• Journal of Korean Society of Transportation
• /
• v.36 no.1
• /
• pp.51-65
• /
• 2018

Intentional aggressive driving (IAD) is defined as a hazardous driving event that the aggressive driver intentionally threatens neighbor drivers with abrupt longitudinal and lateral maneuvering. This study developed a methodology for detecting IAD events based on the analysis of interactions between aggressive driver and normal driver. Three major aggressive events including rear-close following, side-close driving, and sudden deceleration were analyzed to develop the algorithm. Then, driving simulation experiments were conducted using a multi-agent driving simulator to obtain data to be used for the development of the detection algorithm. In order to detect the driver's intention to attack, a relative evaluation index (Erratic Driving Index, EDI) reflecting the driving pattern was derived. The derived IAD event detection algorithm utilizes both the existing absolute detection method and the relative detection method. It is expected that the proposed methodology can be effectively used for detecting IAD events in support of in-vehicle data recorder technology in practice.

• Journal of Digital Convergence
• /
• v.13 no.2
• /
• pp.177-183
• /
• 2015

Cross Site Scripting enables hackers to steal other user's information (such as cookie, session etc.) or to do abnormal functions automatically using vulnerability of web application. This attack patterns of Cross Site Scripting(XSS) can be divided into two types. One is Reflect XSS which can be executed in one request for HTTP and its reply, and the other is Stored XSS which attacks those many victim users whoever access to the page which accepted the payload transmitted. To correspond to these XSS attacks, some measures have been suggested. They are data validation for user input, output validation during HTML encoding procedures, and removal of possible risk injection point to prevent from trying to insert malicious code into web application. In this paper, the methods and procedures for these two types are explained and a penetration testing is done. With these suggestions, the attack by XSS could be understood and prepared by its countermeasures.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2016.05a
• /
• pp.309-312
• /
• 2016

Considering that interkorean relations got worse and worse recently, cyber terror of North Korea has seriously become a possibility. Therefore, DoS(Denial of Service), a typical way of cyber terror, is becoming a big issue. Consequently, people are growing more and more interested in information security. Internal DoS attacks, out of a variety of ways of Dos attacks, include disks and memories and shortages of process resources. PAM(Pluggable Authentication Module) is one of the ways of preventing internal DoS attacks in Linux system. This paper provides with a method to internally respond to dos attacks and efficiently prevent shortages of resources by utilizing PAM.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.29 no.4C
• /
• pp.559-569
• /
• 2004

It has become more difficult to correspond an cyber attack quickly as a pattern of attack becomes various and complex. And, current security mechanisms just have passive defense functionalities. In this paper, we propose new network security architecture to respond various cyber attacks rapidly and to chase and isolate the attackers through cooperation between security zones. The proposed architecture make possible to deal effectively with cyber attacks such as IP spoofing or DDoS(Distributed Denial of Service) using active packet technology including a mobile sensor on active network. Active Security Management System based on proposed security architecture consists of active security node and active security server in a security zone, and is designed to have more active correspondent than that of existing mechanisms. We implemented these mechanisms in Linux routers and experimented on a testbed to verify realization possibility of Active Security Management System. The experimentation results are analyzed.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.16 no.1
• /
• pp.115-122
• /
• 2006

The most methods for intrusion detection are based on the misuse detection which accumulates hewn intrusion information and makes a decision of an attack against any behavior data. However it is very difficult to detect a new or modified aoack with only the collected patterns of attack behaviors. Therefore, if considering that the method of anomaly behavior detection actually has a high false detection rate, a new approach is required for very huge intrusion patterns based on sequence. The approach can improve a possibility for intrusion detection of known attacks as well as modified and unknown attacks in addition to the similarity measurement of intrusion patterns. This paper proposes a method which applies the multiple sequence alignments technique to the similarity matching of the sequence based intrusion patterns. It enables the statistical analysis of sequence patterns and can be implemented easily. Also, the method reduces the number of detection alerts and false detection for attacks according to the changes of a sequence size.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.2
• /
• pp.119-129
• /
• 2011

TCP-related Flooding attacks still dominate Distributed Denial of Service Attack. It is a great challenge to accurately detect the TCP flood attack in hish speed network. In this paper, we propose the NIC_Cookie logic implementation, which is a kind of security offload engine against TCP-related DDoS attacks, on network interface card. NIC_Cookie has robustness against DDoS attack itself and it is independent on server OS and external network configuration. It supports not IP-based response method but packet-level response, therefore it can handle attacks of NAT-based user group. We evaluate that the latency time of NIC_Cookie logics is $7{\times}10^{-6}$ seconds and we show 2Gbps wire-speed performance through a benchmark test.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.6
• /
• pp.1021-1031
• /
• 2023

State-sponsored cyber attacks are highly impactful because they are carried out to achieve pre-planned goals. As a defender, it is difficult to respond to them because of the large scale of the attack and the possibility that unknown vulnerabilities may be exploited. In addition, overreacting can reduce the availability of users and cause business disruption. Therefore, there is a need for a response policy that can effectively defend against attacks while ensuring user availability. To solve this problem, this paper proposes a method to collect the number of processes and sessions of defense assets in real time and use them for learning. Using this method to learn reinforcement learning-based policies on a cyber attack simulator, the attack duration based on 100 time-steps was reduced by 27.9 time-steps and 3.1 time-steps for two attacker models, respectively, and the number of "restore" actions that impede user availability during the defense process was also reduced, resulting in an overall better policy.

• Proceedings of the Korea Information Assurance Society Conference
• /
• 2004.05a
• /
• pp.161-165
• /
• 2004

기업 네트워크 환경 및 인터넷 상에서 발생할 수 있는 보안상의 취약점들은 악의를 가진 내외부의 공격자들에게 악용될 가능성이 있다. 이러한 상황은 기업으로 하여금 정보 자산의 유출 및 파괴 등의 물리적인 피해와 더불어 복구를 위한 인력 및 시간의 소요 등 금전적인 손해를 야기시킨다. 이에 정확한 네트워크 보안 위험을 분석하여 이러한 피해의 가능성을 사전에 파악하고, 예방할 수 있는 방안을 마련하여 최대한의 보안성을 확보하여야 한다. 본 고는 이를 해결하기 위한 네트워크의 보안 수준을 측정하고 분석할 수 있는 방법론을 살펴보고, 적절한 평가 절차 및 평가 수행 방법, 점검 항목을 해외이 대표사례와 국내 업체의 위험 분석 방법론 관하여 살펴본다.

• Review of KIISC
• /
• v.24 no.1
• /
• pp.65-74
• /
• 2014

최근 네트워크 시장의 큰 화두가 되고있는 SDN(Software-Defined Network)은 OpenFlow를 활용한 차세대 네트워크 기술로 각광받고 있다. 아직까지의 SDN은 초기단계에 이르고 있으나 현재의 네트워크 산업이 가지는 한계점을 근본적으로 변화시킬 수 있는 기술로 상당한 잠재력이 내재되어 있다. 특히 SDN 기술을 보안 측면에서 이용하게 되면, 기존의 IDS/IPS 제품의 대응 범위를 게이트웨이에서 엔드 포인트까지의 인프라 전반으로 확장시킬 수 있다. 또한 유연한 트래픽 경로 재설정을 통한 DoS나 DDoS 공격에도 효과적으로 대비할 수 있다. 이에 따라 OpenFlow 및 SDN의 기술 분석과 보안 측면에서의 이용 가능성에 대해 기술하고자 한다.

• Review of KIISC
• /
• v.20 no.6
• /
• pp.7-16
• /
• 2010

인터넷 및 통신 기술의 발전은 사용자로 하여금 금융, 방송, 게임 등의 온라인 서비스 제공에 대한 시간 및 공간적 제한을 없애 주였지만, 다른 한편으로는 해커 등의 악의적 사용자로 인한 피해 가능성도 높이고 있다. 이를 해결하기 위한 다양한 보안 기법 가운데 하나가 OTP를 이용한 사용자 인증 방법이다. OTP는 재사용하지 않는 패스워드로서 기존 패스워드 인증 방식이 갖는 취약점을 해결할 수 있는 방식이다. 하지만 OTP 생성 단말의 도난이나 서버 해킹으로 인한 패스워드 추측공격 또는 Stolen verifier 공격 등에 취약할 수 있다. 본 논문에서는 위와 같은 문제점을 해결하기 위해서 두 가지 인증 정보 즉, 시간 기반 OTP 생성방식인 TOTP 및 패스워드를 이용하는 새로운 Two-Factor 인증 프로토콜인 POTP(Password embedded OTP)를 제안한다. 제안한 방식은 재전송 공격에 안전하며, 공격자가 OTP 생성용 디바이스를 획득하더라도 패스워드를 유추할 수 없고 서버의 인증 정보 데이터베이스를 획득하더라도 정상적인 사용자로 위장할 수 함께, 서버에서 인증 정보 보관시 연산 속도가 빠른 해쉬 함수를 이용할 수 있어 보다 효율적이다.