• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.5
• /
• pp.1045-1054
• /
• 2021

As APT attacks become more frequent and sophisticated, not only the advancement of the security systems but also the competence of the cybersecurity officers of each institution that operates them is becoming increasingly important. In a large-scale cyber defence exercise with many blue teams participating and many systems to simulate and defend against, it should be possible to simulate attacks to generate various attack patterns, network payloads, and system events. However, if one RT framework is used, there is a limitation that it can be easily detected by the blue team. In the case of operating multiple RT frameworks, a lot of time and effort by experts for exercise setup and operation for each framework is required. In this paper, we propose iRF(integrated RT framework) that can automatically operate large-scale cyber defence exercise by integrating a number of open RT frameworks and RT frameworks created by ourselves.

• 한국방재학회:학술대회논문집
• /
• 2011.02a
• /
• pp.31-31
• /
• 2011

1990년 이후 공산체계인 구소련과 동구권이 몰락하고 세계적으로 탈냉전의 변화와 우리의 민주정부 수립 후 햇빛정책 등에도 불구하고 북한은 적화통일을 포기하지 않고 작년 11월에 연평도에 포격을 가하여 민간인과, 군이 2명이 사망하는 사건이 발생 하였다. 또한 북한의 공격은 과거의 포탄공격뿐만 아니라 미사일이나 화생방과 같은 생화학물질 탑재 가능한 공격이 예상된다. 이에 대비 정부에서는 고정시설의 화생방 방호는 일단유사시에 국민의 생명과 재산을 보호하는데 필수요소로서 집단보호개념에 도입하고 있으며, 현재 각 중요 대피시설 및 지자체의 기존 대피시설을 개인방호, 탐지, 제독, 운용절차를 포함한 실태파악 및 재래식 탄을 포함한 통합적인 조치를 마련하고 있다. 작년 2010년 11월 연평도에서의 북한 포격이후 우리는 서해5도나 접경지역 주민과 그리고 근접거리의 서울시민들이 안전하게 포격으로부터 피난 할 수 있는 민방위대피소에 대한 문제점이 대두되고 대책방안을 요구하고 있다. 소방방재청 기준에 따르면 직격(直擊) 핵폭탄을 제외한 화생방, 재래식 무기 공격에 견딜 수 있는 시설은 '1등급 대피시설'인데 서울에는 한 곳도 없다. 고층건물의 지하 2층 이하나 지하철, 터널 같은 2등급 대피시설도 폭격은 견딜 수 있지만 화생방 공격에는 취약하다. 지하상가 등 건축물의 지하층, 지하차도나 보도는 그보다 더 취약한 3등급이며 단독 주택의 지하층처럼 방호 효과가 떨어지는 곳이 4등급이다. 2등급으로 분류된 대피소의 경우 분류만 되어 있을 뿐 장기간 대피시 시민들이 사용 할 수 있는 거주공간이 아닌 임시 대피로서의 역할만 하고 있다. 본 연구에서는 민방위 기본법에 따라 지하에 $3.3m^2$ 당 4명 이상이 대피할 수 있는 규모의 공간을 갖추기만 하면 대피시설로 볼 수 있는 현 문제점과 1등급에서 4등급으로 나뉘어져있는 민방위 대피소와 대피소가 있지만 피난공간으로서의 역할과 구조적으로 안전한가에 대한 국내외 실태 분석을 통하여 분석한 결과 우리는 서해5도 대피시설의 반 이상이 무용지물이고 접경지 또한 피난시에 피난장으로서의 대피소가 난방이나, 구급품과 식구 시설 등이 구비가 되어 있지 않고 대피시설로 지정한곳이 간판이나 안내시설이 없다. 외국의 경우 스위스는 연방정부의 관리책임으로 전쟁이나 핵 확산에 따른 화생방 업무 전담팀을 두고 있으며, 방독면은 개인 방호물자로서 전국민 100% 보유하고, 각가정이나 건축, 시설물의 경우 화생방 표준 대피시설 설치관련 규정 마련 시행하고 있다. 대피시설은 화생방 방호가 가능한 지휘부용 대피시설과 일반 주민대피용 시설을 구분하여 설치운영하고 있으며, 전국에 650만개를 설치하고 있다. 결론은 대피시설이 북한 공경시 피난시설로의 활용방안을 모색 등급구분에 따른 현실적용 수정과 기존 대피소 보강과 재선별이 필요하고, 신축시 설계 표준설계안 그리고 기존의 대피소에 대한 보수, 보강방법 가이드라인과 장기간 거주에 대한 설비구축 등과 국민 대홍보등을 제안하였다.

• Journal of Korea Multimedia Society
• /
• v.10 no.1
• /
• pp.36-48
• /
• 2007

This paper proposed 3D keyframe animation using orientation interpolator. 3D keyframe animation consists of a number of transform nodes that have geometrical node of initial model and several interpolator nodes that represent the object moving. In the proposed algorithm, we randomly selects transform nodes with orientation interpolator node and performs to resample quaternion components for haying uniform key time. And then, watermark bits are embedded into quaternion components with large rotation angles. Experimental results verified that the watermark embedded by the proposed algorithm had good robustness against geometrical attacks and timeline attacks and also PSNR of keyvalue in orientation interpolator node is above 42dB.

• Journal of the Institute of Electronics Engineers of Korea TC
• /
• v.43 no.7 s.349
• /
• pp.72-83
• /
• 2006

It is not a practical solution that the DDoS attacks or worm propagations are protected and responded within a domain itself because it clogs access of legitimate users to share communication lines beyond the boundary a domain. Especially, the DDoS attacks with spoofed source address or with bogus packets that the destination addresses are changed randomly but has the valid source address does not allow us to identify access of legitimate users. We propose a scheme of distributed network security management to protect access of legitimate users from the DDoS attacks exploiting randomly spoofed source IP addresses and sending the bogus packets. We assume that Internet is divided into multiple domains and there exists one or more domain security manager in each domain, which is responsible for identifying hosts within the domain. The domain security manager forwards information regarding identified suspicious attack flows to neighboring managers and then verifies the attack upon receiving return messages from the neighboring managers. Through the experiment on a test-bed, the proposed scheme was verified to be able to maintain high detection accuracy and to enhance the. normal packet survival rate.

• The Transactions of the Korea Information Processing Society
• /
• v.13 no.4
• /
• pp.157-165
• /
• 2024

The evolution of the Distributed Denial of Service Attack(DDoS Attack) method has increased the difficulty in the detection process. One of the solutions to overcome the problems caused by the limitations of the existing victim-side detection method was the source-side detection technique. However, there was a problem of performance degradation due to network traffic irregularities. In order to solve this problem, research has been conducted to detect attacks using a collaborative network between several nodes based on artificial intelligence. Existing methods have shown limitations, especially in nonlinear traffic environments with high Burstness and jitter. To overcome this problem, this paper presents a collaborative source-side DDoS attack detection technique introduced with an attention mechanism. The proposed method aggregates detection results from multiple sources and assigns weights to each region, and through this, it is possible to effectively detect overall attacks and attacks in specific few areas. In particular, it shows a high detection rate with a low false positive of about 6% and a high detection rate of up to 4.3% in a nonlinear traffic dataset, and it can also confirm improvement in attack detection problems in a small number of regions compared to methods that showed limitations in the existing nonlinear traffic environment.

• Journal of the Korean Home Economics Association
• /
• v.49 no.6
• /
• pp.1-12
• /
• 2011

This study investigated prevalence rates and differences in social behaviors, psychosocial adjustments, and language ability of preschool children who engaged in bully/victim subgroups: aggressive victims, passive victims, bullies, and non-involved. The participants were 297 preschool children and their teachers in Jeju City. The teachers measured children's peer victimization, social behaviors, and teacher-child relationships. Children's language ability and self-concept were also assessed by individual interview. There were significant differences in social behaviors, psychosocial adjustments, and language ability among the bully/victim subgroups. Aggressive victims included in a high risk group characterized by a high level of aggression, ADHD, peer rejection as well as conflicted relationships with teachers. Moreover, they had limited language ability. The findings highlight behavioral heterogeneity among the bully/victim subgroups in early childhood.

• Journal of Internet Computing and Services
• /
• v.8 no.4
• /
• pp.81-91
• /
• 2007

Binding update for the routing optimization in MIPv6 can make the involved nodes vulnerable to various attacks. Therefore, secure binding update becomes an important research issue in MIPv6, and several protocols have been proposed for this purpose. In this paper, we compare several existing binding update protocols such as RR, SUCV and OMIPv6 and analyze the vulnerability of nodes to the possible attacks and drawbacks of address management and scalability and overhead of encryption operations. Then, we suggest the design requirements for the secure binding update and propose an advanced protocol based on the design principle. Through the analysis, we show that our protocol can achieve a higher level of security against the various attacks and enable better management of address, provide the location privacy and reduce the computational overhead of mobile nodes with constraint computational power.

• Convergence Security Journal
• /
• v.13 no.1
• /
• pp.11-17
• /
• 2013

In this paper, the information security requirements in the mobile ad-hoc network(MANET) are presented, and the algorithm to establish the protection node(gateway) is proposed to prevent the distributed denial of service(DDoS). The information security technology and security threats in the MANET are presented, and protection node is decided to minimize the total cost through the sending nodes and receiving nodes by way of protection node. To set up the protection node, the minimization algorithms of maximum cost and the average cost between the protection node and receiving nodes are compared with the optimal solutions, in which optimal solution is found out by all enumeration method. From the results, the total cost between the sending and receiving nodes is minimized under the average cost minimization algorithm rather than the using of the maximum cost.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2018.10a
• /
• pp.158-161
• /
• 2018

2011년 미국에서 최초로 소개된 후 기존 보안 기술과 다른 새로운 정보시스템 보호 기술로 Moving Target Defense(MTD)가 활발히 연구 되고 있다. MTD는 시스템의 구성 요소들을 뷸규칙적이고 동적으로 변화시켜 공격표면(Attack surface)을 줄임으로써 외부 공격에 대한 보안성을 높인다. 주로 시스템 정보를 수집 및 분석하여 공격하는 보안 위협들에 효과적이며 특히 지능형 지속 보안 위협(Advanced Persistent Threat), 킬 체인(Kill-Chain) 보안에 뛰어난 성능을 기대할 수 있다. 최근 MTD 시스템 구현 및 개발로 상용화가 시작되었으나 MTD 활용을 통해 어느 정도의 보안성 및 효율성을 가지는지에 대한 성능 평가인증, 시험지침 등이 표준화 되어있지 않아 기준이 모호한 실정이다. 본 논문에서는 이러한 최근 MTD 이슈에 대해 살펴보고 MTD와 연관 되어있는 각 분야에 어떤 평가인증 요구사항들이 있는지 분석한다. 이를 통해 MTD에 어떠한 평가인증 요구사항이 있는지 도출하여 앞으로 MTD 평가인증 표준화 참고 및 활용에 기여 할 수 있을 것으로 전망한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.17 no.1
• /
• pp.3-10
• /
• 2007

In this paper, we show that the status certificate-based encryption(SCBE) scheme proposed at ICISC 2004 and the certificateless signature(CLS) scheme proposed at EUC workshops 2006 are insecure. Both schemes are claimed that an adversary has no advantage if it controls only one of two participants making a cryptographic key such as a decryption key in SCBE or a signing key in CLS. But we will show that an adversary considered in the security model of each scheme can generate a valid cryptographic key by replacing the public key of a user.