Earticle

업무형 그리드 환경에서 제로 트러스트 통제 강도와 사용자 행동 및 시스템 성과 간 구조적 트레이드오프를 정량화하기 위해 시뮬레이션 플랫폼을 제안하였다. 인증 절차 강도, 인증 시간 비용, 권한 분리 수준, 규범 압박, 준수 보상, 공격자 보상 등의 변수를 단일요인 스윕 방식으로 조정하고, step-level JSONL 로그와 episode summary를 기반으로 우회율, 절차 생략률, 평균 업무 완료시간, 제출률, 기밀 유출률을 비교하였다. 분석 결과 인증 단계와 시간비용이 증가할수록 우회행동과 업무 지연이 함께 확대되었으며, 낮은 기본 권한 수준과 강한 성과압박 규범은 절차 생략과 우회를 더욱 증가시키는 경향을 보였다. 반면 준수 보상은 환경 마찰 수준에 따라 효과가 제한적이었으며, 공격자 보상이 일정 임계 구간을 넘는 경우 의도적 유출이 발생하였다. 이는 보안성과를 높이더라도 과도한 통제 마찰은 역으로 비정상 경로 선택을 유발할 수 있음을 보여주며, 산업안보 환경에서 통제 강화 자체보다 마찰 관리와 임계값 기반 정책 설계가 병행되어야 함을 시사한다.

This study proposes a work-oriented grid simulation platform to quantify the structural trade-offs between zero trust control intensity, user behavior, and system performance in industrial security environments. The experiment manipulates authentication strength, segmentation intensity, normative pressure, compliance rewards, and attacker rewards through one-factor sweeps and analyzes workaround rate, procedure skip rate, average task completion time, compliance rate, and leakage rate based on step-level logs and episode summaries. The results show that stronger authentication procedures, especially increased steps and time costs, tend to increase both workaround behavior and task delay. Lower default access levels and stronger performance-oriented normative pressure also raise the likelihood of procedure skipping and workaround actions. In contrast, compliance rewards show limited effectiveness under high-friction conditions. Intentional leakage emerges when attacker rewards exceed a certain threshold, indicating a threshold effect. These findings suggest that zero trust should be designed not only around stronger controls but also around friction management and threshold-based policy tuning.

In peer-to-peer accommodation platforms like Airbnb, property descriptions serve not only as informative content but also as persuasive tools that shape user expectations and decisions. While previous studies have focused on visual cues, pricing, and reviews, the linguistic style and framing of these descriptions remain underexplored. This study investigates how the informational versus emotional orientation of property descriptions—and the presence of negative keywords—affect two key user outcomes: booking behavior and customer satisfaction. Grounded in expectation disconfirmation theory, the study conceptualizes textual descriptions as signals that manage user expectations and convey authenticity or risk. Using a large-scale dataset of over 60,000 Airbnb listings in the United States, we apply natural language processing (NLP) and sentiment analysis to classify descriptions and identify negative expressions. These linguistic features are then used as explanatory variables in Poisson and negative binomial regression models to analyze count-based booking behavior, and in OLS models for continuous satisfaction ratings. We also introduce interaction terms to examine the moderating effects of negative keywords. Our research addresses the following questions: (1) How do information-based and emotion-based descriptions affect booking and satisfaction outcomes? (2) Does the presence of negative keywords enhance or undermine the persuasive effectiveness of these descriptions? (3) How do these textual strategies interact to shape user judgment? This study contributes to the literature on platform-mediated markets by demonstrating how language functions not only as a means of communication but also as a strategic framing and signaling mechanism. It shows that textual cues can shape trust, credibility, and expectation managementin online peer-to-peer environments. From a practical standpoint, platforms can leverage these insights to design tools and nudges that assist hosts in crafting effective, trustworthy, and expectation-aligned descriptions.

최근 금융사는 영업점 축소와 비대면 서비스의 확대 추세와 맞물려 챗봇 서비스의 활성화를 추진하고 있다. 그러나 기술적 한계와 이를 둘러싼 내·외부 환경의 제약이 존재하는 상황에서 일시에 챗봇 서비스를 확대하기는 어렵다. 따라서 챗봇 서비스의 제반 상황을 분석하여 단계별로 발생 가능한 문제를 선제적으로 확인하고 해결방안을 모색할 필요가 있다. 이에, 본 연구는 금융 챗봇 서비스 사용자의 사용 의도 및 행동을 고찰하기 위해 현장 실무자 및 연구자 12명을 대상으로 인터뷰를 진행하고, 이를 계획된 행동이론(Theory of Planned Behaviors, 이하 TPB)으로 해석하였 다. 연구 결과, 사용자들은 챗봇 사용 경험을 통해 갖게 된 편리함이나 불편함 등의 ‘감정 및 태도’, 군중 심리나 타인의 공감을 갈망하는 심리 등의 ‘주관적 규범’, 챗봇 사용 과정의 어려움이나 편리함에 대한 인식에 따른 ‘행동 통제’ 등의 특성이 드러났다. 이를 통해 이 특성이 사용자의 챗봇 서비스에 대한 지속적 사용 의도와 실제 행동에 영향을 미칠 수 있음을 알 수 있었다. 후속연구에서는 실제 사용자를 대상으로 하여 구체적인 사용 의도와 영향 요인을 실증적으로 연구 해 볼 필요가 있다.

Recently, financial companies are promoting chatbot services in line with the reduction of branches and the expansion of non-face-to-face services. However, it is difficult to expand the chatbot services at once in the presence of technical limitations and constraints of internal and external environment. Therefore, it is necessary to analyze the various situations of chatbot service to preemptively identify problems that can occur in stages and seek solutions. This study conducted interviews with 12 field practitioners and researchers to examine the intentions and behaviors of financial chatbot service users and interpreted them using TPB. The study revealed the characteristics of 'feelings and attitudes' such as convenience or inconvenience from the chatbot experience, 'subjective norms' such as herd behavior or the yearning for empathy of others, and 'behavioral control' according to the recognition of difficulty or convenience of chatbot use process. This study shows that this characteristic can affect the intention and actual behavior of users to use chatbot service continuously. In the future research, it is necessary to empirically study specific intentions and influence factors for actual users.

IT의 발달로 인해 기업뿐만 아니라 개인에게도 정보보안에 대한 중요성이 계속해서 커지고 있다. 개인정보보안을 위한 여러 방법들이 있지만, 많은 보안 전문가들은 주기적인 비밀번호 변경이 가장 쉬우면서도 효과적으로 개인정보를 보호할 수 있는 방법이라고 강조한 다. 현재 기업이나 여러 단체에서는 온라인 서비스 사용자들에게 비밀번호를 주기적으로 변경하라고 권장하고 있으며, 변경 요청 메시지를 제시하여 사용자들이 비밀번호를 변경하게 끔 유도한다. 이처럼 사용자들에게 제시되는 메시지는 사용자의 행동변화를 유발시킬 수 있는 강력한 방법 중 하나로 볼 수 있다. 메시지 프레이밍에 따르면 동일한 내용을 전달한다 하더라도, 제시되는 메시지가 어떻게 구성되고 표현되는지(긍정/부정)에 따라 설득의 효과가 달라질 수 있다. 본 연구에서는 비밀번호 변경 권유 메시지에도 메시지 프레이밍 기법이 활용될 수 있을 것으로 보고, 긍정적인 메시지와 부정적인 메시지가 사용자들에게 어떤 차이가 있는지 알아보고자 한다. 추가적으로 온라인 서비스에 대해 개인이 가지고 있는 심리적인 소유감의 정도에 따라 메시지 타입의 효과를 조절할 수 있다고 판단하 여, 어떠한 경우에 더 효과적인 행동을 이끌어 낼 수 있을지에 연구해보고자 한다.

클라우드 컴퓨팅은 새로운 컴퓨팅 기술이고 조직에서는 정보자원을 전략적으로 관리할 수 있게 하는 수단을 제공한다. 사용자 관점에서 클라우드 컴퓨팅은 원격의 어플리케이션에 접근하고, 데이터를 저장하며, 개인간 협업을 지원하는 등의 이슈를 수반한다. 조직에서 클라우드 컴퓨팅 효과적으로 적용되기 위해서는 우선 사용자의 채택이 전제조건이다. 본 논문에서 우리는 개인차원의 클라우드 컴퓨팅 수용을 설명하기 위하여 기존의 UTAUT 모형을 수정하고 확장한 모형을 제안하고, 설문 데이터를 이용하여 이 모형의 타당성을 검정한다.

Cloud computing is a new method of computing and managing organizational information technology resources strategically. From the user perspective, it involves computing environment for accessing applications remotely, storing data, and supporting cooperative works. For the cloud computing to be effective in an organization, it should be accepted by individual users. In this paper we propose a research model, extending and modifying UTAUT model. We also test the validity of the model using the questionnaire from a sample of cloud computing services users.

Mobile devices are the most important equipment for accessing various kinds of services. These services are accessed using wireless signals, the same used for mobile calls. Today mobile services provide a fast and excellent way to access all kinds of information via mobile phones. Mobile service providers are interested to know the access behavior pattern of the users from different locations at different timings. In this paper, we have introduced an associated tree for analyzing user behavior patterns while moving from one location to another. We have used four different parameters, namely user, location, dwell time, and services. These parameters provide stronger frequent accessing patterns by matching joins. These generated patterns are valuable for improving web services, recommending new services, and predicting useful services for individuals or groups of users. In addition, an experimental evaluation has been conducted on simulated data. Finally, performance of the proposed approach has been measured in terms of efficiency and scalability. The proposed approach produces excellent results.

Anonymity plays an increasingly important role on social media. This is reflected by more and more applications enabling anonymous interactions. However, do social media users behave different when they are anonymous? In our research, we investigated social media services meant for solely anonymous use (Jodel) and for widely spread non-anonymous sharing of pictures and videos (Instagram). This study examines the impact of anonymity on the behavior of users on Jodel compared to their non-anonymous use of Instagram as well as the differences between the user types: producer, consumer, and participant. Our approach is based on the uses and gratifications theory (U>) by E. Katz, specifically on the sought gratifications (motivations) of self-presentation, information, socialization, and entertainment. Since Jodel is mostly used in Germany, we developed an online survey in German. The questions addressed the three different user types and were subdivided according to the four motivation categories of the U>. In total 664 test persons completed the questionnaire. The results show that anonymity indeed influences users' usage behavior depending on user types and different U> categories.

In a personalized product recommendation system, when the amount of log data is large or sparse, the accuracy of model recommendation will be greatly affected. To solve this problem, a personalized product recommendation method using deep factorization machine (DeepFM) to analyze user behavior is proposed. Firstly, the K-means clustering algorithm is used to cluster the original log data from the perspective of similarity to reduce the data dimension. Then, through the DeepFM parameter sharing strategy, the relationship between low- and high-order feature combinations is learned from log data, and the click rate prediction model is constructed. Finally, based on the predicted click-through rate, products are recommended to users in sequence and fed back. The area under the curve (AUC) and Logloss of the proposed method are 0.8834 and 0.0253, respectively, on the Criteo dataset, and 0.7836 and 0.0348 on the KDD2012 Cup dataset, respectively. Compared with other newer recommendation methods, the proposed method can achieve better recommendation effect.

This paper presents a framework for observable behavior that can be used as a basis for user modeling, and it reports the results of a pair of user studies that examine the joint utility of two specific behaviors. User models can be constructed by hand, or they can be teamed automatically based on feedback provided by the user about the relevance of documents that they have examined. By observing user behavior, it is possible to obtain implicit feedback without requiring explicit relevance judgments. Four broad categories of potentially observable behavior are identified : examine, retain, reference, and annotate, and examples of specific behaviors within a category are further subdivided based on the natural scope of information objects being manipulated . segment object, or class. Previous studies using Internet discussion groups (USENET news) have shown reading time to be a useful source of implicit feedback for predicting a user's preferences. The experiments reported in this paper extend that work to academic and professional journal articles and abstracts, and explore the relationship between printing behavior and reading time. Two user studies were conducted in which undergraduate students examined articles or abstracts from the telecommunications or pharmaceutical literature. The results showed that reading time can be used to predict the user's assessment of relevance, that the mean reading time for journal articles and technical abstracts is longer than has been reported for USENET news documents, and that printing events provide additional useful evidence about relevance beyond that which can be inferred from reading time. The paper concludes with a brief discussion of the implications of the reported results.

This exploratory study aims to understand the potential of log data analysis and expand its utilization in user research methods. Transaction log data are records of electronic interactions that have occurred between users and web services, reflecting information-seeking behavior in the context of digital libraries where users interact with the service system during the search for information. Two ways were used to analyze South Korea's National Digital Science Library (NDSL) log data for three days, including 150,000 data: a log pattern analysis, and log context analysis using statistics. First, a pattern-based analysis examined the general paths of usage by logged and unlogged users. The correlation between paths was analyzed through a χ² analysis. The subsequent log context analysis assessed 30 identified users' data using basic statistics and visualized the individual user information-seeking behavior while accessing NDSL. The visualization shows included 30 diverse paths for 30 cases. Log analysis provided insight into general and individual user information-seeking behavior. The results of log analysis can enhance the understanding of user actions. Therefore, it can be utilized as the basic data to improve the design of services and systems in the digital library to meet users' needs.

This research aimed (1) to study and analyze the ability of current information retrieval (IR) systems based on views of information behavior (IB), and (2) to propose a conceptual framework for an IB model based on the collaboration between the system and user, with the intent of developing an IR system that can apply intelligent techniques to enhance system efficiency. The methods in this study consisted of (1) document analysis which included studying the characteristics and efficiencies of the current IR systems and studying the IB models in the digital environment, and (2) implementation of the Delphi technique through an indepth interview method with experts. The research results were presented in three main parts. First, the IB model was categorized into eight stages, different from traditional IB, in the digital environment, which can correspond to all behaviors and be applied to with an IR system. Second, insufficient functions and log file storage hinder the system from effectively understanding and accommodating user behavior in the digital environment. Last, the proposed conceptual framework illustrated that there are stages that can add intelligent techniques to the IR system based on the collaboration perspective between the user and system to boost the users' cognitive ability and make the IR system more user-friendly. Importantly, the conceptual framework for the IB model based on the collaboration perspective between the user and system for IR assisted the ability of information systems to learn, recognize, and comprehend human IB according to individual characteristics, leading to enhancement of interaction between the system and users.

사용자 인증은 네트워크 보안하는 첫 번째 단계이다. 인증의 유형은 많이 있으며, 하나 이상의 인증 방식은 네트워크 내의 사용자의 인증을 보다 안전하게 한다. 하지만 생체 인증 제외하고, 대부분의 인증 방법은 복사 할 수 있다. 또한 다른 사람이 타인의 인증을 악용 할 수 있다. 따라서, 하나 이상의 인증 방식은 안전한 인증을 위해 사용되 어야한다. 보안을 너무 강조하게 되면 비효율적이기 때문에, 효율적이면서 안전한 시스템을 구축하기 위한 연구가 많이 진행되고 있다. 본 논문은 사용자의 행동에 기초하여 인증 방안을 제시한다. 본 논문에서 제시한 방법은 안전하 고 효율적인 통신을 제공하여 클라우드 기반의 모든 시스템에서 사용자 인증에 적용될 수 있으며, 빅데이터 분석을 통한 보다 정확한 사용자 인증을 통해 안전한 통신에 기여할 것으로 기대한다.

User authentication is the first step to network security. There are lots of authentication types, and more than one authentication method works together for user’s authentication in the network. Except for biometric authentication, most authentication methods can be copied, or someone else can adopt and abuse someone else’s credential method. Thus, more than one authentication method must be used for user authentication. However, more credential makes system degrade and inefficient as they log on the system. Therefore, without tradeoff performance with efficiency, this research proposed user’s behavior based authentication for secure communication, and it will improve to establish a secure and efficient communication.

In the age of the Internet, social media has changed the way individuals communicate and is redefining how companies and customers communicate[1]. With the rapid development of mobile technology and the widespread use of smart phones and wireless networks, mobile social media has evolved into a marketing tool that enables businesses and customers to communicate anywhere and anytime. At present, WeChat, as the most widely used mobile social media platform in China, has been valued by more and more companies. The huge information generated by the WeChat user group's activities, such as the occurrence of purchase behavior, brand promotion, and word-of-mouth communication, has contributed to the explosive development of WeChat marketing. However, at present, the development of corporate WeChat marketing activities is still in the process of exploration. Although many companies are aware of the importance of WeChat marketing and have already carried out some WeChat marketing activities, there is still a lack of clear ideas for the effective implementation of WeChat marketing. There is no clear and effective method for how to positively influence the positive information behavior of user groups. Therefore, it clearly defines the relevant concepts in the research of user information behavior in corporate WeChat marketing, systematically extracts the influencing factors of user information behavior in corporate WeChat marketing, analyzes in depth the role of influencing factors, and conducts actual investigations on users participating in WeChat marketing of corporates. And data analysis to obtain the company's WeChat marketing elements that will truly affect user information behavior will help companies to use the WeChat platform to effectively conduct online marketing, enhance product service promotion, expand propaganda, strengthen customer relationship management, and achieve economic growth. Under the research paradigm of the SOR model, based on the mediating role of PAD model and perceived value, the hierarchically progressive role of each level element is analyzed, and the hypothesis of the relationship between the marketing platform quality and the user's internal state, and the user's internal state are proposed. Based on the hypothesis of hypothesis of user information behavior relationship, hypothesis of the internal role of user's internal state (emotional factors and perceived value) and the intermediary role relationship of user's internal state, a theoretical model of the relationship between the user information behavior influence factors in the corporate WeChat marketing is constructed.

Founded on social network theory, this study will recruit 168 patients in an online health community as the research subject, and uses Poisson regression model to investigate the impact of network structure characteristics on user participation behavior. This study contributes to the body of knowledge in the online medical field and provides practical implications to the managers of online health platforms.

The purpose of this paper is to strengthen trust on the automated collaborative filtering system. Automated collaborative filtering system is quickly becoming a popular technique for recommendation system. This elaborative methodology contributes for reducing information overload and the result becomes index of users' preference. In addition, it can be applied to various industries in various fields. After it collaborative filtering system was developed, many researches are executed to enhance credibility and to apply in various fields. Among these diverse systems, collaborative filtering system which uses Pearson correlation coefficient is most common in many researches. In this paper, we proposed new process diagram of collaborative filtering algorithm and new factors which should improve the credibility of system. In addition, the effects and relationships are also tested.

비디오스트리밍 서비스와 같은 클라우드 컴퓨팅의 확장성 제고를 위하여, 개인 사용자들의 컴퓨팅 자원을 활용하는 기술이 널리 사용되고 있다. 이와 같이 노드의 도움을 받는 시스템은 효율성 극대화를 위하여, 노드들의 행동을 정확히 예측하는 것이 매우 중요하다. 비록 P2P시스템관련 연구가 많이 진행되어 왔으나, 대부분 한 시스템 전체에 대한 특성을 수집 및 분석하는 연구가 주를 이루고 있다. 따라서 각 노드들의 행동 패턴을 분석하는 연구는 초기 단계에 머물러 있다. 본 연구에서는 각 노드들의 가용성에 대한 행동 패턴을 자동으로 분류하기 위한 기술을 제시하고, 그 분류 결과를 수동으로 된 것과 비교한다. 실제 운영되고 있는 P2P시스템에 참여하고 있는 노드들의 사용 기록에 대하여 다양한 조건으로 k-means 클러스터링을 적용하였다. 분석 결과에 따르면, 노드의 가용성 변화 기준으로 다양한 숨겨진 행동 패턴이 존재하는 것을 볼 수 있었다. 본 연구는 노드의 불확실성에 미리 대비하기 위한 시스템 설계에 활용 될 수 있을 것으로 기대된다.

To increase the scalability of cloud computing, utilizing resources of individual users has been widely adopted especially in video streaming services. Accurately predicting behavior of user nodes is critical to achieve a high efficiency in such a peer-assisted system. Though there have been many measurement studies on peer-to-peer systems, most of them have focused on the design and characterization of the systems. Thus the behavior patterns of individual nodes have seldom been studied. In this paper, we present new techniques for classifying behavior of nodes in terms of availability and compare them with naive manual classification. We apply a k-means clustering algorithm with various classification criteria on real trace data of a peer-to-peer system. Our analysis shows that there are various hidden behavior patterns with respect to the transition of availability. Our study will give a useful hint to a system designer in handling churns more efficiently based on the peer classification.

본 연구는 인공지능(AI) 디바이스가 차세대 정보통신기술(ICT)의 핵심 플랫폼으로 급부상하고 있고, 소비자들 의 일상에 널리 적용되고 있는 인공지능 디바이스를 통해 소비자의 사용행태 및 사용자 경험에 대해 살펴보았다. 이를 위해 AI 디바이스 사용 경험이 있는 국내 소비자 600명을 대상으로 AI 디바이스의 속성 인식과 사용행태를 도출하였 다. 분석결과는 다음과 같다. 첫째, 다양한 속성 중 음악청취를 가장 많이 이용하였고, 날씨 정보제공과 같은 단순한 기능을 유용하게 인식하는 것으로 나타났다. 둘째, AI 디바이스 사용자의 주요 사용기기는 AI 스피커, 스마트폰, PC, 노트북 등으로 확인되었다. 셋째, AI 디바이스에 대한 연상 이미지는 재미있는, 유용한, 신기한, 똑똑한, 혁신적인, 친근 한 순으로 나타났다. 따라서 본 연구는 AI 디바이스의 특성을 반영한 사용 행태를 분석함으로써 향후 AI 디바이스를 활용한 사용자의 서비스 제공에 기여할 수 있다는 실무적 시사점을 갖는다.

Artificial intelligence (AI) devices are rapidly emerging as a core platform of next-generation information and communication technology (ICT), this study investigated consumer usage behavior and user experience through AI devices that are widely applied to consumers' daily lives. To this end, data was collected from 600 consumers with experience in using AI devices were derived to recognize the attributes and behavior of AI devices. The analysis results are as follows. First, music listening was the most used among various attributes and it was found that simple functions such as providing weather information were usefully recognized. Second, the main devices used by AI device users were identified as AI speakers, smartphone, PC and laptops. Third, associative images of AI devices appeared in the order of fun, useful, novel, smart, innovative, and friendly. Therefore, practical implications are suggested to contribute to provision of user services using AI devices in the future by analyzing usage behaviors that reflect the characteristics of AI devices.

During the Covid-19 pandemic, social distance regulation calls for non-contact services, making self-service technologies gain much more attention. However, customers found they are pushed into more digital shadow work by employing Self-service technologies (SSTs). This research aims to examine how digital shadow work influences user emotions and behaviors during SSTs use. Based on the grounded theory method (GTM), this draft drives 128 codes and 7 categories to develop the theory of digital shadow work. Operations, consisting of pre-use, during use, and after use, along with the cognitions, including the perception of use-value and time efficiency, act as the trigger of digital shadow work. Achievement emotions, embodying happiness and satisfaction from technology use, result from the perception of high use-value and high time efficiency, while loss emotions, encompassing anger and disappointment from the user experience, generate from the perception of low use-value and low time efficiency, and finally, user responses from the digital shadow work - quitting, continuous and alternative behaviors are found as key factors. The interventing roles of a sense of control, system features, and compensation are also addressed. Examining users’ psychological mechanisms academically contributes to developing the theory of digital shadow work whereas it advances the development of SSTs on a practical side.

웹 애플리케이션의 수요가 나날이 늘어남에 따라 보안 관제 측면의 중요성도 증가하고 있다. 특히 원격으로 서버에 접근하여 악의적인 명령 수행을 수행하는 웹셸 공격은 피해 범위가 넓고 피해 사례 수가 증가하고 있어, 웹 서버 관제 시 웹셸 탐지 능력은 필수적이다. 기존의 웹 방화벽과 같은 보안장비는 우회 가능성이 있으며, 알려지지 않은 공격에 취약하기 때문에 전체 로그 데이터로부터 정상 상태를 정의하고, 이에서 벗어난 비정상 상태를 탐지하는 이상 탐지 기법이 요구된다. 본 연구에서는 웹 서버의 access log에서 웹 서버에 접근한 사용자별 행동특성을 벡터화하여 정상 상태를 정의하고, 이를 벗어난 비정상 상태, 즉 웹셸 공격을 탐지하는 TF-IDF 기반의 임베딩 기법을 제안한다. 본 기법은 응답 용량의 변동을 고려하여 사용자 행동을 보다 정교하게 임베딩함으로써, 웹셸 공격과 같은 비정상상태를 효과적으로 탐지할 수 있다.

As the demand for web applications grows, the importance of security control increases, particularly for detecting webshell attacks that remotely access servers and execute malicious commands. Existing security measures, like web firewalls, can be bypassed and are vulnerable to unknown attacks. Therefore, an anomaly detection technique is needed to define normal behavior from log data and detect deviations. This study proposes a TF-IDF-based embedding technique to vectorize user behavior from web server access logs, thereby defining normal states and detecting anomalies, such as web shell attacks. The proposed method incorporates byte variation count to provide a more refined embedding of user behavior, enabling effective detection of abnormal states like web shell attacks.

인터넷 사용자의 급증으로 웹 어플리케이션은 해커의 주요 공격대상이 되고 있다. 웹 공격을 막기 위한 기존의 WAF(Web Application Firewall)는 공격자의 전반적인 행위보다는 HTTP 요청 패킷 하나하나를 탐지 대상으로 하고 있으며, 새로운 유형의 공격에 대해서는 탐지하기 어려운 것으로 알려져 있다. 본 연구에서는 알려지지 않은 패턴의 공격을 탐지하기 위해 기계학습을 활용한 사용자 행위 기반의 웹 공격 탐지 기법을 제안한다. 공격자가 정상적인 사용자인 것처럼 위장할 수 있는 부분을 제외한 영역에 집중하여 사용자 행위 정보를 정의였으며, 벤치마크 데이터셋인 CSIC 2010을 활용하여 웹 공격 탐지 실험을 수행하였다. 실험결과 Decision Forest 알고리즘에서 약 99%의 정확도를 얻었고, 동일한 데이터셋을 활용한 기존 연구와 비교하여 본 논문의 효율성을 증명하였다.

With the rapid growth in Internet users, web applications are becoming the main target of hackers. Most previous WAFs (Web Application Firewalls) target every single HTTP request packet rather than the overall behavior of the attacker, and are known to be difficult to detect new types of attacks. In this paper, we propose a web attack detection system based on user behavior using machine learning to detect attacks of unknown patterns. In order to define user behavior, we focus on features excluding areas where an attacker can camouflage as a normal user. The experimental results shows that by using the path and query information to define users' behaviors, best results for an accuracy of 99% with Decision forest.