• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.18 no.4
• /
• pp.19-26
• /
• 2018

In recent years, the substantial increase in the population's average age leads to an exceeded number of older persons comparing with the number of any other age group. As a result, both industry and academia are focused on the development of several solutions aimed to guarantee a healthy and safe lifestyle to the elderly. Ambient Assisted Living (AAL) approach is the way to guarantee better life conditions for the aged and for monitoring their health conditions by the development of innovative technologies and services. AAL technologies can also provide more safety for the elderly, offering emergency response mechanisms, fall detection solutions, and video surveillance systems. Unfortunately, due to the sensitive nature of AAL data, AAL systems should satisfy security requirements such as integrity, confidentiality, availability, anonymity, and others. In this paper, we propose an adaptive authentication protocol for the AAL systems. The proposed authentication protocol not only supports several important security requirements needed by the AAL systems, but can also withstand various types of attacks. In addition, the security analysis results show that the proposed authentication protocol is more efficient and secure than the existing authentication protocols.

• KIPS Transactions on Software and Data Engineering
• /
• v.12 no.2
• /
• pp.99-110
• /
• 2023

This study proposed a classification of malicious network traffic using the cyber threat framework(Mitre ATT&CK) and machine learning to solve the real-time traffic detection problems faced by current security monitoring systems. We applied a network traffic dataset called UNSW-NB15 to the Mitre ATT&CK framework to transform the label and generate the final dataset through rare class processing. After learning several boosting-based ensemble models using the generated final dataset, we demonstrated how these ensemble models classify network traffic using various performance metrics. Based on the F-1 score, we showed that XGBoost with no rare class processing is the best in the multi-class traffic environment. We recognized that machine learning ensemble models through Mitre ATT&CK label conversion and oversampling processing have differences over existing studies, but have limitations due to (1) the inability to match perfectly when converting between existing datasets and Mitre ATT&CK labels and (2) the presence of excessive sparse classes. Nevertheless, Catboost with B-SMOTE achieved the classification accuracy of 0.9526, which is expected to be able to automatically detect normal/abnormal network traffic.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.34 no.4
• /
• pp.747-761
• /
• 2024

Recently, modern vehicles have been controlled by Electronic Control Units (ECUs), by which the safety and convenience of drivers are highly improved. It is known that a luxury vehicle has more than 100 ECUs to electronically control its function. However, the modern vehicles are getting targeted by cyber attacks because of this computer-based automotive system. To address the cyber attacks, automotive manufacturers have been developing some methods for securing their vehicles, such as automotive Intrusion Detection System (IDS). This development is only allowed to the automotive manufacturers because they have databases for their in-vehicle network (i.e., DBC Format File) which are highly confidential. This confidentiality poses a significant challenge to external researchers who attempt to conduct automotive security researches. To handle this restricted information, in this paper, we propose a method to partially understand the DBC Format File by analyzing in-vehicle network traffics. Our method is designed to analyze Controller Area Network (CAN) traffics so that checksum signals are identified in CAN Frame Data Field. Also, our method creates a Lookup Set by which a checksum signal is correctly estimated for a given message. We validate our method with the publicly accessible dataset as well as one from a real vehicle.

• Korean Security Journal
• /
• no.18
• /
• pp.169-190
• /
• 2009

Today, the rapid advance of scientific technologies has brought about fundamental changes to the types and levels of terrorism while the war against the world more than one thousand small and big terrorists and crime organizations has already begun. A method highly likely to be employed by terrorist groups that are using 21st Century state of the art technology is cyber terrorism. In many instances, things that you could only imagine in reality could be made possible in the cyber space. An easy example would be to randomly alter a letter in the blood type of a terrorism subject in the health care data system, which could inflict harm to subjects and impact the overturning of the opponent's system or regime. The CIH Virus Crisis which occurred on April 26, 1999 had significant implications in various aspects. A virus program made of just a few lines by Taiwanese college students without any specific objective ended up spreading widely throughout the Internet, causing damage to 30,000 PCs in Korea and over 2 billion won in monetary damages in repairs and data recovery. Despite of such risks of cyber terrorism, a great number of Korean sites are employing loose security measures. In fact, there are many cases where a company with millions of subscribers has very slackened security systems. A nationwide preparation for cyber terrorism is called for. In this context, this research will analyze the current status of Korea's cyber security systems and its laws from a policy perspective, and move on to propose improvement strategies. This research suggests the following solutions. First, the National Cyber Security Management Act should be passed to have its effectiveness as the national cyber security management regulation. With the Act's establishment, a more efficient and proactive response to cyber security management will be made possible within a nationwide cyber security framework, and define its relationship with other related laws. The newly passed National Cyber Security Management Act will eliminate inefficiencies that are caused by functional redundancies dispersed across individual sectors in current legislation. Second, to ensure efficient nationwide cyber security management, national cyber security standards and models should be proposed; while at the same time a national cyber security management organizational structure should be established to implement national cyber security policies at each government-agencies and social-components. The National Cyber Security Center must serve as the comprehensive collection, analysis and processing point for national cyber crisis related information, oversee each government agency, and build collaborative relations with the private sector. Also, national and comprehensive response system in which both the private and public sectors participate should be set up, for advance detection and prevention of cyber crisis risks and for a consolidated and timely response using national resources in times of crisis.

• Korean Security Journal
• /
• no.26
• /
• pp.29-58
• /
• 2011

Since 11 September 2001, warnings of risk in the nexus of terrorism and nuclear weapons and materials which poses one of the gravest threats to the international community have continued. The purpose of this study is to analyze the aim, principles, characteristics, activities, impediments to progress and developmental recommendation of the Global Initiative to Combat Nuclear Terrorism(GICNT). In addition, it suggests implications of the GICNT for the ROK policy. International community will need a comprehensive strategy with four key elements to accomplish the GICNT: (1) securing and reducing nuclear stockpiles around the world, (2) countering terrorist nuclear plots, (3) preventing and deterring state transfers of nuclear weapons or materials to terrorists, (4) interdicting nuclear smuggling. Moreover, other steps should be taken to build the needed sense of urgency, including: (1) analysis and assessment through joint threat briefing for real nuclear threat possibility, (2) nuclear terrorism exercises, (3) fast-paced nuclear security reviews, (4) realistic testing of nuclear security performance to defeat insider or outsider threats, (5) preparing shared database of threats and incidents. As for the ROK, main concerns are transfer of North Korea's nuclear weapons, materials and technology to international terror groups and attacks on nuclear facilities and uses of nuclear devices. As the 5th nuclear country, the ROK has strengthened systems of physical protection and nuclear counterterrorism based on the international conventions. In order to comprehensive and effective prevention of nuclear terrorism, the ROK has to strengthen nuclear detection instruments and mobile radiation monitoring system in airports, ports, road networks, and national critical infrastructures. Furthermore, it has to draw up effective crisis management manual and prepare nuclear counterterrorism exercises and operational postures. The fundamental key to the prevention, detection and response to nuclear terrorism which leads to catastrophic impacts is to establish not only domestic law, institution and systems, but also strengthen international cooperation.

• Korean Security Journal
• /
• no.24
• /
• pp.91-123
• /
• 2010

The threat factors available for occurrence given G20 Summit Meeting are expected leader terrorism, hostage terrorism, bomb terrorism, public facilities terrorism, and aircraft terrorism. As for the threat groups, which are expected in Korea, the North Korea, Islam extremist group, and the group such as NGO organization of being opposed to international meeting are regarded as having possibility of causing hazard. Thus, the purpose of this study is to suggest VIP Security-measure plans in the main site in preparation for G20 Summit Meeting. Accordingly, each country in the world is adopting 'the principle of Triple Ring' in common. Thus, it elicited a coping plan by 1st line(inner ring) 2nd line(middle ring) 3rd line(outer ring) based on this principle, and proposed even an opinion together that will need to be reflected in light of policy for the VIP security measures. In conclusion, as for the VIP Security-measure plans in the main site in preparation for G20 Summit Meeting, In the inner ring(safety sector), first, an intercepting measure needs to be devised for a spot of getting into and out of vehicles given the Straight Street. Second, the Walking Formation needs to be reinforced boldly in the exposed area. In the middle ring(security sector), first, the control plan needs to be devised by considering particularity of the main site. Second, there is necessity for adopting the efficient security badge operation plan that is included RFID function within security badge. In the outer ring(aid protective sector), first, there is necessity of preparing for several VIP terrorisms, of collecting information and intelligence, and of reinforcing the information collection system against terrorism under the cooperation with the overseas information agency. Second, the urgent measure training in time of emergency needs to be carried out toward security agent event manpower. Third, to maintain the certain pace in VIP motorcade, the efficient traffic control system needs to be operated. Finally, as for what will need to be reflected in light of policy for VIP security measures, first, there is necessity for allowing VIP residence to be efficiently dispersed to be distributed and controlled. Second, there is necessity for allowing impure element to misjudge or attack to be failed by utilizing diverse deception operations. Third, according to the reorganization in North Korea's Organization of the South Directed Operations, the powerful 'military-support measure' needs to be driven from this G20 Summit Meeting. For this, the necessity was proposed for further reinforcing the front back defense posture under the supervision of the Ministry of National Defense and for positively coping even with detecting and removing poison in preparation for CBR (chemical, biological, and radio-logical) terrorism.