• Convergence Security Journal
• /
• v.23 no.5
• /
• pp.65-72
• /
• 2023

This paper proposes a method for detecting malicious domains considering human habitual characteristics by building a Deep Learning model based on LSTM (Long Short-Term Memory). DGA (Domain Generation Algorithm) malicious domains exploit human habitual errors, resulting in severe security threats. The objective is to swiftly and accurately respond to changes in malicious domains and their evasion techniques through typosquatting to minimize security threats. The LSTM-based Deep Learning model automatically analyzes and categorizes generated domains as malicious or benign based on malware-specific features. As a result of evaluating the model's performance based on ROC curve and AUC accuracy, it demonstrated 99.21% superior detection accuracy. Not only can this model detect malicious domains in real-time, but it also holds potential applications across various cyber security domains. This paper proposes and explores a novel approach aimed at safeguarding users and fostering a secure cyber environment against cyber attacks.

• Journal of Digital Convergence
• /
• v.13 no.5
• /
• pp.213-218
• /
• 2015

In parallel with evolving information communication technology, M2M(Machine-to-Machine) industry has implemented multi-functional and high-performance systems, and made great strides with IoT(Internet of Things) and IoE(Internet of Everything). Authentication, confidentiality, anonymity, non-repudiation, data reliability, connectionless and traceability are prerequisites for communication security. Yet, the wireless transmission section in M2M communication is exposed to intruders' attacks. Any security issues attributable to M2M wireless communication protocols may lead to serious concerns including system faults, information leakage and privacy challenges. Therefore, mutual authentication and security are key components of protocol design. Recently, secure communication protocols have been regarded as highly important and explored as such. The present paper draws on hash function, random numbers, secret keys and session keys to design a secure communication protocol. Also, this paper tests the proposed protocol with a formal verification tool, Casper/FDR, to demonstrate its security against a range of intruders' attacks. In brief, the proposed protocol meets the security requirements, addressing the challenges without any problems.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.5
• /
• pp.1001-1010
• /
• 2021

Smart factories are complex systems which combine latest information technology (IT) with operation technology (OT). A smart factory aims to provide manufacturing capacity improvement, customized production, and resource reduction with these complex technologies. Although the smart factory is able to increase the efficiency through the technologies, the security level of the whole factory is low due to the vulnerability transfer from IT. In addition, the response and restoration of the business continuity plan are insufficient in case of damage due to the absence of factory security experts. The cope with the such problems, we propose an information security practice content for analyzing the damage by generating ransomware attacks in a digital twin-based smart factory similar to the real world. In our information security content, we introduce our conversion technique of physical devices into virtual machines or simulation models to build a practical environment for the digital twin. This content generates two types of the ransomware attacks according to a defined scenario in the digital twin. When the two generated attacks are successfully completed, at least 8 and 5 of the 23 virtual elements are take damage, respectively. Thus, our proposed content directly identifies the damage caused by the generation of two types of ransomware in the virtual world' smart factory.

• Journal of Convergence for Information Technology
• /
• v.11 no.5
• /
• pp.30-37
• /
• 2021

Various devices are connected to the Internet, and attacks using the Internet are occurring. Among such attacks, there are attacks that use malicious URLs to make users access to wrong phishing sites or distribute malicious viruses. Therefore, how to detect such malicious URL attacks is one of the important security issues. Among recent deep learning technologies, neural networks are showing good performance in image recognition, speech recognition, and pattern recognition. This neural network can be applied to research that analyzes and detects patterns of malicious URL characteristics. In this paper, performance analysis according to various parameters was performed on a method of detecting malicious URLs using neural networks. In this paper, malicious URL detection performance was analyzed while changing the activation function, learning rate, and neural network structure. The experimental data was crawled by Alexa top 1 million and Whois to build the data, and the machine learning library used TensorFlow. As a result of the experiment, when the number of layers is 4, the learning rate is 0.005, and the number of nodes in each layer is 100, the accuracy of 97.8% and the f1 score of 92.94% are obtained.

• The Journal of the Korea Contents Association
• /
• v.11 no.8
• /
• pp.221-230
• /
• 2011

The purpose of this study was to examine validity of the Korean-Child Behavior Checklist: K-CBCL) as measures for emotional and behavioral problems for use with children with autism spectrum disorders. In present study, the factor of the K-CBCL was investigated, using data of 248 children with autism spectrum disorders, with 11.17 mean ages. The two factor model of Internalizing problems (Withdrawn, Somatic Complaints, Anxious/Depressed) and Externalizing problems (Delinquent Behavior, Aggressive Behavior) was investigated by the confirmatory factor analysis. The two factor model of K-CBCL was adequate for children with autism spectrum disorders. The inter-item consistency for the sub-factor of K-CBCL demonstrated on adequate reliability of the measure. Although the inter-item consistency of Withdraw, Social problems, Delinquent Behavior was not acceptable, the inter-item consistency of Internalizing, Externalizing and total problems were good. This results supported validity and reliability and suggested that K-CBCL is used to assess for emotional and behavioral problems in children with autism spectrum disorders.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2021.10a
• /
• pp.443-444
• /
• 2021

Security threats to information services are increasingly being developed, and the frequency and damage caused by security threats are also increasing. In particular, security threats occurring inside the organization are increasing significantly, and the size of the damage is also large. A zero trust model has been proposed as a way to improve such a security environment. In the zero trust model, a subject who has access to information resources is regarded as a malicious attacker. Subjects can access information resources after verification through identification and authentication processes. However, the initially proposed zero trust model basically focuses on the network and does not consider the security environment for systems or data. In this study, we proposed a zero trust-based access control mechanism that extends the existing zero trust model to the file system. As a result of the study, it was confirmed that the proposed file access control mechanism can be applied to implement the zero trust model.

• The Journal of the Korea Contents Association
• /
• v.20 no.11
• /
• pp.301-313
• /
• 2020

This study is a study on the interlocking method between emergency preparedness simulation model and military exercise war game model. The national emergency preparedness government exercises are being carried out by a message exercise and technology development for simulation models is being carried out to create a situation similar to the actual practice. In order to create a situation similar to the actual war, the military situation must be reflected and to do so, a link with the military exercise war game model is needed. The military exercise war game model applies HLA/RTI, which is a standardized interlocking method for various models such as Taegeuk JOS, and it is necessary to apply HLA/RTI linkage method to link with these military exercise war game models. In addition, since the emergency preparedness simulation model requires limited information such as enemy location and enemy attack situation on major facilities in the military exercise model, a method of interlocking that can select and link information is required. Therefore, in this study, the interlocking interface design plan is presented in order to selectively link the interlocking method and information between the emergency preparedness simulation model and the military exercise war game model. The main functions of interlocking interface include federation synchronization, storage and recovery, object management service, time management, and data filtering functions.

• Journal of the Korea Society of Computer and Information
• /
• v.28 no.10
• /
• pp.67-76
• /
• 2023

Although deep learning models are making innovative achievements in the field of computer vision, the problem of vulnerability to adversarial examples continues to be raised. Adversarial examples are attack methods that inject fine noise into images to induce misclassification, which can pose a serious threat to the application of deep learning models in the real world. In this paper, we propose a model that detects adversarial examples using differences in predictive values between edge-learned classification models and underlying classification models. The simple process of extracting the edges of the objects and reflecting them in learning can increase the robustness of the classification model, and economical and efficient detection is possible by detecting adversarial examples through differences in predictions between models. In our experiments, the general model showed accuracy of {49.9%, 29.84%, 18.46%, 4.95%, 3.36%} for adversarial examples (eps={0.02, 0.05, 0.1, 0.2, 0.3}), whereas the Canny edge model showed accuracy of {82.58%, 65.96%, 46.71%, 24.94%, 13.41%} and other edge models showed a similar level of accuracy also, indicating that the edge model was more robust against adversarial examples. In addition, adversarial example detection using differences in predictions between models revealed detection rates of {85.47%, 84.64%, 91.44%, 95.47%, and 87.61%} for each epsilon-specific adversarial example. It is expected that this study will contribute to improving the reliability of deep learning models in related research and application industries such as medical, autonomous driving, security, and national defense.

• The Journal of the Korea Contents Association
• /
• v.20 no.7
• /
• pp.618-628
• /
• 2020

The purpose of this paper is to propose a new security orchestration service model by combining various security solutions that have been introduced and operated individually as a basis for cyber security framework. At present, in order to respond to various and intelligent cyber attacks, various single security devices and SIEM and AI solutions that integrate and manage them have been built. In addition, a cyber security framework and a security control center were opened for systematic prevention and response. However, due to the document-oriented cybersecurity framework and limited security personnel, the reality is that it is difficult to escape from the control form of fragmentary infringement response of important detection events of TMS / IPS. To improve these problems, based on the model of this paper, select the targets to be protected through work characteristics and vulnerable asset identification, and then collect logs with SIEM. Based on asset information, we established proactive methods and three detection strategies through threat information. AI and SIEM are used to quickly determine whether an attack has occurred, and an automatic blocking function is linked to the firewall and IPS. In addition, through the automatic learning of TMS / IPS detection events through machine learning supervised learning, we improved the efficiency of control work and established a threat hunting work system centered on big data analysis through machine learning unsupervised learning results.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.40 no.8
• /
• pp.1551-1559
• /
• 2015

Recently, the performance of smart devices is almost similar to that of the existing PCs, thus the users of smart devices can perform similar works such as messengers, SNSs(Social Network Services), smart banking, etc. originally performed in PC environment using smart devices. Although the development of smart devices has led to positive impacts, it has caused negative changes such as an increase in security threat aimed at mobile environment. Specifically, the threats of mobile devices, such as leaking private information, generating unfair billing and performing DDoS(Distributed Denial of Service) attacks has continuously increased. Over 80% of the mobile devices use android platform, thus, the number of damage caused by mobile malware in android platform is also increasing. In this paper, we propose android based malware detection mechanism using time-series analysis, which is one of statistical-based detection methods.We use auto-regressive moving-average model which is extracting accurate predictive values based on existing data among time-series model. We also use fast and exact malware detection method by extracting possible malware data through Z-Score. We validate the proposed methods through the experiment results.