprinkler at the end of inflexible pipe will work continuously, which is located between flexible and inflexible pipes. The extinguishing pipe network is suggested as dividing whole roof as multiple sections for a swift fire extinguishing in case of intentional or natural fire attack to our invaluable cultural assets.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.18 no.6
• /
• pp.627-635
• /
• 2017

Modern warfare is gradually changing into a network war, and information electronic warfare is also progressing. In modern war, electronic warfare is all military activity concerned with electromagnetic field use, such as signal collecting, communication monitoring, information analysis, and electronic attack. The one key function of signal collecting for enemy signal analysis, direction finding, collects the signal radiated from enemy area and then calculates the enemy direction. This paper examined the Watson-Watt algorithm for an amplitude direction finding system and CVDF algorithm for phase direction finding system and analyzed the difference in the direction finding accuracy between in the clean electromagnetic field environment and in the real operating field environment of electronic warfare system. In the real field, the direction finding accuracy was affected by the reflected field from the surrounding obstacles. Therefore, this paper proposesan enhanced direction finding process for reducing the effect. The result of direction finding by applying the proposed process was enhanced above $1.24^{\circ}$ compared to the result for the existing process.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.17 no.11
• /
• pp.746-754
• /
• 2016

Smart healthcare systems, a convergent industry based on information and communications technologies (ICT), has emerged from personal health management to remote medical treatment as a distinguished industry. The smart healthcare environment provides technology to deliver vital information, such as pulse rate, body temperature, health status, and so on, from wearable devices to the hospital network where the physician is located. However, since it deals with the patient's personal medical information, there is a security issue for personal information management, and the system may be vulnerable to cyber-attacks in wireless networks. Therefore, this study focuses on a key-development and device-management system to generate keys in the smart environment to safely manage devices. The protocol is designed to provide safe communications with the generated key and to manage the devices, as well as the generated key. The security level is analyzed against attack methods that may occur in a healthcare environment, and it was compared with existing key methods and coding capabilities. In the performance evaluation, we analyze the security against attacks occurring in a smart healthcare environment, and the security and efficiency of the existing key encryption method, and we confirmed an improvement of about 15%, compared to the existing cipher systems.

• Journal of KIISE:Computing Practices and Letters
• /
• v.15 no.5
• /
• pp.345-349
• /
• 2009

Social bookmarking systems are a typical web 2.0 service based on folksonomy, providing the platform for storing and sharing bookmarking information. Spammers in social bookmarking systems denote the users who abuse the system for their own interests in an improper way. They can make the entire resources in social bookmarking systems useless by posting lots of wrong information. Hence, it is important to detect spammers as early as possible and protect social bookmarking systems from their attack. In this paper, we applied a diverse set of machine learning approaches, i.e., decision tables, decision trees (ID3), $na{\ddot{i}}ve$ Bayes classifiers, TAN (tree-augment $na{\ddot{i}}ve$ Bayes) classifiers, and artificial neural networks to this task. In our experiments, $na{\ddot{i}}ve$ Bayes classifiers performed significantly better than other methods with respect to the AUC (area under the ROC curve) score as veil as the model building time. Plausible explanations for this result are as follows. First, $na{\ddot{i}}ve$> Bayes classifiers art known to usually perform better than decision trees in terms of the AUC score. Second, the spammer detection problem in our experiments is likely to be linearly separable.

• Journal of the Korea Society of Computer and Information
• /
• v.19 no.12
• /
• pp.143-152
• /
• 2014

This paper introduces Database security to prevent the rapidly increasing issue of private information leakage. The Database security examined in the paper separates into DB access control area and DB encryption area which further leads the paper to analyze the factors of the two areas and suggest necessary elements for creating stable Database security. In addition, the paper examines previous DB security programs by areas and analyzes pros and cons from the tested result. The experiment indicated that while DB access control presents less degradation and reduced the need to modify the existing DBMS since the access control operates at the end point of the network, DB encryption presented strength in protecting the data from unauthorized access. On the other hand, DB access control is less useful in preventing the attack in advance which leaves the log to enable tracking afterward while DB encryption can only be operated by limited types of Database and causes degradation due to system load and shows higher percentage of failure when creating the system. This paper examines characteristics of Database security areas in order to be used as a reference for institutions or companies seeking stable Database security.

• Journal of KIISE:Software and Applications
• /
• v.34 no.1
• /
• pp.79-94
• /
• 2007

In the ubiquitous computing age which uses a high quantity network, mobile devices such as wearable and hand-held ones with a small tamers and a wireless communication module will be widely used in near future. Thus, a lot of researches about an augmented game on mobile devices have been attempted recently. The existing augmented games used a traditional 'backpack' system and a pattern marker. The 'backpack' system is expensive, cumbersome and inconvenient to use, and because of the pattern marker, it is only possible to play the game in the previously installed palace. In this paper, we propose an augmented game called Flying Cake using a face region to create the virtual object(character) without the pattern marker, which manually indicates an overlapped location of the virtual object in the real world, on a small and mobile PDA instead of the cumbersome hardware. Flying Cake is an augmented shooting game. This game supplies us with two types: 1) a single player which attacks a virtual character on images captured by a camera in an outdoor physical area, 2) dual players which attack the virtual character on images which we received through a wireless LAN. We overlap the virtual character on the face region using a face detection technique, and users play Flying Cake though attacking the virtual character. Flying Cake supplies new pleasure to flayers with a new game paradigm through an interaction between the user in the physical world captured by the PDA camera and the virtual character in a virtual world using the face detection.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.34 no.10B
• /
• pp.1050-1061
• /
• 2009

The Tactical Internet(TI) managed by Infantry Brigades is used for the purpose of sharing information of Command Control and Situation Awareness. When there are more than two destinations to transmit data in the TI system, a multicasting is utilized based on pre-defined multicast groups. However even in the case when a source node needs to send some messages like weathercast and attack alarm etc to only a part of Battalion or Brigades in a specific geographical region (destination region), the current TI multicasting protocol is designed to transmit the messages to the pre-defined group or all of the Battalion/Brigade nodes, resulting in inefficiency in terms of end-to-end delay and overhead. In this paper, we propose more efficient protocol for such cases, named as "Tactical Internet Geocasting (TIG)". The proposed scheme firstly checks whether the destination region belongs to one Battalion region or more than two Battalion regions using location information, and then performs a greedy forwarding from the source node to the destination region, followed by a local flooding inside of the destination region. With performance analysis and simulations using NS-2, TIG is compared to the current TI multicasting protocol (i.e., Simplified MDP) and the LBM (Location-based Multicast). The simulation results show that the proposed TIG is more efficient than both in terms of delay and network overhead.