• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2015.05a
• /
• pp.706-707
• /
• 2015

최근 인터넷 사용이 급증함에 따라 통신망을 통한 악성코드의 감염 경로가 다양해지고 있다. 특히, 봇(Bot)에 의한 공격은 주로 C&C(command-and-control)서버에서 이루어지는데, C&C서버가 IP 형태로 운영되므로 IP를 차단하는 방식을 통해 보안을 유지할 수밖에 없었다. 그러나 공격자들 역시 이러한 서버 차단을 회피하기 위해 우회적인 방법으로 접속을 시도하는 등 차츰 지능화되고 있다. 이러한 악성코드는 사용자의 시스템에 침입하면, 실행이 되는 동안 일반적인 검출방법으로는 검출해 내기가 쉽지 않다. 따라서 본 논문에서는 악성코드 감염에 의한 피해 확산을 방지하기 위해 보안에 이전트 기반의 악성프로세스 검출시스템 모델을 제시하고자 한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.5
• /
• pp.873-883
• /
• 2013

Security vulnerability quantification is the method that identify potential vulnerabilities by scoring vulnerabilities themselves and their countermeasures. However, due to the structural feature of smart grid system, it is difficult to apply existing security threat evaluation schemes. In this paper, we propose a network model to evaluate smartgrid security threat for AMI and derive attack scenarios. Additionally, we show that the result of security threat evaluation for proposed network model and attack scenario by applying MTTC scheme.

• Proceedings of the Korea Society for Simulation Conference
• /
• 2001.05a
• /
• pp.72-76
• /
• 2001

인터넷이 생활의 중요한 요소로 자리잡기 시작하면서 네트워크의 침해 사고가 급증하고 있는 현실이다. 이러한 침해 사고를 예방하기 위해 침입 탐지 시스템(IDS)과 방화벽(Firewall)이 많이 사용되고 있다. 방화벽과 침입 탐지 시스템은 연동은 서로의 단점을 보완하여 더 강력하게 네트워크를 보호할 수 있다. 방화벽과 침입 탐지 시스템을 위한 시뮬레이션 모델은 DEVS (Discrete Event system Specification) 방법론을 사용하여 구성하였다. 본 논문에서는 실제 침입 데이터를 발생시켜 실제 침입에 가까운 상황 가운데 침입 행위를 판별하도록 구성하였다. 이렇게 구성된 시뮬레이션 모델을 사용하여 침입탐지 시스템의 핵심 요소인 침입 판별이 효과적으로 수행되는지를 시뮬레이션 할 수 있다. 현재의 침입은 광범위해지고, 복잡하게 되어 한 침입 탐지 시스템이 독립적으로 네트워크의 침입을 판단하기 어렵게 되었다. 이를 위해 네트워크 내에 여러 침입 탐지 시스템 에이전트를 배치하였고, 에이전트들이 서로 정보를 공유함으로써 공격에 효과적으로 대응할 수 있도록 하였다. 침입 탐지 시스템이 서로 협력하여 침입을 탐지하고, 이런 정보를 침입 차단 시스템에게 넘겨주게 된다. 이와 같은 구성을 통해서 공격자로부터 발생된 패킷이 네트워크 내로 들어오는 것을 원천적으로 막을 수 있도록 하였다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2002.10c
• /
• pp.460-462
• /
• 2002

시스템 침입은 정보통신기술의 비약적인 발전에 따른 정보화의 역기능으로, 이론 해결하기 위한 다양한 방법들이 제안되어 왔다. 그러나 최근 침입 패러다임의 변화로 인해 기존 방법으로 해결하지 못하는 공격이 발생했으며, 그중 보안 시스템 우회나 보안 시스템 자체에 대한 공격은 기존 보안 도구를 무력화시킬 수도 있다. 본 논문에서는 이를 해결하기 위한 방법으로 고전적인 결함허용 기법을 응용한 결함허용 기능을 정의하고 이를 이용한 계층적 시스템 모델을 제안한다. 또한, 보안 시스템의 특성에 맞는 결함 허용 기능 선택을 위한 기준으로 비용 기반 선택 모델을 제안한다.

• Annual Conference of KIPS
• /
• 2023.11a
• /
• pp.220-228
• /
• 2023

사이버 공격과 위협은 예측 불가능한 수준으로 높아지고 있어 해킹 위협을 완벽히 차단하고 예방하는 것은 현실적으로 불가능하다. 따라서 사이버 공간의 공격이 발생했을 경우 신속한 대응 및 시스템의 생존성 보장을 위해서 사이버 복원력이 필요하다. 우리는 정부, 공공기관, 기업이 사이버 복원력개념을 도입하고 내재화를 위한 평가모델을 연구하였다.

• Convergence Security Journal
• /
• v.23 no.5
• /
• pp.101-106
• /
• 2023

Recently, cyberattacks are increasing in social engineering attacks using intelligent and continuous phishing sites and hacking techniques using malicious code. As personal security becomes important, there is a need for a method and a solution for determining whether a malicious URL exists using a web application. In this paper, we would like to find out each feature and limitation by comparing highly accurate techniques for detecting malicious URLs. Compared to classification algorithm models using features such as web flat panel DB and based URL detection sites, we propose an efficient URL anomaly detection technique.

• KIPS Transactions on Software and Data Engineering
• /
• v.10 no.7
• /
• pp.271-278
• /
• 2021

As the current cyber attacks become more intelligent, the existing Intrusion Detection System is difficult for detecting intelligent attacks that deviate from the existing stored patterns. In an attempt to solve this, a model of a deep learning-based intrusion detection system that analyzes the pattern of intelligent attacks through data learning has emerged. Intrusion detection systems are divided into host-based and network-based depending on the installation location. Unlike network-based intrusion detection systems, host-based intrusion detection systems have the disadvantage of having to observe the inside and outside of the system as a whole. However, it has the advantage of being able to detect intrusions that cannot be detected by a network-based intrusion detection system. Therefore, in this study, we conducted a study on a host-based intrusion detection system. In order to evaluate and improve the performance of the host-based intrusion detection system model, we used the host-based Leipzig Intrusion Detection-Data Set (LID-DS) published in 2018. In the performance evaluation of the model using that data set, in order to confirm the similarity of each data and reconstructed to identify whether it is normal data or abnormal data, 1D vector data is converted to 3D image data. Also, the deep learning model has the drawback of having to re-learn every time a new cyber attack method is seen. In other words, it is not efficient because it takes a long time to learn a large amount of data. To solve this problem, this paper proposes the Siamese Convolutional Neural Network (Siamese-CNN) to use the Few-Shot Learning method that shows excellent performance by learning the little amount of data. Siamese-CNN determines whether the attacks are of the same type by the similarity score of each sample of cyber attacks converted into images. The accuracy was calculated using Few-Shot Learning technique, and the performance of Vanilla Convolutional Neural Network (Vanilla-CNN) and Siamese-CNN was compared to confirm the performance of Siamese-CNN. As a result of measuring Accuracy, Precision, Recall and F1-Score index, it was confirmed that the recall of the Siamese-CNN model proposed in this study was increased by about 6% from the Vanilla-CNN model.

• Smart Media Journal
• /
• v.13 no.6
• /
• pp.9-15
• /
• 2024

In recent trends, there has been an increase in 'Qshing' attacks, a hybrid form of phishing that exploits fake QR (Quick Response) codes impersonating government agencies to steal personal and financial information. Particularly, this attack method is characterized by its stealthiness, as victims can be redirected to phishing pages or led to download malicious software simply by scanning a QR code, making it difficult for them to realize they have been targeted. In this paper, we have developed a classification technique utilizing machine learning algorithms to identify the maliciousness of URLs embedded in QR codes, and we have explored ways to integrate this with existing QR code readers. To this end, we constructed a dataset from 128,587 malicious URLs and 428,102 benign URLs, extracting 35 different features such as protocol and parameters, and used AutoML to identify the optimal algorithm and hyperparameters, achieving an accuracy of approximately 87.37%. Following this, we designed the integration of the trained classification model with existing QR code readers to implement a service capable of countering Qshing attacks. In conclusion, our findings confirm that deriving an optimized algorithm for classifying malicious URLs in QR codes and integrating it with existing QR code readers presents a viable solution to combat Qshing attacks.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.5
• /
• pp.1141-1151
• /
• 2018

In an APT attack, the communication stage between infected hosts and C&C(Command and Control) server is the key stage for intrusion into the attack target. Attackers can control multiple infected hosts by the C&C Server and direct intrusion and exploitation. If the C&C Server is exposed at this stage, the attack will fail. Therefore, in recent years, the Domain Generation Algorithm (DGA) has replaced DNS in C&C Server with a short time interval for making detection difficult. In particular, it is very difficult to verify and detect all the newly registered DNS more than 5 million times a day. To solve these problems, this paper proposes a model to judge DGA-DNS detection by the morphological similarity analysis of normal DNS and DGA-DNS, and to determine the sign of APT attack through it, then we verify its validity.

• Convergence Security Journal
• /
• v.11 no.6
• /
• pp.9-15
• /
• 2011

It is difficult to identify attack requests from normal ones when those attacks are based on CSRF which enables an attacker transmit fabricated requests of a trusted user to the website. For the protection against the CSRF, there have been a lot of research efforts including secret token, custom header, proxy, policy model, CAPTCHA, and user reauthentication. There remains, however, incapacitating means and CAPTCHA and user reauthentication incur user inconvenience. In this paper, we propose a method to detect CSRF attacks by analyzing the structure of websites and the usage patterns. Potential victim candidates are selected and website usage patterns according to the structure and usage logs are analyzed. CSRF attacks can be detected by identifying normal usage patterns. Also, the proposed method does not damage users' convenience not like CAPTCHA by requiring user intervention only in case of detecting abnormal requests.