Abstract:
An apparatus for quantifying network threat situations includes a traffic analyzing unit to analyze packet patterns of traffics occurring on a target network being monitored to extract one or more suspicious domains. An IP monitoring unit gives security levels among a plurality of security levels to the suspicious domains according to the number of access IPs accessing the suspicious domains. An activity index computing unit computes activity indices for the suspicious domains from activity indices according to the access times to the suspicious domains of the access IPs. An attack amount anticipation unit analogizes an expected amount of attacks for each suspicious domain according to an expected amount of attacks for each zombie computer, the security level and the activity index of the suspicious domain.
Abstract:
Provided is an exploration method based on reward decomposition in multi-agent reinforcement learning. The exploration method includes: generating a positive reward estimation model through neural network training based on training data including states of all agents, actions of all the agents, and a global reward true value; generating, for each of the agents, a first individual utility function based on the global reward true value and generating a second individual utility function using the positive reward estimation model; and determining an action of each of the agents using the first individual utility function and the second individual utility function based on the state of each of the agents.
Abstract:
Provided herein is a communication method using MIMO (Multiple-Input Multiple-Output) technology for communicating with a terminal included in each of a plurality of base station cells using a communication apparatus, the method including calculating, by the communication apparatus, the number of terminals included inside a base station cell; generating, by the communication apparatus, pilot signals corresponding to the calculated number of terminals; and allocating, by the communication apparatus, the pilot signals to a terminal that may maximize a network capacity based on the generated pilot signals.
Abstract:
An exploration method used by an exploration apparatus in multi-agent reinforcement learning to collect training samples during the training process is provided. The exploration method includes calculating the influence of a selected action of each agent on the actions of other agents in a current state, calculating a linear sum of the value of a utility function representing the action value of each agent and the influence on the actions of the other agent calculated for the selected action of each agent, and obtaining a sample to be used for training an action policy of each agent by probabilistically selecting the action in which the linear sum is the maximum, and the random action.
Abstract:
Provided is a method for exploration based on curiosity and prioritization of experience data in multi-agent reinforcement learning, the method including the steps of: calculating a similarity between a policy of a first agent and a policy of a second agent and computing a final reward using the similarity; and performing clustering on a replay buffer using a result of calculating the similarity between the policy of the first agent and the policy of the second agent and performing sampling on data in the cluster.
Abstract:
There are provided a method and an apparatus for detecting attacks and automatically generating attack signatures based on signature merging. A method for detecting attacks and automatically generating attack signatures based on signature merging includes detecting a character string matched to at least one previously stored compressed attack signature in an input packet received from a network, determining whether the character string detected in the primary attack detection is matched to at least one previously stored individual attack signature, and, if the detected character string is matched to the at least one previously stored individual attack signature, determining the input packet as an attack packet, and, if the detected character string is not matched, determining the input packet as a new attack signature.