• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.3
• /
• pp.579-589
• /
• 2017

The cloud environment is hypervisor-based, and many virtual machines are interconnected, which makes propagation of malicious code easier than other environments. Accordingly, this paper proposes a malicious traffic dynamic analysis system for secure cloud environment. The proposed system continuously monitors and analyzes malicious activity in an isolated virtual network environment by distinguishing malicious traffic that occurs in a cloud environment. In addition, the analyzed results are reflected in the distinguishment and analysis of malicious traffic that occurs in the future. The goal of this research is secure and efficient malicious traffic dynamic analysis by constructing the malicious traffic analysis environment in the cloud environment for detecting and responding to the new and variant malicious traffic generated in the cloud environment.

• Journal of Digital Contents Society
• /
• v.8 no.1
• /
• pp.69-76
• /
• 2007

The blocking of malicious traffic in groupware network system is used to prevent the spread and distribution of malicious traffic. The method protecting from malicious traffic in groupware system is designed to handle the malicious traffic of various routes with the internal course of groupware, which leads to lighten the load of security and traffic. It was impossible to block this kind of traffic at the traditional structure. When the protection of the proposed groupware system is performed, there appears to be a great change for the rate of a load factor at the CPU of Backbone Switch which is connected to the internal gateway. The load factor of CPU, which was increased with the traffic, is now remarkably reduced after the internal gateway is set up. This is to show that a lot of malicious traffic pass through the internal network and that network environment is faced to the menace of many malicious traffics. This paper is to show the efficiency of protection of internal gateway proposed in this study, for the rate of CPU of Backbone Switch was about 17% a day, but was dropped up to the 4% after the malicious traffic was removed.

• Journal of Internet Computing and Services
• /
• v.19 no.1
• /
• pp.1-10
• /
• 2018

Network threats such as Internet worms and computer viruses have been significantly increasing. In particular, APTs(Advanced Persistent Threats) and ransomwares become clever and complex. IDSes(Intrusion Detection Systems) have performed a key role as information security solutions during last few decades. To use an IDS effectively, IDS rules must be written properly. An IDS rule includes a key signature and is incorporated into an IDS. If so, the network threat containing the signature can be detected by the IDS while it is passing through the IDS. However, it is challenging to find a key signature for a specific network threat. We first need to analyze a network threat rigorously, and write a proper IDS rule based on the analysis result. If we use a signature that is common to benign and/or normal network traffic, we will observe a lot of false alarms. In this paper, we propose a scheme that analyzes a network threat and extracts key signatures corresponding to the threat. Specifically, our proposed scheme quantifies the degree of correspondence between a network threat and a signature using the LDA(Latent Dirichlet Allocation) algorithm. Obviously, a signature that has significant correspondence to the network threat can be utilized as an IDS rule for detection of the threat.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2016.07a
• /
• pp.305-306
• /
• 2016

최근에 게임 플레이어들을 노리는 악성코드가 발견돼 사용자들의 주의가 필요하다. 게임 플레이어를 노리는 악성코드는 이전부터 존재해왔지만 이번에 발견된 악성코드는 게임 콘텐츠로 위장한 사례로, 직.간접적으로 게임을 즐기는 불특정 다수를 대상으로 하고 있다. 본 논문에서는 게임 콘텐츠를 위장하여 악성코드를 이용한 사이버 공격에 대한 사전 차단을 위하여 악성코드 탐지엔진에서 수집된 트래픽 정보로부터 악성링크를 판단할 수 있는 실시간 악성링크 탐지 기능을 제안한다.

• Journal of KIISE
• /
• v.41 no.9
• /
• pp.617-624
• /
• 2014

Malicious traffic, such as DDoS attack and botnet communications, refers to traffic that is generated for the purpose of disturbing internet networks or harming certain networks, servers, or hosts. As malicious traffic has been constantly evolving in terms of both quality and quantity, there have been many researches fighting against it. In this paper, we propose an effective malicious traffic detection method that exploits the X-means clustering algorithm. We also suggest how to analyze statistical characteristics of malicious traffic and to define metrics that are used when clustering. Finally, we verify effectiveness of our method by experiments with two released traffic data.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2016.10a
• /
• pp.222-225
• /
• 2016

최근 기업 네트워크에서 암호화 트래픽 사용량이 증가하고 있으며, 악성 행위를 암호화하여 보안 장비를 우회하는 문제들이 발생하고 있다. 본 논문에서는 기업 네트워크 환경에서 암호화된 트래픽을 검사하기 위해 SSL 트래픽을 복호화하는 시스템을 제안한다. 제안하는 시스템은 암호화 트래픽 분석을 통해 악성 행위 및 기업 내부정보 유출 탐지에 활용할 수 있다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.3
• /
• pp.37-44
• /
• 2011

Recently malicious activities that is a DDoS, spam, propagation of malware, steeling person information, phishing on the Internet are related malicious botnet. To detect malicious botnet, Many researchers study a detection system for malicious botnet, but these applies specific protocol, action or attack based botnet. In this reason, we study a selection of measurement to detec malicious botnet in this paper. we collect a traffic of malicious botnet and analyze it for feature of network traffic. And we select a feature based measurement. we expect to help a detection of malicious botnet through this study.

• Proceedings of the Korean Information Science Society Conference
• /
• 2005.07a
• /
• pp.130-132
• /
• 2005

인터넷상의 수많은 트래픽 정보 중에서 악성 트래픽 정보를 빠르게 감지하는 것은 그 정보의 방대함 때문에 쉽지 않다. 공격시각회(Attack Visualization) 기법은 이런 수많은 정보 중에서 악성 트래픽 정보를 좀 더 쉽게 인지하게 함으로써 새로운 공격에 대해서 빠른 대응과 피해 최소화를 하는데 활용할 수 있다. 본 연구에서는 평행좌표계(Parallel Coordinates)를 이용해 공격시각화를 하여, 분산 서비스 거부 공격, 웜, 스캐닝 공격 등 인터넷상에 알려진 혹은 알려지지 않은 새로운 공격들에 대해 빠른 대응을 하기위한 기술 연구를 하였으며, 각 공격들의 특정 시각화 패턴을 감지하고 이를 알려주는 이상탐지(anomaly detection) 시각화 시스템 PCAV를 구현하였다. PCAV 시스템을 통해 네트워크 관리자는 실시간으로 트래픽 정보와 공격들의 시각화 정보를 원격에서도 모니터링하고 이를 통해 즉시 대응하는 것이 가능하다. 또한, 이전에 발생한 공격들의 시각화 정보를 확인하고 이를 분석하는 것과, 알려지지 않은 공격이 발생했을지라도 그 공격의 시각적 패턴이 나타났을 때 즉각 공격 서명(Signature)으로 활용 하는 것이 가능하다.

• Convergence Security Journal
• /
• v.6 no.4
• /
• pp.49-57
• /
• 2006

Firewall to block a network access of unauthorized IP system and IDS (Intrusion Detection System) to detect malicious code pattern to be known consisted the main current of the information security system at the past. But, with rapid growth the diffusion speed and damage of malicious code like the worm, study of the unknown attack traffic is processed actively. One of such method is detection technique using traffic statistics information on the network viewpoint not to be an individual system. But, it is very difficult but to reserve traffic raw data or statistics information. Therefore, we present extraction technique of a network traffic Raw data and a statistics information like the time series. Also, We confirm the validity of a mixing traffic and show the evidence which is suitable to the experiment.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2014.10a
• /
• pp.937-939
• /
• 2014

Recently, an intelligent APT(Advanced Persistent Threat) attack which aims to a special target is getting to be greatly increased. It is very hard to protect with existing intrusion detection methods because of the difficulties to protect the initial intrusion of malicious code. In this paper, we analyze out-bound traffics to prevent call-back step after malicious code intrusion, and propose an APT malicious traffic detection method with considering of trust. The proposed method is expected to provide a basement to improve the detection rate in comparing with that of existing detection methods.