2025, Vol.21, No.4

Journal of Software Forensics 2025 KCI Impact Factor : 0.3

pISSN : 3092-541X / eISSN : 3140-071X
https://journal.kci.go.kr/ksavs

In large-scale information systems and web services, log-based anomaly detection is a key means of capturing early signs of ransomware and other malware. However, unsupervised methods that rely on raw log text and limited feature engineering perform poorly on real security logs with imbalanced labels and multi-stage attacks. This paper proposes an LLM-based log embedding pipeline that combines three representations-raw logs, embeddings from pre-trained Llama language models, and domain-fine-tuned embeddings for security logs-with statistical and deep anomaly detection models, using about 800,000 web access and system audit log entries. Under a common data split, embedding-based representations raise the binary F1-score of most models to roughly 2.5 times the raw-log baseline and more than threefold for rare attack types, demonstrating their effectiveness as a common input representation for malware anomaly detection and early-warning systems.

With the expansion of open government data policies and the rapid deployment of Generative AI technologies, the utilization of KOGL (Korea Open Government License)-licensed open government works has significantly increased. However, copyright infringement issues continue to arise due to misunderstanding of license conditions, inaccurate labeling, and ambiguity in third-party ownership, leading to violations of attribution (BY), non-commercial use (NC), no-derivatives (ND), and false registration (CF). Traditional manual verification processes are insufficient for handling the growing volume and complexity of shared content, and they fail to automatically detect contextual and multimodal infringement patterns. To address these challenges, this study proposes a multimodal AI-based copyright infringement risk prediction model that integrates textual descriptions and image content to evaluate KOGL compliance. The model consists of a six-stage pipeline-Input, Pre-processing, CUR Feature Extraction, GRU-based Sequence Modeling, CRU Rule Engine, and Final Decision-and learns contextual temporal patterns to classify infringement types. Through 1,000 repeated experiments, the proposed model achieved significantly improved performance over single-modal baselines in Accuracy, F1-Score, and AUC, and provides evidence-based explanatory outputs for practical decision support.

Game streaming has grown into a core marketing channel for the game industry. However, for story-driven games, live streams and VODs can reveal key narrative elements - such as endings and plot twists - thereby undermining purchase incentives and harming the economic interests of copyright holders. Current publisher streaming guidelines are typically written in natural language, which makes automated compliance assessment and post-hoc reproducibility difficult, and their interpretive ambiguity leads to inconsistent enforcement. This paper defines a license-script-based real-time control model that takes game state and stream metadata as inputs. Using a prototype consisting of an OBS plug-in and a game control module, it proposes an architecture that maps guideline conditions into executable scripts and enforces them in real time. The paper also organizes conditions extracted from real-world guidelines into a classification scheme, quantitatively presents the scope and limits of what can be expressed and enforced via a stateless evaluation model, and discusses how execution logs can serve as evidentiary artifacts for determining license violations and supporting forensic evaluation.