• The Journal of the Korea Contents Association
• /
• v.13 no.4
• /
• pp.17-22
• /
• 2013

Impersonation attack, based on vulnerable security of SIP, facilitate a intruder to take malicious actions such as toll fraud and session hijacking. This paper suggests a new technique for a countermeasure. When receiving a register request message, registrar checks whether the value of Form header or the value of Call-ID header is stored in location server or not. If the record containing either of them are stored and periodically updated, we regard that message as impersonation attack and discard it. Since this technique uses the information stored in server instead of adding encryption mechanism for user authentication, it can easily build securer SIP environment.

• Proceedings of the Korean Information Science Society Conference
• /
• 2005.07a
• /
• pp.127-129
• /
• 2005

신분위장공격 탐지는 오랫동안 연구되어 왔지만 실제 시스템에 적용되어 사용되기에는 여전이 높은 오탐지율(false alarm)과 낮은 탐지력(detecion rate)이 가장 큰 문제였다. 유닉스 시스템에서 신분위장공격을 탐지하기 위하여 사용자의 유닉스 명령어 행위를 프로파일링하고 정상 프로파일링에서 벗어난 권한 도용을 탐지하는 방법을 사용한다. 본 연구에서는 신분위장공격 탐지 시스템의 탐지력을 높이기 위하여 순서 정보를 반영한 SVM 커널 기법을 고찰하고 실험 결과를 정리하였다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.20 no.4
• /
• pp.89-108
• /
• 2010

Recently many mutual authentication protocol for light-weight hash-based for RFID have been proposed. Most of them have assumed that communications between a backend server and reader are secure, and not considered threats for backend server and RFID reader impersonation. In the real world, however, attacks against database or reader are more effective rather than attacks against RFID tag, at least from attacker's perspective. In this paper, we assume that all communications are not secure to attackers except the physical attack, and considering realistic threats for designing a mutual authentication protocol based on hash function. And It supports a mutual authentication and can protect against the replay attack, impersonation attack, location tracking attack, and denial of service attack in the related work. We besides provide a secure and efficient RFID mutual authentication protocol which resists impersonation attacks on all of the entities and alow a backend server to search tag-related information efficiently. We conclude with analyzing the safety and efficiency among latest works.

• The Journal of the Korea Contents Association
• /
• v.11 no.12
• /
• pp.88-93
• /
• 2011

Due to vulnerable authentication scheme of SIP, intruders can easily impersonate legitimate user. HTTP Digest authentication scheme or private key issued by trust third parties has been used to prevent impersonation attack. However, these methods have suffered security vulnerability or service delay due to computation overhead. In this paper, we propose new authentication method to generate automatically one-time password using the pre-shared password and time information of messages exchanged between SIP UA(User Agent) and SIP Registrar. This method protects against impersonation attack without significant modification of exiting SIP authentication procedure to build securer SIP environment.

• The Journal of the Korea Contents Association
• /
• v.15 no.12
• /
• pp.18-23
• /
• 2015

This paper proposes a new protection technique against deregistration attack in SIP. Although it is caused by simple spoofing the REGISTER message of a legitimate SIP UA, its impact is serious. This new protection technique identifies and protects the deregistration attack by removing a binding form the location server after delaying a certain period of time instead of removing the binding immediately after receiving deregistration message. Therefore, this technique makes it possible to establish a secure SIP environment defending the deregistraion attack without any additional overhead such as an encryption or authentication.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2013.05a
• /
• pp.655-658
• /
• 2013

최근 피싱의 한 유형으로 등장한 파밍은 웹 사이트를 위조하여 개인정보를 탈취하는 공격이다. 신뢰받는 기관(금융, 정부 등)의 사이트로 위장하여 개인정보를 탈취하는 방식은 같으나 차이점은 피싱의 경우 유사 도메인을 이용하는 경우가 많아 사용자가 주의를 기울이면 공격을 피할 수 있다. 하지만, 파밍의 경우 DNS 스푸핑을 이용하여 사용자가 정확한 도메인주소(URL)를 입력 하더라도 공격자가 미리 만들어둔 위장 웹 서버로 접속이 되기 때문에 사용자가 주의 깊게 살펴보아도 공격을 인지하기 어렵다. 본 논문에서는 파밍 공격에 사용되는 DNS 스푸핑에 대해 논의하고 파밍 탐지기법에 대해 소개한다. 궁극적으로는 파밍 탐지기법들을 비교 및 분석한 후 실제 구현을 위해서 극복해야 할 한계점을 알아본다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.3
• /
• pp.365-371
• /
• 2021

With the rapid growth in Internet users, web applications are becoming the main target of hackers. Most previous WAFs (Web Application Firewalls) target every single HTTP request packet rather than the overall behavior of the attacker, and are known to be difficult to detect new types of attacks. In this paper, we propose a web attack detection system based on user behavior using machine learning to detect attacks of unknown patterns. In order to define user behavior, we focus on features excluding areas where an attacker can camouflage as a normal user. The experimental results shows that by using the path and query information to define users' behaviors, best results for an accuracy of 99% with Decision forest.

• Proceedings of the Korean Institute of Intelligent Systems Conference
• /
• 2006.05a
• /
• pp.331-335
• /
• 2006

인터넷의 발달과 사용자 증가로 인해 IETF는 다양한 네트워크와 프로토콜 상에서 안전하고 신뢰성 있는 사용자 인증을 위해 AAA를 제안하였다. 그러나 AAA의 최신 버전인 Diameter 표준의 인증 방식은 상호인증과 부인방지를 제공하지 않는다. 이러한 Diameter의 인증을 보완하기 위해 공개키를 이용한 AAA 인증 방식이 제안되었으나, 통신과 연산의 오버헤드로 인해 이동 노드에 적용이 어렵다. 이러한 단점을 극복한 ID 기반 AAA 인증 방식이 제안 되었으나 공모공격과 위장공격으로부터의 취약점을 가진다. 이 논문에서는 공모공격과 위장공격에 안전하고, 계산적 전력적 능력이 부족한 이동 노드의 연산량을 감소시키는 새로운 ID기반 AAA인증 방식을 제안한다. 제안한 방식의 검증을 위해 기존 방식을 비교 평가하여 암호학적인 안전성과 연산량의 효율성을 검증한다. 제안 방식은 이동 노드의 인증시 2개의 난수를 생성하여 안전성을 제공하며, Mobile 노드의 지수연산을 줄임으로 계산 전력적 측면에서 효율적이고 서버의 성능에 따라 인증 수행 시간을 감소 시켜 끊김 없는 서비스를 제공할 수 있는 장점을 갖는다.

• Journal of the Institute of Electronics and Information Engineers
• /
• v.51 no.11
• /
• pp.127-133
• /
• 2014

In order to protect information asset from various malicious code, Honeypot system is implemented. Honeypot system is designed to elicit attacks so that internal system is not attacked or it is designed to collect malicious code information. However, existing honeypot system is designed for the purpose of collecting information, so it is designed to induce inflows of attackers positively by establishing disguised server or disguised client server and by providing disguised contents. In case of establishing disguised server, it should reinstall hardware in a cycle of one year because of frequent disk input and output. In case of establishing disguised client server, it has operating problem such as procuring professional labor force because it has a limit to automize the analysis of acquired information. To solve and supplement operating problem and previous problem of honeypot's hardware, this thesis suggested hybrid honeypot. Suggested hybrid honeypot has honeywall, analyzed server and combined console and it processes by categorizing attacking types into two types. It is designed that disguise (inducement) and false response (emulation) are connected to common switch area to operate high level interaction server, which is type 1 and low level interaction server, which is type 2. This hybrid honeypot operates low level honeypot and high level honeypot. Analysis server converts hacking types into hash value and separates it into correlation analysis algorithm and sends it to honeywall. Integrated monitoring console implements continuous monitoring, so it is expected that not only analyzing information about recent hacking method and attacking tool but also it provides effects of anticipative security response.

• KIPS Transactions on Computer and Communication Systems
• /
• v.2 no.11
• /
• pp.503-510
• /
• 2013

Recently, the rapid development of network technology has enabled people to use various services on the internet. However, the existing password-based user authentication system used in the internet environment requires a password table, which is a potential security threat as it could be leaked by an insider. To solve this issue, remote user authentication methods that do not require a user password table have been proposed. Regarding remote user authentication using a smart card in particular, various methods have been suggested to reduce expenses and to improve stability and efficiency, but the possibility of impersonation attacks and password-guessing attacks using information saved in a user's smart card still exist. Therefore, this study proposes a remote user authentication method that can safeguard against impersonation attacks and password guessing attacks, by analyzing weak points of conventional methods and creating a smart card's ID and password that are based on the user's ID and password.