• The Journal of the Korea institute of electronic communication sciences
• /
• v.8 no.9
• /
• pp.1313-1318
• /
• 2013

In order to actively respond to cyber attacks, not only the security systems such as IDS, IPS, and Firewalls, but also ESM, a system that detects cyber attacks by analyzing various log data, are preferably deployed. However, as the attacks be come more elaborate and advanced, existing signature-based detection methods start to face their limitations. In response to that, researches upon symptom detection technology based on attack modeling by employing big-data analysis technology are actively on-going. This symptom detection technology is effective when it can accurately extract features of attacks and manipulate them to successfully execute the attack modeling. We propose the ways to extract attack features which can play a role as the basis of the modeling and detect intelligent threats by carrying out scenario-based modeling.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2014.11a
• /
• pp.587-590
• /
• 2014

국가R&D사업 관리를 위해 17개 부처 청은 각각의 과제관리 대표전문기관을 지정하고 있으며, 16개 대표전문기관은 매년 국가R&D 과제를 발주하고 예산을 집행하며, 협약된 과제에 대한 성과를 관리하고 있다. 국가R&D 과제를 발주하기 위해 먼저 사업에 대한 공고를 시행하는데 대부분의 부처 및 대표전문기관은 온라인 시스템을 이용한다. 대표전문기관은 각각의 연구관리시스템을 운영하여 R&D과제 공고정보를 게제하고 연구자는 해당 시스템에 로그인하여 과제를 신청한다. 이 때 과제신청을 하고자하는 연구자는 원하는 공고정보를 찾고 과제를 신청하기 위해 산재된 연구관리시스템을 접근하여 원하는 정보를 탐색해야 하는 불편함이 존재한다. 본 논문에서는 범부처 국가R&D과제 공고정보를 통합적으로 제공하고, 산재된 연구관리시스템에 개별적으로 접근하지 않고도 과제신청을 효율적으로 수행할 수 있는 방안을 제시한다. 이기종간의 로그인 방안과 과제신청 프로세스, 신청된 관제정보를 효율적으로 관리, 제공하는 방법에 대해 논하며, 이는 국가R&D과제를 수행하고자 하는 연구자에게 과제 신청 방법의 효율성을 제공한다.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.23 no.3
• /
• pp.119-125
• /
• 2023

IT infrastructure operation has advanced, and the methods for managing systems have become widely adopted. Recently, research has focused on improving system management using Syslog. However, utilizing log data collected through these methods presents challenges, as logs are extracted in various formats that require expert analysis. This paper proposes a system that utilizes edge computing to distribute the collection of Syslog data and preprocesses duplicate data before storing it in a central database. Additionally, the system constructs a data dictionary to classify and count data in real-time, with restrictions on transmitting registered data to the central database. This approach ensures the maintenance of predefined patterns in the data dictionary, controls duplicate data and temporal duplicates, and enables the storage of refined data in the central database, thereby securing fundamental data for big data analysis. The proposed algorithms and procedures are demonstrated through simulations and examples. Real syslog data, including extracted examples, is used to accurately extract necessary information from log data and verify the successful execution of the classification and storage processes. This system can serve as an efficient solution for collecting and managing log data in edge environments, offering potential benefits in terms of technology diffusion.

• Proceedings of the Korean Society of Broadcast Engineers Conference
• /
• 2015.07a
• /
• pp.106-109
• /
• 2015

ICT 기술이 급속하게 발전함에 따라 수없이 많은 기술이 등장하고 정착되고 안정화되고 있는 상황에서 빅데이터 이슈는 매우 중요하다. 이러한 변화에 빠르게 대응하는 개인이나 기업에게 엄청난 새로운 기회와 부가가치 창출을 제공을 부여해 주고 있다. 현재 방송분야에서는 빅데이터 기술이 콘텐츠 서비스 분야에서 활발히 적용되고 있으며 그 영역이 점차 확대되고 있는 추세이다. 이에 본 논문은 디지털 방송 시스템을 구성하고 있는 다양한 기기에서 발생되는 장애나 이벤트를 빅데이터 분석을 통해 통합관제 모니터링, 통계 및 분석을 통하여 처리할 수 있는 시스템을 제안한다. 제안한 시스템은 방송 인프라 통합 관리, 실시간 이벤트 검색, 장애 분석 및 리포팅 기능을 제공함으로써 문제점을 신속히 파악하여 안정적인 방송 운영을 지원하도록 한다. 또한 각종 방송 장비들의 로그 정보를 수집하여 서비스 상태 및 작업 통계를 통한 시스템의 가용성을 평가할 수 있도록 한다.

• Review of KIISC
• /
• v.29 no.3
• /
• pp.6-13
• /
• 2019

최근 머신러닝 기술이 비약적으로 발전하고 있다. 하드웨어 성능이 향상되고 머신러닝 활용 도구가 오픈소스로 사용 편리하게 개발되어 대중화됨으로써 보안데이터 분석 분야에서도 머신러닝을 이용한 기술 개발이 활발히 진행되고 있다. 본 논문에서는 보안 분야의 악성코드 데이터와 보안관제 로그 데이터를 주요 대상으로 머신러닝 기술을 적용할 때 고려되어야 할 기술적 사항들과 최신 연구 동향, 데이터 셋 특징, 그리고 머신러닝 기반의 보안데이터 분석 기술의 기대 효과 및 현재 기술의 한계점 등을 다루도록 한다.

• The Journal of the Korea Contents Association
• /
• v.20 no.7
• /
• pp.618-628
• /
• 2020

The purpose of this paper is to propose a new security orchestration service model by combining various security solutions that have been introduced and operated individually as a basis for cyber security framework. At present, in order to respond to various and intelligent cyber attacks, various single security devices and SIEM and AI solutions that integrate and manage them have been built. In addition, a cyber security framework and a security control center were opened for systematic prevention and response. However, due to the document-oriented cybersecurity framework and limited security personnel, the reality is that it is difficult to escape from the control form of fragmentary infringement response of important detection events of TMS / IPS. To improve these problems, based on the model of this paper, select the targets to be protected through work characteristics and vulnerable asset identification, and then collect logs with SIEM. Based on asset information, we established proactive methods and three detection strategies through threat information. AI and SIEM are used to quickly determine whether an attack has occurred, and an automatic blocking function is linked to the firewall and IPS. In addition, through the automatic learning of TMS / IPS detection events through machine learning supervised learning, we improved the efficiency of control work and established a threat hunting work system centered on big data analysis through machine learning unsupervised learning results.

• Journal of Korea Multimedia Society
• /
• v.18 no.1
• /
• pp.42-51
• /
• 2015

In this paper, we analyze the quality status of Health and Welfare division's standardized log and asses the characteristics of the institutions' logs analysis to establish the criteria to minimize hazards and control the quality of log's institutional details to limit extraction. As a result, extraction condition's proposed development direction to adequately assess and control health and welfare abuses privacy control target log. This improvement over the status and quality of information shared with relation to institutional work of the log quality characteristics is made possible. In addition, quality control and inspection standards were prepared in accordance with the institutional log characteristics. Future research will include performing continuous analysis and improvement activities on the quality of logs with integrated control of sharing personal information and distributing information about logs' quality to proactively target organ. Therefore, we expect that correcting proactive personal information misuse and leakage is possible to achieve.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2021.05a
• /
• pp.638-640
• /
• 2021

The network separation environment is a network security design system that separates the internal business network from the external Internet network. It separates the internal business network from the external Internet by separating it into a business network that is not connected to the network to which the Internet is connected. The network is separated, and it is a relatively secure network structure compared to Danilman in terms of security. However, there are frequent cases of infecting internal networks by using vulnerabilities in internal systems, network devices, and security devices. In this paper, we analyze the vulnerability of IT security threats in such a network isolation environment and provide technical measures for effective security monitoring.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.2
• /
• pp.471-484
• /
• 2018

Recently, cyber threats are frequently occurring in ICS(industrial control systems) of government agencies, infrastructure, and manufacturing companies. In order to cope with such cyber threats, it is necessary to apply CTI to ICS. For this purpose, a security information collection system is needed. However, it is difficult to install security solution in control devices such as PLC. Therefor, it is difficult to collect security information of ICS. In addition, there is a problem that the security information format generated in various assets is different. Therefore, in this paper, we propose an efficient method to collect ICS security information. We utilize CybOX/STIX/TAXII CTI models that are easy to apply to ICS. Using this model, we designed the formats to collect security information of ICS assets. We created formats for system logs, IDS logs, and EWS application logs of ICS assets using Windows and Linux. In addition, we designed and implemented a security information collection system that reflects the designed formats. This system can be used to apply monitoring system and CTI to future ICS.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.4
• /
• pp.961-974
• /
• 2015

With the advancement of SIEM from ESM, it allows deep correlated analysis using huge amount of data. By collecting software's vulnerabilities from assessment with certain classification measures (e.g., CWE), it can improve detection rate effectively, and respond to software's vulnerabilities by analyzing big data. In the phase of monitoring and vulnerability diagnosis Process, it not only detects predefined threats, but also vulnerabilities of software in each resources could promptly be applied by sharing CCE, CPE, CVE and CVSS information. This abstract proposes a model for effective detection and response of software vulnerabilities and describes effective outcomes of the model application.