• Review of KIISC
• /
• v.25 no.3
• /
• pp.5-10
• /
• 2015

스마트그리드(Smartgrid) 시대의 도래 및 제어시스템으로의 IIoT(Industrial Internet of Things) 기술 도입으로 외부 인터넷망과의 접점이 증가하면서 스마트그리드 제어시스템을 대상으로 하는 사이버위협이 증가하고 있는 추세이며, 그에 대한 피해 사례가 지속적으로 보고되고 있다. 또한 스마트그리드 제어시스템에 HCI(Human-Computer Interaction) 기술이 악의적인 내부 공격자는 전문적인 지식이 없더라도 비교적 쉽게 제어시스템을 조작 및 오작동 시킬 수 있게 되었다. 본 논문에서는 HCI가 적용된 스마트그리드 제어시스템에서의 내부자 공격에 대응하기 위해 사용자 및 구성 장비에 대한 인증 기능을 강화하여 제어시스템 사용자와 구성 장비의 신뢰성을 보장할 수 있는 방법을 제시한다.

• Annual Conference of KIPS
• /
• 2020.05a
• /
• pp.286-289
• /
• 2020

정보통신 기술의 발달로 무분별한 사이버 공격에 노출되어 있기 때문에 정보보안의 기술이 중요해지고 있다. 이중 침입 탐지 시스템은 방화벽과 더불어 시스템 및 네트워크 보안을 위한 대표적인 수단으로, 현재까지 네트워크 기반인 NIDS와 호스트 기반인 HIDS에 대한 많은 연구가 이루어졌다. 이러한 침입 탐지에 대한 CTI(Cyber Threat Intelligence)를 공유하기 위해 다양한 CTI 프레임워크를 사용하여 CTI 정보를 공유하는 연구가 진행되고 있다. 이에 본 논문에서는 CVE기반의 OpenIOC와 Snort 및 OSSEC에서 생성된 Raw Data를 결합하여 새로운 CTI 프레임 워크를 제안한다. 제안된 시스템을 테스트하기 위해서는 CVE 분석을 기반으로한 Kali Linux로 공격을 진행한다, 이를 통해 생성된 데이터는 시간이 지남에 따라 축적된 데이터를 저장 및 검색을 위해 대규모 분산 처리 시스템과도 결합이 필요할 것으로 예상되며 추후 딥러닝 기술을 활용하면 지능형 지속 위협을 분석하는데 용이할 것으로 예상된다.

• Annual Conference of KIPS
• /
• 2023.11a
• /
• pp.170-172
• /
• 2023

최근 자동차는 자율주행차 혹은 스마트카로 진화하며 다양한 외부 통신 인터페이스를 포함하고 있습니다. 각 기능 통제를 위해 차량 소프트웨어의 복잡성과 자동차 기술 발전에 따라 통신 인터페이스의 증가로 인하여 자동차에 대한 사이버 공격 가능성 및 위험성이 꾸준히 증가하고 있습니다. 특히, 커넥티드카의 안전을 위한 V2X(Vehicle to Everything)통신이 보안 취약점을 가질 경우, 이는 탑승자의 생명에 직접적인 위협을 초래할 수 있습니다. 그러나, 지능형 교통 시스템에서는 익명성을 위해 일정 시간이 지나면 차량의 식별정보를 변경해 공격자를 찾는데 어려움이 있다. 따라서 본 논문에서는 지능형 교통 시스템 내에서 이상행위를 유발하는 차량을 탐지하기 위해 V2X에 활용되는 표준 메시지 정보를 통해 식별하여 추적하는 기술을 제안하고자 한다.

• Convergence Security Journal
• /
• v.23 no.2
• /
• pp.11-25
• /
• 2023

Since President Biden's inauguration, significant cyberattacks have occurred several times in the United States, and cybersecurity was emphasized as a national priority. The U.S. is advancing efforts to strengthen the cybersecurity both domestically and internationally, including with allies. In particular, the Biden administration announced the National Cybersecurity Strategy in March 2023. The National Cybersecurity Strategy is the top guideline of cybersecurity and is the foundation of other cybersecurity policies. And it includes public-privates as well as international policy directions, so it is expected to affect the international order. Meanwhile, In Korea, a new administration was launched in 2022, and the revision of the National Cybersecurity Strategy is necessary. In addition, cooperation between Korea and the U.S. has recently been strengthened, and cybersecurity is being treated as a key agenda in the cooperative relationship. In this paper, we examine the cyber security strategies of the Trump and Biden administration, and analyze how the strategies have changed, their characteristics and implications in qualitative and quantitative terms. And we derive the implications of these changes for Korea's cybersecurity policy.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.5
• /
• pp.1027-1041
• /
• 2015

Recently, there are rapidly increasing cases of APT (Advanced Persistent Threat) attacks such as Verizon(2010), Nonghyup(2011), SK Communications(2011), and 3.20 Cyber Terror(2013), which cause leak of confidential information and tremendous damage to valuable assets without being noticed. Several anomaly detection technologies were studied to defend the APT attacks, mostly focusing on detection of obvious anomalies based on known malicious codes' signature. However, they are limited in detecting APT attacks and suffering from high false-negative detection accuracy because APT attacks consistently use zero-day vulnerabilities and have long latent period. Detecting APT attacks requires long-term analysis of data from a diverse set of sources collected over the long time, real-time analysis of the ingested data, and correlation analysis of individual attacks. However, traditional security systems lack sophisticated analytic capabilities, compute power, and agility. In this paper, we propose a Fast Data based real-time abnormal behavior detection system to overcome the traditional systems' real-time processing and analysis limitation.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.15 no.8
• /
• pp.5256-5262
• /
• 2014

Recently, Distributed Denial of Service (DDoS) attacks, such as spreading malicious code, cyber-terrorism, have occurred in government agencies, the press and the financial sector. DDoS attacks are the simplest Internet-based infringement attacks techniques that have fatal consequences. DDoS attacks have caused bandwidth consumption at the network layer. These attacks are difficult to detect defend against because the attack packets are not significantly different from normal traffic. Abnormal traffic is threatening the stability of the network. Therefore, the abnormal traffic by generating indications will need to be detected in advance. This study examined the abnormal traffic detection technique using a forecasting model-based trend model.

• Korean Security Journal
• /
• no.18
• /
• pp.169-190
• /
• 2009

Today, the rapid advance of scientific technologies has brought about fundamental changes to the types and levels of terrorism while the war against the world more than one thousand small and big terrorists and crime organizations has already begun. A method highly likely to be employed by terrorist groups that are using 21st Century state of the art technology is cyber terrorism. In many instances, things that you could only imagine in reality could be made possible in the cyber space. An easy example would be to randomly alter a letter in the blood type of a terrorism subject in the health care data system, which could inflict harm to subjects and impact the overturning of the opponent's system or regime. The CIH Virus Crisis which occurred on April 26, 1999 had significant implications in various aspects. A virus program made of just a few lines by Taiwanese college students without any specific objective ended up spreading widely throughout the Internet, causing damage to 30,000 PCs in Korea and over 2 billion won in monetary damages in repairs and data recovery. Despite of such risks of cyber terrorism, a great number of Korean sites are employing loose security measures. In fact, there are many cases where a company with millions of subscribers has very slackened security systems. A nationwide preparation for cyber terrorism is called for. In this context, this research will analyze the current status of Korea's cyber security systems and its laws from a policy perspective, and move on to propose improvement strategies. This research suggests the following solutions. First, the National Cyber Security Management Act should be passed to have its effectiveness as the national cyber security management regulation. With the Act's establishment, a more efficient and proactive response to cyber security management will be made possible within a nationwide cyber security framework, and define its relationship with other related laws. The newly passed National Cyber Security Management Act will eliminate inefficiencies that are caused by functional redundancies dispersed across individual sectors in current legislation. Second, to ensure efficient nationwide cyber security management, national cyber security standards and models should be proposed; while at the same time a national cyber security management organizational structure should be established to implement national cyber security policies at each government-agencies and social-components. The National Cyber Security Center must serve as the comprehensive collection, analysis and processing point for national cyber crisis related information, oversee each government agency, and build collaborative relations with the private sector. Also, national and comprehensive response system in which both the private and public sectors participate should be set up, for advance detection and prevention of cyber crisis risks and for a consolidated and timely response using national resources in times of crisis.

• Journal of the Institute of Electronics and Information Engineers
• /
• v.50 no.2
• /
• pp.60-69
• /
• 2013

Highlighted by recent security breaches including Google, Western Energy Company, and the Stuxnet infiltration of Iranian nuclear sites, Cyber warfare attacks pose a threat to national and global security. In particular, targeted attacks such as APT exploiting a high degree of stealthiness over a long period, has extended their victims from PCs and enterprise servers to government organizations and critical national infrastructure whereas the existing security measures exhibited limited capabilities in detecting and countermeasuring them. As a solution to fight against such attacks, we designed and implemented a security monitoring system, which shares security information and helps cooperative countermeasure. The proposed security monitoring system collects security event logs from heterogeneous security devices, analyses them, and visualizes the security status using 3D technology. The capability of the proposed system was evaluated and demonstrated throughly by deploying it under real network in a ISP for a week.

• Convergence Security Journal
• /
• v.20 no.2
• /
• pp.29-35
• /
• 2020

The cyber attacks targeting the systems of national and public organizations in the front line of cyber security have been advanced, and the number of cyber attacks has been on the constant rise. In this circumstance, it is necessary to develop the security evaluation technology to prevent cyber attacks to the systems of national and public organizations. Most of the studies of the vulnerability analysis on the information systems of national and public organizations almost focus on automation. In actual security inspection, it is hard to automate some parts. In terms of security policies for threats, many different plans have been designed and applied in the managerial, physical, and technical fields, giving particular answers no matter how they are subjective or situational. These tendencies can be standardized in OCIL(Open Checklist Interactive Language), and partial automation can be achieved. Therefore, this study tries to implement XML Converter in order for OCIL based security level evaluation with typical evaluation questions.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2002.11a
• /
• pp.459-462
• /
• 2002

기존의 개별적 보안 사항에 맞추어 서비스를 제공하는 여러 보안 솔루션들이 급변하는 네트워크 환경에 적절한 대응을 못하고 있는 실정이다. 단순한 보안 문제에 대한 특화된 솔루션에 의존을 해왔기 때문에 해당 네트워크와 시스템 환경에 맞는 적절한 대응책을 마련하지 못하고 있으며, 그 이전에 취약성 분석조차도 미비하기 때문이다. 그러므로 적절한 취약성 분식에 대한 방법론 제시가 필수적이다. 사이버 공격과 방어 메커니즘 분석을 통해 얻어지는 시스템의 각 요소들을 Modeling하고, 시뮬레이션 기법을 이용하여 취약성을 평가하고 다시 재구성하여 적용해보는 취약성 분석 방법을 기술하고자 한다. 다양한 공격들로부터 전체 시스템을 보호하고, Survivability를 증가시키기 위해서는 취약성 분석이 기반이 되어야 하며, 그 시스템은 취약성에 의한 결함이나, 공격에 의한 장애에도 불구하고, 고유의 기능을 완전하게 제공하기 위해서 지속적으로 수행되는 속성을 유지해야 할 것이다.