In recent years, attacks on network environments continue to rapidly advance and are increasingly intelligent. Accordingly, it is evident that there are limitations in existing signature-based intrusion detection systems. In particular, for novel attacks such as Advanced Persistent Threat (APT), signature patterns have problems with poor generalization performance. Furthermore, in a network environment, attack samples are rarely collected compared to normal samples, creating the problem of imbalanced data. Anomaly detection using an autoencoder has been widely studied in this environment, and learning is through semi-supervised learning methods to overcome these problems. This approach is based on the assumption that reconstruction errors for samples that are not used for training will be large, but an autoencoder is often over-generalized and this assumption is often broken. In this paper, we propose a network intrusion detection method using a memory-augmented deep auto-encoder (MemAE) that can solve the over-generalization problem of autoencoders. The MemAE model is trained to reconstruct the input of an abnormal sample that is close to a normal sample, which solves the generalization problem for such abnormal samples. Experiments were conducted on the NSL-KDD, UNSW-NB15, and CICIDS 2017 datasets, and it was confirmed that the proposed method is better than other one-class models.

Recently, several plant pathogens have become more active due to temperature increases arising from climate change, which has caused damage to various crops. If climate change continues, it will likely be very difficult to maintain current crop production, and the problem of a shortage of expert manpower is also deepening. Fortunately, research on various early diagnosis systems based on deep learning is actively underway to solve these problems, but the problem of lack of diversity in some hard-to-collect disease samples remains. This imbalanced data increases the bias of machine learning models, causing overfitting problems. In this paper, we propose a data augmentation method based on an image-to-image translation model to solve the bias problem by supplementing these insufficient diseased leaf images. The proposed augmentation method performs translation between healthy and diseased leaf images and utilizes attention mechanisms to create images that reflect more evident disease textures. Through these improvements, we generated a more plausible diseased leaf image compared to existing methods and conducted an experiment to verify whether this data augmentation method could further improve the performance of a classification model for early diagnosis of plants. In the experiment, the PlantVillage dataset was used, and the extended dataset was built using the generated images and original images, and the performance of the classification models was evaluated through the test set.

As cyberattacks become more intelligent, the difficulty increases for traditional intrusion detection systems to detect advanced attacks that deviate from previously stored patterns. To solve this problem, a deep learning-based intrusion detection system model has emerged that analyzes intelligent attack patterns through data learning. However, deep learning models have the disadvantage of having to re-learn each time a new cyberattack method emerges. The time required to learn a large amount of data is not efficient. In this paper, an experiment was conducted using the Leipzig Intrusion Detection Data Set (LID-DS), which is a host-based intrusion detection data set released in 2018. In addition, in order to evaluate and improve the performance of the system, a host-based intrusion detection model consisting of pre-processing, vector-to-image processing, training and testing steps is proposed. In the training and testing steps, a Siamese Convolutional Neural Network (Siamese-CNN) is constructed using the few-shot learning method, which shows excellent performance by learning a small amount of data. Siamese-CNN determines whether the attack type is the same based on the similarity score of each cyberattack sample converted to an image. The accuracy was calculated using the few-shot learning technique. The performance of the Vanilla Convolutional Neural Network (Vanilla-CNN) and Siamese-CNN are compared to confirm the performance of Siamese-CNN. As a result of measuring the accuracy, precision, recall, and F1-score indicators, it was confirmed that the recall of the Siamese-CNN model proposed in this study increased by about 6% compared to the Vanilla-CNN model.

In recent years, there has been an increase in the number of phishing attacks targeting people in the fields of defense, security, and diplomacy around the world. In particular, hacking attack group Kimsuky has been conducting phishing attacks to collect key information from public institutions since 2013. The main feature of the attack techniques used by the Kimsuky attack group are to conceal malicious code in phishing e-mails disguised as normal e-mails to spread a document file that is vulnerable to security, such as a Hangul file, or to induce interest through a social engineering attack technique to collect account information. This study classified the types of phishing e-mail attacks into spoofed e-mails, e-mail body vulnerability use, and attached file spoofing, and detailed analyses of their attack methods, such as commonality and characteristic analyses, were performed to analyze the profile of this phishing e-mail attack group. Based on the results, the purpose of the attacking group was determined to be intelligence gathering because it focused on phishing attacks targeting Korean diplomatic and defense public institutions and related foreign institutions. Finally, a countermeasure that can be used by mail service providers and mail users to respond to phishing e-mails is suggested.