LDA를 활용한 네트워크 위협 시그니처 추출기법

이성일 ( Sungil Lee ),이수철 ( Suchul Lee ),이준락 ( Jun-rak Lee ),염흥열 ( Heung-youl Youm ) 한국인터넷정보학회 2018 인터넷정보학회논문지 Vol.19 No.1

인터넷 웜, 컴퓨터 바이러스 등 네트워크에 위협적인 악성트래픽이 증가하고 있다. 특히 최근에는 지능형 지속 위협 공격 (APT: Advanced Persistent Threat), 랜섬웨어 등 수법이 점차 고도화되고 그 복잡성(Complexity)이 증대되고 있다. 지난 몇 년간 침입탐지시스템(IDS: Intrusion Detection System)은 네트워크 보안 솔루션으로서 중추적 역할을 수행해왔다. 침입탐지시스템의 효과적 활용을 위해서는 탐지규칙(Rule)을 적절히 작성하여야 한다. 탐지규칙은 탐지하고자 하는 악성트래픽의 핵심 시그니처를 포함하며, 시그니처를 포함한 악성트래픽이 침입탐지시스템을 통과할 경우 해당 악성트래픽을 탐지하도록 한다. 그러나 악성트래픽의 핵심 시그니처를 찾는 일은 쉽지 않다. 먼저 악성트래픽에 대한 분석이 선행되어야 하며, 분석결과를 바탕으로 해당 악성트래픽에서만 발견되는 비트패턴을 시그니처로 사용해야 한다. 만약 정상 트래픽에서 흔히 발견되는 비트패턴을 시그니처로 사용하면 수많은 오탐(誤探)을 발생시키게 될 것이다. 본고에서는 네트워크 트래픽을 분석하여 핵심 시그니처를 추출하는 기법을 제안한다. 제안 기법은 LDA(Latent Dirichlet Allocation) 알고리즘을 활용하여, 어떠한 네트워크 트래픽에 포함된 시그니처가 해당 트래픽을 얼마나 대표하는지를 정량화한다. 대표성이 높은 시그니처는 해당 네트워크 트래픽을 탐지할 수 있는 침입탐지시스템의 탐지규칙으로 활용될 수 있다. Network threats such as Internet worms and computer viruses have been significantly increasing. In particular, APTs(Advanced Persistent Threats) and ransomwares become clever and complex. IDSes(Intrusion Detection Systems) have performed a key role as information security solutions during last few decades. To use an IDS effectively, IDS rules must be written properly. An IDS rule includes a key signature and is incorporated into an IDS. If so, the network threat containing the signature can be detected by the IDS while it is passing through the IDS. However, it is challenging to find a key signature for a specific network threat. We first need to analyze a network threat rigorously, and write a proper IDS rule based on the analysis result. If we use a signature that is common to benign and/or normal network traffic, we will observe a lot of false alarms. In this paper, we propose a scheme that analyzes a network threat and extracts key signatures corresponding to the threat. Specifically, our proposed scheme quantifies the degree of correspondence between a network threat and a signature using the LDA(Latent Dirichlet Allocation) algorithm. Obviously, a signature that has significant correspondence to the network threat can be utilized as an IDS rule for detection of the threat.

데스크탑 규모의 간결한 롤투롤 나노임프린팅 기반 나노패턴 연속가공 시스템 개발

이정수(Jeongsoo Lee),이지훈(Jihun Lee),남승범(Seungbum Nam),조성일(Sungil Cho),조용수(Yongsu Jo),고민석(Minseok Go),이승조(Seungjo Lee),오동교(Dong Kyo Oh),김정대(Jeong Dae Kim),이재혁(Jae Hyuk Lee),옥종걸(Jong G. Ok) 한국기계가공학회 2017 한국기계가공학회지 Vol.16 No.1

We have developed a compact desktop-sized nanopatterning system driven by the Roll-to-Roll (R2R) nanoimprinting (NIL) principle. The system realizes the continuous and high-speed stamping of various nanoscale patterns on a large-area flexible substrate without resorting to ponderous and complicated instruments. We first lay out the process principle based on continuous NIL on a UV-curable resin layer using a flexible nanopatterned mold. We then create conceptual and specific designs for the system by focusing on two key processes, imprinting and UV curing, which are performed in a continuous R2R fashion. We build a system with essential components and optimized modules for imprinting, UV curing, and R2R conveying to enable simple but effective nanopatterning within the desktop volume. Finally, we demonstrate several nanopatterning results such as nanolines and nanodots, which are obtained by operating the built desktop R2R NIL system on transparent and flexible substrates. Our system may be further utilized in the scalable fabrication of diverse flexible nanopatterns for many functional applications in optics, photonics, sensors, and energy harvesters.

데스크탑 규모의 롤투롤 나노임프린팅 기반 정밀패턴 가공 스테이션 개발

이정수(Jeongsoo Lee),이지훈(Jihun Lee),오동교(Dong Kyo Oh),남승범(Seungbum Nam),조성일(Sungil Cho),조용수(Yongsu Jo),고민석(Minseok Go),김정대(Jeong Dae Kim),이재혁(Jae Hyuk Lee),이승조(Seungjo Lee),이윤규(Youn Kyou Lee),김동하(Dong Ha 한국기계가공학회 2017 한국기계가공학회 춘추계학술대회 논문집 Vol.2017 No.4

Hybrid Cluster Mesh organization scheme for Energy Efficient Wireless Sensor Networks

SungIl Lee,JaeSung Lim,SungHyun Yang,Yoon Myung Hyun 대한전자공학회 2007 ITC-CSCC :International Technical Conference on Ci Vol.2007 No.7

Wireless Sensor Networks(WSNs) have become a main technology for ubiquitous computing environments. In WSNs, battery recharge or replacement is impossible because sensors are left unattended after deployment. Therefore, WSNs need a networking protocol scheme to increase the life time of sensor nodes. In this paper, we propose a Hybrid Cluster Mesh(HCM) scheme which recognizes the density of neighbor nodes and each node decides its topology itself.

Iterative static modeling of channelized reservoirs using history-matched facies probability data and rejection of training image

Lee, Kyungbook,Kim, Sungil,Choe, Jonggeun,Min, Baehyun,Lee, Hyun Suk Springer-Verlag 2019 Petroleum science Vol.16 No.1

Piosk : A Practical Kiosk To Prevent Information Leakage

Lee, Suchul,Lee, Sungil,Oh, Hayoung,Han, Seokmin The Institute of Internet 2019 International journal of advanced smart convergenc Vol.8 No.2

One of important concerns in information security is to control information flow. It is whether to protect confidential information from being leaked, or to protect trusted information from being tainted. In this paper, we present Piosk (Physical blockage of Information flow Kiosk) that addresses both the problems practically. Piosk can forestall and prevent the leakage of information, and defend inner tangible assets against a variety of malwares as well. When a visitor who carries a re-writable portable storage device, must insert the device into Piosk installed next to the security gate. Then, Piosk scans the device at the very moment, and detects & repairs malicious codes that might be exist. After that, Piosk writes the contents (including sanitized ones) on a new read-only portable device such as a compact disk. By doing so, the leakage of internal information through both insiders and outsiders can be prevented physically. We have designed and prototyped Piosk. The experimental verification of the Piosk prototype implementation reveals that, Piosk can accurately detect every malware at the same detection level as Virus Total and effectively prevent the leakage of internal information. In addition, we compare Piosk with the state-of-the-art methods and describe the special advantages of Piosk over existing methods.

Teaching L2 Vocabulary Knowledge

( Sungil Lee ) 한국중등영어교육학회 2010 중등영어교육 Vol.3 No.2

L2 learners of English need to learn a large amount of vocabulary to read authentic texts and to communicate in the target language. Schmitt (2008) suggests that L2 learners are required to know 2000-3000 word families to understand spoken English, and 6000-7000 word families to cover 98%of texts. Because of the limited time for which L2 learners are exposed to the target language, to gain the enough amount of vocabulary is not a piece of cake. Along with broadening vocabulary size, L2 learners are required to deepen their vocabulary knowledge. Vocabulary knowledge includes the different aspects of word knowledge such as grammatical features, word associations, register constraints, syntactic features, and so on. In this regard, how effectively should vocabulary be taught and tested has been the center of the research of vocabulary acquisition. In the present paper, several issues in learning L2 vocabulary knowledge and pedagogy are mentioned.

조직을 위한 비윤리적 행위의 수용: 행위자의 능력 판단과 윤리적 판단의 매개효과

이성일(Sungil Lee),서유미(Yumi Seo) 한국인사조직학회 2017 인사조직연구 Vol.25 No.4

기업 활동에 대한 윤리적 판단의 필요성은 다양한 관점에서 제기되었으나, 대체로 기업윤리가 성과에 기여할 수 있다는 도구적 관점이 통용되어 왔다. 즉 기업에서의 윤리적 판단과 활동은 기업성과에 기여할 것이라는 기대로 인해 필요성이 확인되곤 했던 것이다. 그러나, 기업윤리에 대한 이러한 도구적 관점의 이면에는 비윤리적 행위 라도 조직성과에 기여한다면 승인될 수 있다는 가능성을 내포하고 있으며, 이는 실제로 몇몇 경험적 연구를 통해 확인되어 왔다. 다만, 조직을 위한 비윤리적 행위가 조직 내에서 승인되는 과정과 성격에 대해서는 아직 충분히 밝혀진 바가 없었다. 이에 본연구는 우선 비윤리적 행위가 조직이익을 지향하는 것으로 인식될 때, 이 행위가 행위자의 능력(ability)으로 판단될 수 있다는 것을 검증하고자 하였다. 그리고 이렇게 조직을 위한 비윤리적 행위를 능력으로 인식하는 것은 해석자의 윤리적 판단(Ethical Judgment)을 완화하여 궁극적으로 비윤리적 행위자에 대한 신뢰(trust) 또한 강화할 수있음을 밝히고자 하였다. 즉, 조직을 위한 비윤리적 행위의 수용 과정에서 행위자에 대한 능력 판단과 행위에 대한 윤리적 판단이 매개하고 있으며, 조직을 위한 비윤리적 행위 수용의 성격은 신뢰임을 보이고자 한 것이다. 이를 위해 본 연구는 직장인 및대학생 178명을 대상으로 시나리오에 기반을 둔 설문조사를 실시하였으며, 그 결과 비윤리적 행위가 조직 이익을 위한 행위로 인식될 경우 행위자에 대한 능력판단과 윤리적 판단의 완화라는 연속다중매개를 통해 궁극적으로 비윤리적 행위자에 대한 신뢰를 강화한다는 가설을 검증하였다. 그리고 이러한 결과를 조직에서 적용하기 위한 시사점과 연구의 한계에 대해 논의하였다. Although an instrumental perspective on business ethics implies that unethical behavior for the organization could be approved, and this has been examined by a few empirical studies, the mechanism and characteristics of unethical behavior approved by organizational members are yet to be fully explored. We examined this approval process of unethical behavior for an organization, especially focusing on the role of the perceived ability of the actor and the ethical judgment about the unethical behavior. We further argue that there could be a serial multiple mediation path from the pursuit of unethical behavior for the organization, which is expected to increase the perception of ability that leads to generous ethical judgment, and finally to the establishment of trust for the actor. We designed scenario-based surveys for students and employees, and our results showed that when people recognize the intention of unethical behavior is for the organization’s purposes, this has significant impact on perceived ability and ethical judgment. In addition, the serial multiple mediation path showed that recognition of the intention of unethical behavior has significant indirect effects through the perception of ability and ethical judgment on the level of trust for the actor. Through this process, we could find that trust is an important characteristic of approving unethical behavior for the organization. Managerial implications and limitations of this study are discussed.

에지밀도를 이용한 교육영상에서의 자막추출

조선길(Sungil Cho),홍전일(Junil Hong),이완주(Wanjoo Lee),이병래(Byeong Rae Lee),강현철(Hyunchul Kang) 한국통신학회 2000 한국통신학회 학술대회논문집 Vol.2000 No.7

Aquifer characterization of gas reservoirs using Ensemble Kalman filter and covariance localization

Kim, Sungil,Lee, Choongho,Lee, Kyungbook,Choe, Jonggeun Elsevier 2016 Journal of petroleum science & engineering Vol.146 No.-

<P><B>Abstract</B></P> <P>For decision making, it is necessary to predict reservoir behaviors using reliable models. We can forecast future performances with less uncertainty after reservoir characterization, which is an essential step for integrating available static and dynamic data in history matching. Ensemble Kalman filter (EnKF) is one of the powerful methods for reservoir characterization. It uses recursive updates and provides uncertainty assessment.</P> <P>EnKF has been rarely applied to characterization of gas reservoirs in spite of its active research for oil reservoirs. Gas reservoirs show typically high recovery and are less sensitive to permeability uncertainty. However, the recovery of gas reservoirs is severely affected by an aquifer, which has considerable uncertainty. Therefore, aquifer characterization is crucial for production management and uncertainty assessment of gas reservoirs.</P> <P>This paper presents a method to characterize permeability distribution and aquifer sizes of gas reservoirs using static data and production data available. Covariance localization is applied for taking account of proper relationship between well production data and the properties of grid cells. The proposed method manages not only permeability overshooting but also successful assimilation of permeability distribution. Besides, the aquifer factors come closer to the reference values as compared with a standard EnKF. Therefore, it obviously improves future predictions of gas and water productions.</P> <P><B>Highlights</B></P> <P> <UL> <LI> We characterize permeability distribution and aquifer sizes of gas reservoirs using only production data. </LI> <LI> We propose EnKF with covariance localization to characterize aquifer factors. </LI> <LI> The proposed method improves assimilation of permeability and predictions of gas and water rates. </LI> <LI> The proposed method characterizes performances of aquifer factors. </LI> </UL> </P>