• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.21 no.4
• /
• pp.15-23
• /
• 2021

In most hacking attacks, hackers intrudes inside for a long period of time and attempts to communicate with the outside using a circumvent connection to achieve purpose. research in response to advanced and intelligent cyber threats has been mainly conducted with signature-based detection and blocking methods, but recently it has been extended to threat hunting methods. attacks from organized hacking groups are advanced persistent attacks over a long period of time, and bypass remote attacks account for the majority. however, even in the intrusion detection system using intelligent recognition technology, it only shows detection performance of the existing intrusion status. therefore, countermeasures against targeted bypass rwjqthrwkemote attacks still have limitations with existing detection methods and threat hunting methods. in this paper, to overcome theses limitations, we propose a model that can detect the targeted circumvent connection remote attack threat of an organized hacking group. this model designed a threat hunting process model that applied the method of verifying the origin IP of the remote circumvent connection, and verified the effectiveness by implementing the proposed method in actual defense information system environment.

• The Journal of Korea Institute of Information, Electronics, and Communication Technology
• /
• v.15 no.1
• /
• pp.27-35
• /
• 2022

In this paper we propose white noise adding method to prevent missclassification of deep learning system by adversarial attacks. The proposed method is that adding white noise to input image that is benign or adversarial example. The experimental results are showing that the proposed method is robustness to 3 adversarial attacks such as FGSM attack, BIN attack and CW attack. The recognition accuracies of Resnet model with 18, 34, 50 and 101 layers are enhanced when white noise is added to test data set while it does not affect to classification of benign test dataset. The proposed model is applicable to defense to adversarial attacks and replace to time- consuming and high expensive defense method against adversarial attacks such as adversarial training method and deep learning replacing method.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.34 no.3
• /
• pp.451-461
• /
• 2024

Recently, various AI chatbots based on large language models have been released. Chatbots have the advantage of providing users with quick and easy information through interactive prompts, making them useful in various fields such as question answering, writing, and programming. However, a vulnerability in chatbots called "prompt injection attacks" has been proposed. This attack involves injecting instructions into the chatbot to violate predefined guidelines. Such attacks can be critical as they may lead to the leakage of confidential information within large language models or trigger other malicious activities. However, the vulnerability of Korean prompts has not been adequately validated. Therefore, in this paper, we aim to generate malicious Korean prompts and perform attacks on the popular chatbot to analyze their feasibility. To achieve this, we propose a system that automatically generates malicious Korean prompts by analyzing existing prompt injection attacks. Specifically, we focus on generating malicious prompts that induce harmful expressions from large language models and validate their effectiveness in practice.

• Annual Conference of KIPS
• /
• 2012.11a
• /
• pp.881-883
• /
• 2012

최근 정보통신 기술의 발전으로 국가 주요 핵심 기반시설(Critical Infrastructure)의 제어시스템에 대한 개방형 프로토콜 적용 및 외부 시스템과의 연계 등이 점차 증가되고 일반화됨에 따라 국가 핵심 기반시설이 사이버 침해 및 공격에 따른 위협에 노출되고 있다. 특히 기존의 보안기술은 알려진 공격(well-known attack)에만 대응하도록 설계되었기 때문에 공격패턴이 알려지지 않은 신종 공격이 국가 주요 핵심 기반시설을 공격하면 막대한 피해가 불가피하다. 본 논문에서는 최근 IT분야의 화두로 떠오르고 있는 가상화(Virtualization)기술을 적용하여 기존 허니넷 시스템의 장점을 유지하면서 허니넷 시스템의 자원문제, 구축 및 운영관리 문제를 줄일 수 있는 가상 허니넷 모델을 제시하였다. 또한 공격의도 확인기반의 데이터 분석 및 수집기법, 포커스 지향 분석기법을 제시를 통해 분석 결 도출에 필요한 시간비용을 최소화하는 방안을 제안하였다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2004.10a
• /
• pp.469-471
• /
• 2004

오늘날, 가용성과 중단 없는 서비스 제공에 대한 관심 고조, 개방화되는 시스템, 중앙 집중적 단일화된 관리와 통제 적용의 어려움으로 시스템이 주어진 임무를 수행해 나갈 수 있는 능력인 생존성이 요구되고 있다. 정보통신기반의 생존성을 평가하기 위해서는 평가 방법론을 정의해야하고 이를 뒷받침해주는 기술적인 연구가 수행되어야한다. 특히, 복잡 다양한 시스템들로 구성된 현재의 정보통신기반 네트워크의 특성과 실제 공격을 통해 테스트하기 어려운 현실을 감안하여, 시뮬레이션 기법을 사용한 생존성 평가기술이 연구되고 있다. 보안 시뮬레이션은 공격자, 네트워크 모델, 성능평가 모델, 원인.결과 모델들로 이루어져 있으며 이 중 원인.결과 모델이란 모델들 자체의 동적 정보이며 모델들간을 이어주는 관계 데이터이다. 본 논문에서는 원인-결과 모델링을 위해 단위 취약점(Atomic Vulnerability)을 이용한 취약점 분석 방법을 제안하고 이를 토대로 한 시뮬레이션용 취약성 데이터베이스인 VDBFS의 구축과정과 결과를 소개한다.

• Annual Conference of KIPS
• /
• 2018.05a
• /
• pp.145-148
• /
• 2018

클라우드 컴퓨팅 기반 사물인터넷 환경은 급격히 증가하는 통신량, 기종 간 이질성, 지연 시간과 같은 문제점으로 인해 어려움을 겪고 있다. 이를 해결하기 위한 대표적인 방법 중 하나는 분산 모델을 통해 클라우드 컴퓨팅 환경에 집중된 네트워크 또는 컴퓨팅 파워를 분산시키는 포그 컴퓨팅 (Fog Computing) 또는 에지 컴퓨팅 (Edge Computing)을 활용하는 것이다. 그러나 이 분산형 네트워크의 단점을 보완하기 위해 사물인터넷 (IoT, Internet of Things)과 가장 가까이 존재하는 네트워크 모델로써 미스트 컴퓨팅 (Mist Computing)이 탄생하였다. 그러나 다양한 프로토콜에 의해 통신이 이루어지는 사물인터넷 환경에는 수천 가지 제로데이 공격이 존재한다. 이 공격들의 대부분은 이전에 알려진 공격의 작은 변형체이다. 이러한 공격을 효과적으로 막기 위해 사물인터넷 환경에서의 침입 탐지 시스템은 지능적이어야 한다. 따라서 본 논문에서는, 미스트 컴퓨팅 환경에서 새로운 또는 지속적으로 변화하는 사물인터넷 대상 공격을 효과적으로 방어하기 위한 인공지능 기반 침입 탐지 시스템을 제안한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.4
• /
• pp.617-628
• /
• 2022

Ascon is one of the final round candidates of the NIST lightweight cryptography contest, which has been underway since 2015, and supports hash modes Ascon-Hash and Ascon-Xof. In this paper, we develop a MILP model for collision attack on the Ascon-Hash and search for a differential trail that can be used in a quantum setting through the model. In addition, we present an algorithm that allows an attacker who can use a quantum computer to find a quantum free-start collision attack of 3-round Ascon-Hash using the discovered differential trail. This attack is meaningful in that it is the first to analyze a collision attack on Ascon-Hash in a quantum setting.

• Korean Journal of Social Welfare
• /
• v.62 no.2
• /
• pp.161-185
• /
• 2010

The purpose of this study is to verify the causal relationship between depression and aggressiveness among adolescents. The 4-year longitudinal data collected from 2,670 4th grade elementary school students by the Korean Youth Panel study was used in this study. From the analysis result using the Autoregressive Cross-Lagged Model, the depression and aggressiveness in adolescents were continued from elementary school 4th grade to middle school 7th grade in significant stability. In addition, the previous aggressiveness turned out to have significant positive effect on the later period depression. Similarly, the previous depression had significant effect on the later aggressiveness, but the direction was negative. This means that the adolescents's depression increases as their aggressiveness increases, but as the depression increases, the later aggressiveness of the adolescents decreases. There were no differences between girls and boys within the relationship of these two variables. Finally, the implication derived from the results, the limitation of this study, and suggestion for following studies were presented.

• KIPS Transactions on Computer and Communication Systems
• /
• v.4 no.10
• /
• pp.349-360
• /
• 2015

In recent year, phishing attacks are flooding with services based on the web technology. Phishing is affecting online security significantly day by day with the vulnerability of web pages. To prevent phishing attacks, a lot of anti-phishing techniques has been made with their own advantages and dis-advantages respectively, but the phishing attack has not been eradicated completely yet. In this paper, we have studied phishing in detail and categorize a process of phishing attack in two parts - Landing-phase, Attack-phase. In addition, we propose an phishing detection methodology based on web sites heuristic. To extract web sites features, we focus on URL and source codes of web sites. To evaluate performance of the suggested method, set up an experiment and analyze its results. Our methodology indicates the detection accuracy of 98.9% with random forest algorithm. The evaluation of proof-of-concept reveals that web site features can be used for phishing detection.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.5
• /
• pp.997-1006
• /
• 2019

To overcome the difficulties and inefficiencies of the existing power analysis attack, we try to extract the secret key embedded in a cryptographic device using attack model based on MLP(Multi-Layer Perceptron) method. The target of our proposed power analysis attack is the AES-128 encryption module implemented on an 8-bit processor XMEGA128. We use the divide-and-conquer method in bytes to recover the whole 16 bytes secret key. As a result, the MLP-based power analysis attack can extract the secret key with the accuracy of 89.51%. Additionally, this MLP model has the 94.51% accuracy when the pre-processing method on power traces is applied. Compared to the machine leaning-based model SVM(Support Vector Machine), we show that the MLP can be a outstanding method in power analysis attacks due to excellent ability for feature extraction.