• Annual Conference of KIPS
• /
• 2014.04a
• /
• pp.586-589
• /
• 2014

고안전성이 요구되는 소프트웨어의 경우 극히 낮은 확률로 발생하는 오류로 인하여 전체시스템의 안전에 치명적인 상황을 야기할 수 있으므로, 철저한 안전성 검증이 요구된다. 모든 가능한 실행경로를 고려해야 하는 안전성 검증은 시간과 비용이 오래 걸리는 단점이 있다. 본 논문에서는 안전성 검증의 고비용 문제를 개선하기 위해 안전성 특질을 기준으로 코드 자르기 기법[2]을 구현한 도구를 개발하였다. 개발한 도구를 OSEK/VDX[1] 기반의 개방형 차량 전장용 운영체제인 Trampoline[3] 소스코드에 적용한 결과 분석 대상의 코드의 크기를 83% 줄일 수 있음을 보였다.

• The Journal of the Korea Contents Association
• /
• v.10 no.5
• /
• pp.70-79
• /
• 2010

We perform static program analysis for the binary code. The reason you want to analyze at the level of binary code, installed on your local computer, run the executable file without source code. And the reason we want to perform static analysis, static program analysis is to understand what actions to perform on your local computer. In this paper, execution flow graph representing information such as the execution order among functions and the flow of control is generated. Using graph, User can find execution flow of binary file and calls of insecure functions at the same time, and the graph should facilitate the analysis of binary files. In addition, program to be run is ensured the safety by providing an automated way to search the flow of execution, and program to be downloaded and installed from outside is determined whether safe before running.

• Journal of the Korea Society of Computer and Information
• /
• v.13 no.2
• /
• pp.19-29
• /
• 2008

In case of unit testing, White-box test can be used to closely check source code and to analyze logic and statement errors. On the other hand, in case of function testing of system level, Black-box test can be mainly used to compare actual and expected results by inputting test data because the scale of function is large. This Black-Box test in system testing level has problem in tracing errors in source code when we find errors. Moreover applying White-box test is not easy for system testing level because the levels of test target are different. Therefore this paper suggests the vertical test method of a practical and integrated system level which can checks up to source code level using White-box test style although it aims to test the highly abstract level like a system function. In addition, the experiment explains how to apply the vertical test by displaying an example which traces from UML specification model to the source code and also shows efficiency of error trace.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.6
• /
• pp.1139-1150
• /
• 2022

With the rapid development of SW Industry, softwares are everywhere in our daily life. The number of vulnerabilities are also increasing with a large amount of newly developed code. Vulnerabilities can be exploited by hackers, resulting the disclosure of privacy and threats to the safety of property and life. In particular, since the large numbers of increasing code, manually analyzed by expert is not enough anymore. Machine learning has shown high performance in object identification or classification task. Vulnerability detection is also suitable for machine learning, as a reuslt, many studies tried to use RNN-based model to detect vulnerability. However, the RNN model is also has limitation that as the code is longer, the earlier can not be learned well. In this paper, we proposed a novel method which applied BERT to detect vulnerability. The accuracy was 97.5%, which increased by 1.5%, and the efficiency also increased by 69% than Vuldeepecker.

• KIPS Transactions on Software and Data Engineering
• /
• v.8 no.8
• /
• pp.317-322
• /
• 2019

Programming judge systems for programming training support are typically built on the Web, where the examiners uploads a programming problem, which the student reads and submits an answer to the problem. The judge system executes the submitted answer of source code to provide feedback such as pass, failure, and error messages. Students who receive the feedback except for the pass continues debugging the source code until they are judged to pass. We developed an online judge system to support programming training and analyzed answers submitted by the students and found that many of the students who were not judged to pass that test did not know exactly where they were wrong but continued to solve the problem. The current judge system generally feeds runtime error messages back to students. However, with only runtime error message, it is difficult for student who train to find the wrong part of the answer. Therefore, in this paper, we propose a system that provides the feedback of programming failure by analyzing the control flow of the test cases used in the source code submitted by the student. The proposed system helps students find the wrong parts more quickly by feeding back the paths where faults in the control flow may exist. In addition, we show that this system is applicable to the answer source code that the actual student submitted.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.6
• /
• pp.1353-1360
• /
• 2016

We analyze the efficiency of the double-block-length hash functions, Abreast-DM, HIROSE, MDC-2, MJH, MJH-Double based on AES or LEA. We use optimized open-source code for AES, and our implemented source code for LEA. As a result, the hash functions based on LEA are generally more efficient than those, based on AES. In terms of speed, the hash function with LEA are 6%~19% faster than those with AES except for Abreast-DM. In terms of memory, the hash functions with LEA has 20~30 times more efficient than those with AES.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2010.07a
• /
• pp.67-70
• /
• 2010

본 논문은 바이너리 코드 수준에서 정적인 프로그램 분석을 수행하는 프레임워크를 설계 및 구현한다. 정적으로 바이너리 코드 수준에서 분석을 수행하려는 이유는 일반적으로 컴퓨터에 설치되는 실행 파일은 소스 코드 없이 단지 바이너리로 된 실행 파일만 주어지는 경우가 대부분이고, 정적 제어 흐름 분석을 통해 수행 전에 동작을 파악하기 위해서이다. 본 논문에서는 바이너리 실행 파일로부터 실행 순서 및 제어 흐름 등의 정보를 표현할 수 있는 제어 흐름 그래프를 작성하여 바이너리 파일의 실행 흐름과 위험한 함수의 호출 여부를 동시에 파악할 수 있도록 하며, 그래프 시각화를 통해 바이너리 파일의 분석을 용이하게 한다. 또한 실행 흐름에 대한 자동 탐색 방법을 제공한다.

• Proceedings of the Korea Information Assurance Society Conference
• /
• 2004.05a
• /
• pp.3-8
• /
• 2004

The majority of recent intrusions reveal that the attackers do not use the previous intrusion techniques or network flaw, rather they tend to use the vulnerabilities residing inside the program, which are the running programs on the system or the processes for the service. Therefore, the security managers must focus on updating the programs with lots of time and efforts. Developers also need to patch continuously to update the program, which is a lot of burden for them. In order to solve the problem, we need to understand the vulnerabilities in the program, which has been studied for some time. And also we need to analyze the functions that contains some vulnerabilities inside. In this paper, we first analyzed the vulnerabilities of the standard C library, and Win32 API functions used in various programs. And then we described the design and implementation of the automated scanning tool for writing secure source code based on the analysis.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.15 no.11
• /
• pp.6849-6855
• /
• 2014

Recently, with the increasing use of smart phones, security issues, such as safety and reliability of the use of the Android application has become a topic to provide services in various forms. An Android application is performed using several important files in the form of an apk file. On the other hand, they may be subject to unauthorized use, such as the loss of rights and privileges due to the insertion of malicious source code of these apk files. This paper examines the Android environment to study ways to define the threats related to the unauthorized use of the application source code, and based on the results of the analysis, to prevent unauthorized use of the application source code. In this paper, a system is provided using a third body to prevent and detect applications that have been counterfeited or forged illegally and installed on Android devices. The application provides services to existing systems that are configured with only the service server that provides users and applications general, This paper proposes the use of a trusted third party for user registration and to verify the integrity of the application, add an institution, and provide a safe application.

• Proceedings of the Korea Water Resources Association Conference
• /
• 2022.05a
• /
• pp.118-118
• /
• 2022

지속적인 학문의 발전을 위해서는 선행연구에 대한 재현성이 무엇보다도 중요하다고 할 수 있다. 하지만 컴퓨터와 소프트웨어의 급속한 발달로 인한 컴퓨터 환경의 다양화, 분석 소프트웨어의 지속적 최신화로 인해서 최근 구축된 모델도 짧게는 몇 달, 길게는 1~2년후면 다양한 에러로 인하여 재현성이 불가능해지고 있다. 이러한 재현성의 극복을 위해서 온라인을 통한 데이터와 소스코드의 공유의 필요성이 제시되고 있으나, 실제로는 개인마다 컴퓨터 환경, 버전, 소프트웨어 설치에 필요한 라이브러리의 버전 또는 디렉토리 등이 달라 단순히 온라인을 통한 데이터와 소스코드의 공유만으로 재현성을 개선하기는 힘든 것이 현실이다. 따라서 이러한 컴퓨터 모델링 환경의 공유는 과거의 형태와 같이 데이터, 소스코드와 매뉴얼의 공유만으로 불가능하다고 할 수 있다. 따라서 본 연구에서는 수자원 모델링의 재현성 개선을 위해 1) 온라인 저장소, 2) 클라우드기반 JupyterHub 모델링 환경과 3) 모델 APIs 3개의 핵심 구성요소를 제시하고, 최근 미국에서 개발된SUMMA(Structure for Unifying Multiple Modeling Alternative) 수자원 모델에 적용하여 재현성 달성을 위한 3개의 핵심 구성요소의 필요성과 용이성을 검증하였다. 첫 번째, 데이터와 모델의 온라인 공유는 FAIR(Findable, Accessible, Interoperable, Reusable) 원칙으로 개발된 수자원분야의 대표적인 온라인 저장소인 HydroShare를 활용하여 모델입력자료를 메타데이터와 함께 공유하였다. 두 번째, HydroShare에서 Web App의 형태로 제공되는 클라우드기반 JupyterHub환경인 CUAHSI JupyterHub(CJH)와 일루노이대학에서 제공하는 CyberGIS-Jupyter for water JupyterHub(CJW)환경에 수자원모델링 환경을 컨테이너(Docker) 환경을 통해 구축·공유하였다. 마지막으로, 클라우드에서 수자원모델의 효율적 이용을 위해 Python기반의SUMMA모델 API인 pySUMMA를 개발·공유하였다. 이와같이 구축된 3개의 핵심 구성요소를 이용하여 2015년 Water Resources Research에 게재된 SUMMA 논문의 9개 Test Cases 중에서 5개를 누구나 쉽게 재현할 수 있음을 증명하였다. 재현성의 중요성에 대한 인식의 증가로 Open과 Transparent Hydrology에 대한 요구가 증대되고 있으며, 이를 위해서 클라우드 기반의 모델링 환경구축 및 제공이 확대되고 있다. 본 연구에서 제시한 HydroShare와 같은 온라인 저장소, CJH와 CJW와 같은 클라우드기반 모델링환경, 모델의 효율적 이용을 위한 모델 APIs는 급속도로 발달하고 있는 컴퓨터 및 소프트웨어 환경에서 핵심구성요소이며, 연구의 재현성 개선을 통해 수자원공학 발전에 기여할 것으로 기대된다.