• Communications for Statistical Applications and Methods
• /
• v.28 no.2
• /
• pp.161-169
• /
• 2021

The two-dimensional confusion matrix used in credit assessment, biostatistics, and many other fields consists of true positive, true negative, false positive, and false negative. Their rates, such as the true positive rate (TPR), true negative rate (TNR), false positive rate, and false negative rate, can be applied to measure its accuracy. In this study, we propose the TPR-TNR plot, a graphical method that can geometrically describe and explain these rates based on the confusion matrix. The proposed TPR-TNR plot consists of two right-angled triangles. We obtain that the TPR and TNR describe the acute angles of right-angled triangles in the plot. These acute angles can be used to determine optimal thresholds corresponding to lots of accuracy measures.

• Journal of information and communication convergence engineering
• /
• v.7 no.1
• /
• pp.7-12
• /
• 2009

The advanced computer network and Internet technology enables connectivity of computers through an open network environment. Despite the growing numbers of security threats to networks, most intrusion detection identifies security attacks mainly by detecting misuse using a set of rules based on past hacking patterns. This pattern matching has a high rate of false positives and can not detect new hacking patterns, making it vulnerable to previously unidentified attack patterns and variations in attack and increasing false negatives. Intrusion detection and prevention technologies are thus required. We proposed a network based hybrid Probe Intrusion Detection model using Fuzzy cognitive maps (PIDuF) that detects intrusion by DoS (DDoS and PDoS) attack detection using packet analysis. A DoS attack typically appears as a probe and SYN flooding attack. SYN flooding using FCM model captures and analyzes packet information to detect SYN flooding attacks. Using the result of decision module analysis, which used FCM, the decision module measures the degree of danger of the DoS and trains the response module to deal with attacks. For the performance evaluation, the "IDS Evaluation Data Set" created by MIT was used. From the simulation we obtained the max-average true positive rate of 97.064% and the max-average false negative rate of 2.936%. The true positive error rate of the PIDuF is similar to that of Bernhard's true positive error rate.

• The Korean Journal of Applied Statistics
• /
• v.32 no.4
• /
• pp.593-605
• /
• 2019

Significant literature exists on the area under the ROC curve (AUC) and the volume under the ROC surface (VUS) which are statistical measures of the discriminant power of classification models. Whereas the partial AUC is restricted on the false positive rate, the two-way partial AUC is restricted on both the false positive rate and true positive rate, which could be more efficient and accurate than partial AUC. The two-way partial AUC was suggested as more efficient and accurate than the partial AUC. Partial VUS as well as the three-way partial VUS were also developed for the ROC surface. A proposed AUC is expressed in this paper with probability and integration using two truncated distribution functions restricted on both the false positive rate and true positive rate. It is also found that this AUC has a relation with the two-way partial AUC. The three-way partial VUS for the ROC surface is also related to the VUS using truncated distribution functions. These AUC and VUS are represented and estimated in terms of Mann-Whitney statistics. Their parametric and non-parametric estimation methods are explored based on normal distributions and random samples.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.5
• /
• pp.1197-1207
• /
• 2018

PowerShell is command line shell and scripting language, built on the .NET framework, and it has several advantages as an attack tool, including built-in support for Windows, easy code concealment and persistence, and various pen-test frameworks. Accordingly, malwares using PowerShell are increasing rapidly, however, there is a limit to cope with the conventional malware detection technique. In this paper, we propose an improved monitoring method to observe commands executed in the PowerShell and a deep learning based malware classification model that extract features from commands using Convolutional Neural Network(CNN) and send them to Recurrent Neural Network(RNN) according to the order of execution. As a result of testing the proposed model with 5-fold cross validation using 1,916 PowerShell-based malwares collected at malware sharing site and 38,148 benign scripts disclosed by an obfuscation detection study, it shows that the model effectively detects malwares with about 97% True Positive Rate(TPR) and 1% False Positive Rate(FPR).

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.10 no.4
• /
• pp.811-817
• /
• 2009

The rapid growth of network based IT systems has resulted in continuous research of security issues. Probe intrusion detection is an area of increasing concerns in the internet community. Recently, a number of probe intrusion detection schemes have been proposed based on various technologies. However, the techniques, which have been applied in many systems, are useful only for the existing patterns of probe intrusion. They can not detect new patterns of probe intrusion. Therefore, it is necessary to develop a new Probe Intrusion Detection technology that can find new patterns of probe intrusion. In this paper, we proposed a new network based probe intrusion detector(NePID) using anomaly traffic analysis and fuzzy cognitive maps that can detect intrusion by the denial of services attack detection method utilizing the packet analyses. The probe intrusion detection using fuzzy cognitive maps capture and analyze the packet information to detect syn flooding attack. Using the result of the analysis of decision module, which adopts the fuzzy cognitive maps, the decision module measures the degree of risk of denial of service attack and trains the response module to deal with attacks. For the performance evaluation, the "IDS Evaluation Data Set" created by MIT was used. From the simulation we obtained the max-average true positive rate of 97.094% and the max-average false negative rate of 2.936%. The true positive error rate of the NePID is similar to that of Bernhard's true positive error rate.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2018.01a
• /
• pp.47-50
• /
• 2018

본 논문에서는 초음파 영상에서 환자 정보를 제거하여 ROI 영역을 추출하고, 추출된 ROI 영역에서 최대 명암도를 임계치로 설정한 이진화 기법을 적용하여 ROI 영역을 이진화 한다. 이진화된 ROI 영역에서 4 방향 윤곽선 추적 기법을 적용하여 상완동맥 혈류 영역이 존재하는 사다리꼴 형태의 영역을 추출한다. 추출된 사다리꼴 형태의 영역에서 상완동맥 혈류영역을 정확히 추출하기 위하여 제안된 무게 중심법을 이용하여 추출된 후보 영역을 양자화 한다. 무게 중심법은 추출된 사다리꼴 영역에서 FCM 기반 무게중심법과 PCM 기반 무게중심법을 각각 계산한 후, 두 중심 간의 차이가 존재 할 경우에는 두 중심의 평균값을 새로운 무게 중심으로 설정하여 각 픽셀들을 클러스터링하여 상완 동맥 영역을 추출한다. 추출된 상완 동맥 영역에는 고혈압 영역인 빨강색 영역과 저혈압이나 혈류가 역류하는 영역인 파란색 영역이 존재한다. 추출된 상완 동맥 영역에서 고혈압 영역만을 추출하기 위해 빨강색 영역을 제외한 그 외의 영역은 제거한다. 전문의가 제공한 상완동맥 혈류 초음파 영상을 대상으로 TPR(True Positive Rate) 검사을 분석한 결과, 제안된 방법이 기존의 방법 보다 TPR 값이 높게 나타나는 것을 확인하였다.

• Journal of the Korean Data and Information Science Society
• /
• v.26 no.1
• /
• pp.255-260
• /
• 2015

Among many optimal threshold criteria from ROC curve, the closest-to-(0,1) and amended closest-to-(0,1) criteria are considered. An ROC curve that passes close to the (0,1) point indicates that two models are well classified. In this case, the ROC curve is located far from the (1,0) point. Hence we propose two criteria: the farthest-to-(1,0) and amended farthest-to-(1,0) criteria. These criteria are found to have a relationship with the KolmogorovSmirnov statistic as well as some optimal threshold criteria. Moreover, we derive that a definition for the proposed criteria with more than two dimensions and with relations to multi-dimensional optimal threshold criteria.

• 한국HCI학회:학술대회논문집
• /
• 2008.02a
• /
• pp.215-217
• /
• 2008

The most widely used method for searching contents of mot ion picture compares contents by extracted cuts. The cut extract ion methods, such as CHD(Color Histogram Difference) or ECR(Edge Change Ratio), are very weak at modifications such as cropping, resizing and low bit rate. The suggested method uses audio contents for indexing and searching to make search be robust against these modification. Scenes of audio contents are extracted for modification-robust search. And based on these scenes, make spectral powers binary on each frequency bin. in the time-frequency domain. The suggested method shows failure rate less than 1% on the false positive error and the true negative error to the modified(using cropping, clipping, row bit rate, addtive frame) contents.

• Journal of the Architectural Institute of Korea Structure & Construction
• /
• v.36 no.3
• /
• pp.113-120
• /
• 2020

The purpose of this study is to compare the models of Deep Learning-based Convolution Neural Network(CNN) for concrete crack detection. The comparison models are AlexNet, GoogLeNet, VGG16, VGG19, ResNet-18, ResNet-50, ResNet-101, and SqueezeNet which won ImageNet Large Scale Visual Recognition Challenge(ILSVRC). To train, validate and test these models, we constructed 3000 training data and 12000 validation data with 256×256 pixel resolution consisting of cracked and non-cracked images, and constructed 5 test data with 4160×3120 pixel resolution consisting of concrete images with crack. In order to increase the efficiency of the training, transfer learning was performed by taking the weight from the pre-trained network supported by MATLAB. From the trained network, the validation data is classified into crack image and non-crack image, yielding True Positive (TP), True Negative (TN), False Positive (FP), False Negative (FN), and 6 performance indicators, False Negative Rate (FNR), False Positive Rate (FPR), Error Rate, Recall, Precision, Accuracy were calculated. The test image was scanned twice with a sliding window of 256×256 pixel resolution to classify the cracks, resulting in a crack map. From the comparison of the performance indicators and the crack map, it was concluded that VGG16 and VGG19 were the most suitable for detecting concrete cracks.

• Journal of Acupuncture Research
• /
• v.24 no.6
• /
• pp.187-193
• /
• 2007

Objectives : The objectives of this study were to investigate the relationship between electrical detection of ear acupuncture points and musculoskeletal pain. Methods : 18 adults who have musculoskeletal pain without trauma factorsparticipated in this study. They answered the questionnaire and their ear acupuncture points were examined with electrical detectors. We analyzed the relationship between electrical detection of ear acupuncture points and musculoskeletal pain with concordance rate and validity. Results : Total concordance rates of the head region was 68.00%(questionnaire) 32.08%(investigation), that of vertebral region was 67.86%, 59.38%, that of both upper limbs was 86.67%, 39.69%, and that of both lower limbs was 50.00%, 23.46%. The true positive rate was 0.704, the true negative rate was 0.492, the false positive rate was 0.508, and the false negative rate was 0.296 in the validity test. In the head, two concordance rates of the temporal and occipital regions were relatively higher than those of the parietal and frontal regions. In the vertebral region, two concordance rates of the cervical and lumbar regions were relatively higher than those of the thoracic and sacrum regions. In the upper limb, two concordance rates of the shoulder and shoulder joints were relatively higher than those of the others. In the lower limb, concordance rates of investigation were relatively low at all areas. The right lower limb was relatively higher than the left in concordance rates of the questionnaire. Conclusions : The results suggest that electrical detection of ear acupuncture points can be used in the diagnosis and treatment of musculoskeletal pain.