Abstract: In order to enhance system security in the BYOD and smart work environment, the abnormal behavior detection system carries out the first analysis for processing situation information into connection, use and agent situation information and profile information and analyzing the entire use behavior pattern during the personalized connection period, and carries out the second analysis based on service access speed to enhance capability for detecting an abnormal behavior.

Abstract: Differently from the existing network-based security systems through network traffic analysis, the abnormal behavior detection system implemented a method for detecting an abnormal behavior by patterning various behavior elements, such as time, position, connection network and a used device of an object. In order to enhance system security in the BYOD and smart work environment, the abnormal behavior detection system processes situation information into situation information of connection, use and agent and profile information and detects behaviors, such as abnormal access and use of a terminal device using the entire use behavior pattern and deviation of pattern error rate during the personalized connection period.

Abstract: An abnormal behavior detection system includes a context information reception unit receiving a variety of types of context information from a context information collection system, a context information processing unit generating a corresponding detection request message when context information about “termination or access termination” is received and transfer the corresponding detection request message to an abnormal detection unit, the abnormal detection unit detecting an abnormal use behavior by analyze frequency of behaviors in an identical access situation which have occurred during an entire access period through an analysis of a use behavior pattern during the entire access period, a profile management unit profiling pieces of context information according to various use behaviors of the user and store and manage the pieces of profiled context information, and an information analysis unit analyzing web site or DB use information based on the pieces of received context information.

Abstract: An abnormal behavior detection system includes a context information reception unit receiving a variety of types of context information from a context information collection system, a context information processing unit generating a corresponding detection request message when context information about web service use is received and transfer the corresponding detection request message to an abnormal detection unit, an abnormal detection unit comparing sequence of a use page and use speed, performed right after user access, with a pattern in the past access through an analysis of an initial use behavior pattern when the detection request message is received and to detect an abnormal use behavior, a profile management unit profiling pieces of context information according to various use behaviors of the user and store and manage the pieces of profiled context information, and an information analysis unit analyzing web site or DB use information.

Abstract: Disclosed is a behavior detection system for detecting an abnormal behavior, can perform dynamic control based on situation information and a profile of each user to cope with an element threatening security of an internal infrastructure of an enterprise, such as information leakage, in BYOD and smart work environment. The system calculates probabilities of behaviors occurring for respective connection behavior elements, calculates standard deviations of the probabilities based on weighting factors and determines whether or not the calculated behavior occurrence probabilities and behavior standard deviation correspond to a normal behavior, existence of an abnormal connection behavior in a BYOD and smart work environment is detected and an abnormal user is detected by examining whether or not an average traffic volume, an average use time and traffic volume with respect to a use time exceeds respective standard values.