• Journal of Advanced Navigation Technology
• /
• v.16 no.3
• /
• pp.488-494
• /
• 2012

This paper classifies the self-defense techniques used by the malicious software based on their approaches, introduces the packing technique as one of the code protection methods and proposes a way to quickly analyze the packed malicious codes. Packing technique hides a malicious code and restore it at runtime. To analyze a packed code, it is initially required to find the entry point after restoration. To find the entry point, it has been used reversing the packing routine in which a jump instruction branches to the entry point. However, the reversing takes too much time because the packing routine is usually obfuscated. Instead of reversing the routine, this paper proposes an idea to search some features of the startup code in the standard library used to generate the malicious code. Through an implementation and a consequent empirical study, it is proved that the proposed approach is able to analyze malicious codes faster.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.22 no.4
• /
• pp.287-294
• /
• 2021

A Python-based LSTM model was constructed using a Tensorflow backend to estimate the amount of outflow during floods in the Gokgyo-cheon basin flowing into the Sapgyo Lake. To understand the effects of the length of input data used for learning, i.e., the sequence length, on the performance of the model, the model was implemented by increasing the sequence length to three, five, and seven hours. Consequently, when the sequence length was three hours, the prediction performance was excellent over the entire period. As a result of predicting three extreme rainfall events in the model verification, it was confirmed that an average NSE of 0.96 or higher was obtained for one hour in the leading time, and the accuracy decreased gradually for more than two hours in the leading time. In conclusion, the flood level at the Gangcheong station of Gokgyo-cheon can be predicted with high accuracy if the prediction is performed for one hour of leading time with a sequence length of three hours.

• Journal of Korea Multimedia Society
• /
• v.13 no.5
• /
• pp.754-762
• /
• 2010

Nowadays, email-based targeted attacks using malcode-bearing documents have been steadily increased. To improve the success rate of the attack and avoid anti-viruses, attackers mainly employ zero-day exploits and relevant social engineering techniques. In this paper, we propose an architecture of the email vaccine cloud system to prevent targeted attacks using malcode-bearing documents. The system extracts attached document files from email messages, performs behavior analysis as well as signature-based detection in the virtual machine environment, and completely removes malicious documents from the messages. In the process of behavior analysis, the documents are regarded as malicious ones in cases of creating executable files, launching new processes, accessing critical registry entries, connecting to the Internet. The email vaccine cloud system will help prevent various cyber terrors such as information leakages by preventing email based targeted attacks.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2014.07a
• /
• pp.369-370
• /
• 2014

본 논문에서는 안드로이드 환경에서 클래스 반사(Reflection)과 예외처리를 이용하여 안드로이드 보호 시스템을 우회하여 임의의 코드를 수행할 수 있는 방법을 제시한다. 일반적인 자바 환경과는 달리 안드로이드 환경에서는 보안 강화를 위해 APK 파일 내 루트 디렉토리의 클래스 파일만을 반사를 통해 동적 로딩이 가능하다. 하지만, 본 논문에서는 클래스 반사와 예외 처리를 이용하여 임의의 디렉토리 내 파일을 로딩 및 동적 실행할 수 있는 방법을 보이며 이 방법은 저자가 알기로는 기존에 알려지지 않은 방법이다. 이를 기반으로, 본 논문에서는 AES 암호와 동적 로딩을 이용하여, 모바일 어플리케이션의 내부 코드를 은폐하는 기법을 제안한다. 제안기법을 활용 시, 첫째 공격자의 입장에서는 내부 코드를 은폐하여 백신을 우회하는 악성코드 제작이 가능하고, 둘째, 프로그램 제작자의 입장에서는 핵심 알고리즘을 은폐하여 저작권을 보호하는 코드 제작이 가능하다. 안드로이드 버전 4.4.2(Kitkat)에서 프로토타입을 구현하여 제안 기법의 실효성을 보였다.

• Journal of Korea Multimedia Society
• /
• v.12 no.8
• /
• pp.1120-1127
• /
• 2009

The commensurate number of the attacks and infringement targeting a vulnerability of the game service has been increasing constantly, due to the dramatic growth and expansion of the impact of the game industry. However, there exist no subsequent researches for the differentiated technology, which is to prevent the reverse function of the game service. Therefore, in this study, we examined the current status of infringement toward online game services which are provided in the market currently and designed the proper technical measures for a manipulation of the game service which is the most vulnerable part. We have encrypted an execution file and decrypted it in real time process. Furthermore, we conducted debugging, disassemble, and prevented a its own memory dump, also concealed the information to overcome the module dependency to preclude a manipulation.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2009.04a
• /
• pp.1466-1469
• /
• 2009

최근 웹 서비스 환경에서 공격자가 자신의 근원지를 은닉하기 위하여 여러 단계의 경유지를 거쳐 공격을 시도하는 사례가 증가하고 있으며, 이에 대한 법률적 증거 확보 및 능동적인 대처를 위하여 웹 어플리케이션에서의 역추적 기술이 필요하다. 현재 자바 애플릿이나 ActiveX, 플러그인, 웹 로그 등을 이용한 응용 계층의 추적 기술이 개발되고 있지만, 웹 클라이언트에 의하여 차단될 가능성이 높고, 플러그인 종류 및 호환되지 않는 운영 환경 등 제약조건으로 인하여 사용에 제한이 있다. 본 논문에서는 액션 스크립트를 이용한 웹 클라이언트 모니터링 시스템을 제안한다. 제안된 시스템은 웹 클라이언트가 실행을 인식하지 못하고 수행되어 웹 클라이언트에 의한 차단을 막을 수 있고, 다양한 운영 환경에서 사용이 가능하다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.3
• /
• pp.493-501
• /
• 2020

For the obfuscation of Flow Analysis on the Android operating system, the size of the Flow Graph can be large enough to make analysis difficult. To this end, a library in the form of aar was implemented so that it could be inserted into the application in the form of an external library. The library is designed to have up to five child nodes from the entry point in the dummy code, and for each depth has 2n+1 numbers of methods from 100 to 900 for each node, so it consists of a total of 2,500 entry points. In addition, entry points consist of a total of 150 views in XML, each of which is connected via asynchronous interface. Thus, the process of creating a Inter-procedural Control Flow Graph has a maximum of 14,175E+11 additional cases. As a result of applying this to application, the Inter Procedure Control Flow Analysis too generates an average of 10,931 edges and 3,015 nodes with an average graph size increase of 36.64%. In addition, in the APK analyzing process showed that up to average 76.33MB of overhead, but only 0.88MB of execution overhead in the user's ART environment.

• The Transactions of the Korea Information Processing Society
• /
• v.7 no.2
• /
• pp.385-391
• /
• 2000

Recently, neural network research for forecasting the consecutive controlling rules of the future is being progressed, using the series data which are different from the traditional statistical analysis methods. In this paper, we suggest the pruning algorithm for the fast and exact weather forecast that excludes the hidden layer of the early optional designed nenral network. There are perform the weather forecast experiments using the 22080 kinds of weather data gathered from 1987 to 1996 for proving the efficiency of this suggested algorithm. Through the experiments, the early optional composed $26{\times}50{\times}1$ nenral network became the most suitable $26{\times}2{\times}1$ structure through the pruning algorithm suggested, in the optimum neural network $26{\times}2{\times}1$, in the case of the error temperature ${\pm}0.5^{\circ}C$, the average was 33.55%, in the case of ${\pm}1^{\circ}C$, the average was 61.57%, they showed more superior than the average 29.31% and 54.47% of the optional designed structure, also. we can reduce the calculation frequency more than maximum 25 times as compared with the optional sturcture neural network in the calculation frequencies.

• Journal of Practical Engineering Education
• /
• v.15 no.2
• /
• pp.381-388
• /
• 2023

Through artificial neural network education using spreadsheets, non-major undergraduate students can understand the operation principle of artificial neural networks and develop their own artificial neural network software. Here, training of the operation principle of artificial neural networks starts with the generation of training data and the assignment of correct answer labels. Then, the output value calculated from the firing and activation function of the artificial neuron, the parameters of the input layer, hidden layer, and output layer is learned. Finally, learning the process of calculating the error between the correct label of each initially defined training data and the output value calculated by the artificial neural network, and learning the process of calculating the parameters of the input layer, hidden layer, and output layer that minimize the total sum of squared errors. Training on the operation principles of artificial neural networks using a spreadsheet was conducted for undergraduate non-major students. And image training data and basic artificial neural network development results were collected. In this paper, we analyzed the results of collecting two types of training data and the corresponding artificial neural network SW with small 12-pixel images, and presented methods and execution results of using the collected training data for Orange machine learning model learning and analysis tools.

• KIPS Transactions on Computer and Communication Systems
• /
• v.4 no.1
• /
• pp.23-30
• /
• 2015

Reflection is a feature of the Java programming language that can examine and manipulate components of program itself. If you use the reflection, you can get an obfuscation effect of Java source because it converts sources into complicated structures. However, when using it, strings of components name of program are exposed. Therefore, it cannot prevent static analysis. In this paper, we presents a method and a tool of interfere with static analysis using reflection. And in this case, exposed strings are encoded using Vigen$\acute{e}$re cipher. Experimental results show that this tool is effective in increasing the overall complexity of the source code. Also the tool provides two types decryption method based on server and local. It can be selected based on the importance of the API because it affects the execution speed of the application.