• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.4
• /
• pp.785-794
• /
• 2019

Recently Deep Learning technology, one of the fourth industrial revolution technologies, is used to identify the hidden meaning of network data that is difficult to detect in the security arena and to predict attacks. Property and quality analysis of data sources are required before selecting the deep learning algorithm to be used for intrusion detection. This is because it affects the detection method depending on the contamination of the data used for learning. Therefore, the characteristics of the data should be identified and the characteristics selected. In this paper, the characteristics of malware were analyzed using network data set and the effect of each feature on performance was analyzed when the deep learning model was applied. The traffic classification experiment was conducted on the comparison of characteristics according to network characteristics and 96.52% accuracy was classified based on the selected characteristics.

• Proceedings of the Korean Information Science Society Conference
• /
• 2004.10a
• /
• pp.463-465
• /
• 2004

최근 기업이나 국가 기관의 다양한 서비스 제공 요구와 함께 웹 서비스의 유용성과 용이성이 맞물려 웹 서비스 사용량은 꾸준히 증가하고 있으며, 웹 서비스 보안의 필요성은 매우 높아졌다. 그러나 다른 인터넷 서비스들에 비해 웹 서비스에 대한 보안은 연구 부족으로 인하여 기술적 수준이 낮으며, 오히려 웹 서비스에 특화된 보안 기술과 도구의 부족으로 인하여 웹 공격의 빈도와 피해는 점점 증가하고 있는 추세이다. 웹 서비스를 효과적으로 보호하기 위해서는 웹 서비스에 특화된 침입 탐지 기술이 필요하며, 이를 평가하기 위한 웹 IDS 평가 환경과 평가 기준이 필요하다. 본 연구에서는 웹 IDS 평가를 위한 평가 기준과 테스트 환경 설계에 대해서 알아보고자 한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2021.11a
• /
• pp.687-689
• /
• 2021

정맥을 이용한 생체 인식 방법은 신체의 노화에 영향을 받지 않고 높은 사용 편의성과 변조의 위험이 적어 인증 수단으로 폭넓게 활용되고 있다. 그러나 가짜 정맥 영상을 통한 스푸핑 공격 위험이 존재한다. 이러한 문제를 해결하기 위해 실제 정맥 영상과 가짜 정맥 영상을 구분하는 기술이 필요하다. 본 연구에서는 실제 정맥 데이터의 마디와 뼈의 밝기 차이를 이용해 진짜 정맥 영상과 가짜 정맥 영상을 구분하는 기술을 연구했다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2024.05a
• /
• pp.902-904
• /
• 2024

엣지-클라우드 통신네트워크에서의 지속 가능한 사이버 보안 솔루션을 개발하기 위한 연구는 중요성을 갖는다. 최근의 기술 발전으로 인해 엣지 디바이스와 클라우드 서비스 간의 통신이 활발해지면서 보안 위협이 증가하고 있다. 이에 따라 연합 강화 학습과 같은 첨단 기술을 활용하여 보안 취약점을 탐지하고 대응하는 것이 중요하다. 본 논문에서는 엣지-클라우드 환경에서의 보안 취약점을 식별하고 대응하기 위해 연합 강화 학습을 기반으로 한 솔루션을 제안한다. 이를 통해 네트워크의 안전성을 보장하고 사이버 공격에 대응할 수 있는 기술을 개발하기 위해, 엣지-클라우드 환경에서의 보안 취약점을 식별하고 대응하기 위해 연합 강화 학습 기반으로 한 솔루션을 소개한다.

• Smart Media Journal
• /
• v.13 no.6
• /
• pp.9-15
• /
• 2024

In recent trends, there has been an increase in 'Qshing' attacks, a hybrid form of phishing that exploits fake QR (Quick Response) codes impersonating government agencies to steal personal and financial information. Particularly, this attack method is characterized by its stealthiness, as victims can be redirected to phishing pages or led to download malicious software simply by scanning a QR code, making it difficult for them to realize they have been targeted. In this paper, we have developed a classification technique utilizing machine learning algorithms to identify the maliciousness of URLs embedded in QR codes, and we have explored ways to integrate this with existing QR code readers. To this end, we constructed a dataset from 128,587 malicious URLs and 428,102 benign URLs, extracting 35 different features such as protocol and parameters, and used AutoML to identify the optimal algorithm and hyperparameters, achieving an accuracy of approximately 87.37%. Following this, we designed the integration of the trained classification model with existing QR code readers to implement a service capable of countering Qshing attacks. In conclusion, our findings confirm that deriving an optimized algorithm for classifying malicious URLs in QR codes and integrating it with existing QR code readers presents a viable solution to combat Qshing attacks.

• Convergence Security Journal
• /
• v.15 no.4
• /
• pp.35-41
• /
• 2015

Internet of Things has a wide range of vulnerabilities are exposed to information security threats. However, this does not deal with the basic solution, the vaccine does not secure encryption for the data transmission. The encryption and authentication message transmitted from one node to the construction of the secure wireless sensor networks is required. In order to satisfy the constraint, and security requirements of the sensor network, lightweight encryption and authentication technologies, the light key management technology for the sensor environment it is required. Mandatory sensor network security technology, privacy protection technology subchannel attack prevention, and technology. In order to establish a secure wireless sensor networks encrypt messages sent between the nodes and it is important to authenticate. Lightweight it shall apply the intrusion detection mechanism functions to securely detect the presence of the node on the network. From the sensor node is not involved will determine the authenticity of the terminal authentication technologies, there is a need for a system. Network security technology in an Internet environment objects is a technique for enhancing the security of communication channel between the devices and the sensor to be the center.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.18 no.6
• /
• pp.627-635
• /
• 2017

Modern warfare is gradually changing into a network war, and information electronic warfare is also progressing. In modern war, electronic warfare is all military activity concerned with electromagnetic field use, such as signal collecting, communication monitoring, information analysis, and electronic attack. The one key function of signal collecting for enemy signal analysis, direction finding, collects the signal radiated from enemy area and then calculates the enemy direction. This paper examined the Watson-Watt algorithm for an amplitude direction finding system and CVDF algorithm for phase direction finding system and analyzed the difference in the direction finding accuracy between in the clean electromagnetic field environment and in the real operating field environment of electronic warfare system. In the real field, the direction finding accuracy was affected by the reflected field from the surrounding obstacles. Therefore, this paper proposesan enhanced direction finding process for reducing the effect. The result of direction finding by applying the proposed process was enhanced above $1.24^{\circ}$ compared to the result for the existing process.

• KIISE Transactions on Computing Practices
• /
• v.24 no.2
• /
• pp.99-104
• /
• 2018

Recently, there are increasing damages by ransomware in the world. Ransomware is a malicious software that infects computer systems and restricts user's access to them by locking the system or encrypting user's files saved in the hard drive. Victims are forced to pay the 'ransom' to recover from the damage and regain access to their personal files. Strong countermeasure is needed due to the extremely vicious way of attack with enormous damage. Malware analysis method can be divided into two approaches: static analysis and dynamic analysis. Recent malwares are usually equipped with elaborate packing techniques which are main obstacles for static analysis of malware. Therefore, this paper suggests a dynamic analysis method to monitor activities of ransomware. The proposed method can analyze ransomwares more accurately. The suggested method is comprised of extracting signatures of benign program, malware, and ransomware, and selecting the most appropriate signatures for ransomware detection.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.6
• /
• pp.1157-1167
• /
• 2013

The development of electronic devices has recently led to many problems such as personal information rape and leakage of business information. Conventional loud-speakers have been generally used to output devices. It can be, however, operated as a micro-phone which was abused as a means for eavesdropping since the speaker and microphone have basically the equivalent structure. Most importantly, the general peoples are not aware of the approaching danger about using speaker as microphone. And, traditional eavesdropping detection equipment does not check the attack. In this paper, we demonstrate that there is a serious danger and vulnerability in using loud-speakers since they can be used as eavesdropping devices.

• Smart Media Journal
• /
• v.8 no.1
• /
• pp.19-26
• /
• 2019

At the opening ceremony of 2018 Winter Olympics in PyeongChang, an unknown cyber-attack occurred. The malicious code used in the attack is based on in-memory malware, which differs from other malicious code in its concealed location and is spreading rapidly to be found in more than 140 banks, telecommunications and government agencies. In-memory malware accounts for more than 15% of all malicious codes, and it does not store its own information in a non-volatile storage device such as a disk but resides in a RAM, a volatile storage device and penetrates into well-known processes (explorer.exe, iexplore.exe, javaw.exe). Such characteristics make it difficult to analyze it. The most recently released in-memory malicious code bypasses the endpoint protection and detection tools and hides from the user recognition. In this paper, we propose a method to efficiently extract the payload by unpacking injection through IDA Pro debugger for Dorkbot and Erger, which are in-memory malicious codes.