• Title/Summary/Keyword: 좀비

Search Result 46, Processing Time 0.023 seconds

Efficient Buffer Management Scheme for Mitigating Possibility of DDoS Attack (DDoS 공격 가능성 완화를 위한 효율적인 버퍼 관리 기술)

  • Noh, Hee-Kyeong;Kang, Nam-Hi
    • The Journal of the Institute of Internet, Broadcasting and Communication
    • /
    • v.12 no.2
    • /
    • pp.1-7
    • /
    • 2012
  • DDoS attack is a malicious attempt to exhaust resources of target system and network capacities using lots of distributed zombi systems. DDoS attack introduced in early 2000 has being evolved over time and presented in a various form of attacks. This paper proposes a scheme to detect DDoS attacks and to reduce possibility of such attacks that are especially based on vulnerabilities presented by using control packets of existing network protocols. To cope with DDoS attacks, the proposed scheme utilizes a buffer management techniques commonly used for congestion control in Internet. Our scheme is not intended to detect DDoS attacks perfectly but to minimize possibility of overloading of internal system and to mitigate possibility of attacks by discarding control packets at the time of detecting DDoS attacks. In addition, the detection module of our scheme can adapt dynamically to instantly increasing traffic unlike previously proposed schemes.

Classification of Malicious Web Pages by Using SVM (SVM을 활용한 악성 웹 페이지 분류)

  • Hwang, Young-Sup;Moon, Jae-Chan;Cho, Seong-Je
    • Journal of the Korea Society of Computer and Information
    • /
    • v.17 no.3
    • /
    • pp.77-83
    • /
    • 2012
  • As web pages provide various services, the distribution of malware via the web pages is being also increased. Malware can make personal information leak, system mal-function and system be zombie. To protect this damages, we should block the malicious web pages. Because the malicious codes embedded in web pages are obfuscated or transformed, it is difficult to detect them using signature-based approaches which are used by current anti-virus software. To overcome this problem, we extracted features to classify malicious web pages and benign ones by analyzing web pages. And we propose a classification method using SVM which is widely used in machine learning. Experimental results show that the proposed method is better than other methods. The proposed method could classify malicious web pages correctly and be helpful to block the distribution of malicious codes.

Analyzing of connected car vulnerability and Design of Security System (커네티트 카의 취약점 분석 및 보안 시스템 설계)

  • Kim, Tae-Hyoung;Jang, Jong-Wook
    • Proceedings of the Korean Institute of Information and Commucation Sciences Conference
    • /
    • 2016.05a
    • /
    • pp.241-243
    • /
    • 2016
  • In the Past, Trend of car security was Physical Something like doorlock system, and The Generation did not have skills connecting External devices. Through Car Development is up, that trend of car security Changed Physical Security to Intelligence Security. This Changes give a chance to hackers to attack this system. This System use CAN(Controller Area Network) Protocol which have three vulnerabilities. First, ID Spoofing, Twice, D - Dos Attack, Third, Android Application Injected Modern cars have many ECU(Electronic Control Unit) to control devices like Engine ON/OFF, Door Lock Handling, and Controlling Handle. Because CAN Protocol spread signal using broadcast, Hackers can get the signal very easily, and Those often use Mobile devices like Android or IOS to attack this system. if bluetooth signal is spread wide, hackers get the signal, and analysis the bluetooth data, so then They makes certain data to attack ECU, they send the data to ECU, and control ECU installed car. so I suggest that I will prevent this attack to make Auth system and prevent this attack in end of Android.

  • PDF

Detecting ShellCode Using Entropy (엔트로피를 이용한 ShellCode 탐지 방법)

  • Kim, Woosuk;Kang, Sunghoon;Kim, Kyungshin;Kim, Seungjoo
    • KIPS Transactions on Computer and Communication Systems
    • /
    • v.3 no.3
    • /
    • pp.87-96
    • /
    • 2014
  • Hackers try to achieve their purpose in a variety of ways, such as operating own website and hacking a website. Hackers seize a large amount of private information after they have made a zombie PC by using malicious code to upload the website and it would be used another hacking. Almost detection technique is the use Snort rule. When unknown code and the patterns in IDS/IPS devices are matching on network, it detects unknown code as malicious code. However, if unknown code is not matching, unknown code would be normal and it would attack system. Hackers try to find patterns and make shellcode to avoid patterns. So, new method is needed to detect that kinds of shellcode. In this paper, we proposed a noble method to detect the shellcode by using Shannon's information entropy.

CNN Based Real-Time DNS DDoS Attack Detection System (CNN 기반의 실시간 DNS DDoS 공격 탐지 시스템)

  • Seo, In Hyuk;Lee, Ki-Taek;Yu, Jinhyun;Kim, Seungjoo
    • KIPS Transactions on Computer and Communication Systems
    • /
    • v.6 no.3
    • /
    • pp.135-142
    • /
    • 2017
  • DDoS (Distributed Denial of Service) exhausts the target server's resources using the large number of zombie pc, As a result normal users don't access to server. DDoS Attacks steadly increase by many attacker, and almost target of the attack is critical system such as IT Service Provider, Government Agency, Financial Institution. In this paper, We will introduce the CNN (Convolutional Neural Network) of deep learning based real-time detection system for DNS amplification Attack (DNS DDoS Attack). We use the dataset which is mixed with collected data in the real environment in order to overcome existing research limits that use only the data collected in the experiment environment. Also, we build a deep learning model based on Convolutional Neural Network (CNN) that is used in pattern recognition.

A study on the effective method of detecting denial of service attack to protect Guest OS in paravirtualization (반가상화 환경 Guest OS 보호를 위한 효율적인 서비스 거부 공격 탐지 방법에 관한 연구)

  • Shin, Seung-Hun;Jung, Man-Hyun;Moon, Jong-Sub
    • Journal of the Korea Institute of Information Security & Cryptology
    • /
    • v.22 no.3
    • /
    • pp.659-666
    • /
    • 2012
  • Recently, cloud computing service has become a rising issue in terms of utilizing sources more efficiently and saving costs. However, the service still has some limitations to be popularized because it lacks the verification towards security safety. In particular, the possibility to induce Denial of service is increasing as it is used as Zombie PC with exposure to security weakness of Guest OS's. This paper suggests how cloud system, which is implemented by Xen, detects intrusion caused by Denial of service using hypercall. Through the experiment, the method suggested by K-means and EM shows that two data, collected for 2 mins, 5 mins, 10mins and 20mins each, are distinguished 90% when collected for 2mins and 5mins while collected over 10mins are distinguished 100% successfully.

A Study on the Detection of Malware That Extracts Account IDs and Passwords on Game Sites and Possible Countermeasures Through Analysis (게임 사이트의 계정과 비밀번호 유출 악성코드 분석을 통한 탐지 및 대응방안 연구)

  • Lee, Seung-Won;Roh, Young-Sup;Kim, Woo-Suk;Lee, Mi-Hwa;Han, Kook-Il
    • Journal of the Korea Institute of Information Security & Cryptology
    • /
    • v.22 no.2
    • /
    • pp.283-293
    • /
    • 2012
  • A new type of malware that extracts personal and account data over an extended period of time and that apparently is resistant to detection by vaccines has been identified. Generally, a malware is installed on a computer through network-to-network connections by utilizing Web vulnerabilities that contain injection, XSS, broken authentication and session management, or insecure direct-object references, among others. After the malware executes registration of an arbitrary service and an arbitrary process on a computer, it then periodically communicates the collected confidential information to a hacker. This paper is a systematic approach to analyzing a new type of malware called "winweng," a kind of worm that frequently made appearances during the first half of 2011. The research describes how the malware came to be in circulation, how it infects computers, how its operations expose its existence and suggests improvements in responses and countermeasures. Keywords: Malware, Worm, Winweng, SNORT.

The Traffic Analysis of P2P-based Storm Botnet using Honeynet (허니넷을 이용한 P2P 기반 Storm 봇넷의 트래픽 분석)

  • Han, Kyoung-Soo;Lim, Kwang-Hyuk;Im, Eul-Gyu
    • Journal of the Korea Institute of Information Security & Cryptology
    • /
    • v.19 no.4
    • /
    • pp.51-61
    • /
    • 2009
  • Recently, the cyber-attacks using botnets are being increased, Because these attacks pursue the money, the criminal aspect is also being increased, There are spreading of spam mail, DDoS(Distributed Denial of Service) attacks, propagations of malicious codes and malwares, phishings. leaks of sensitive informations as cyber-attacks that used botnets. There are many studies about detection and mitigation techniques against centralized botnets, namely IRC and HITP botnets. However, P2P botnets are still in an early stage of their studies. In this paper, we analyzed the traffics of the Peacomm bot that is one of P2P-based storm bot by using honeynet which is utilized in active analysis of network attacks. As a result, we could see that the Peacomm bot sends a large number of UDP packets to the zombies in wide network through P2P. Furthermore, we could know that the Peacomm bot makes the scale of botnet maintained and extended through these results. We expect that these results are used as a basis of detection and mitigation techniques against P2P botnets.

What Is a Monster Narrative? Seven Fragments on the Relationship between a Monster Narrative and a Catastrophic Narrative (괴물서사란 무엇인가? - 괴물서사에서 파국서사로 나아가기 위한 일곱 개의 단편 -)

  • Moon, Hyong-jun
    • Cross-Cultural Studies
    • /
    • v.50
    • /
    • pp.31-51
    • /
    • 2018
  • The concept of 'monsters' have become popular, again, in recent times. A number of 'monster narratives' that discuss monsters such as zombies, humanoids, viruses, extraterrestrials, and serial killers have been made and re-made in popular media. Noting such an interesting cultural context, this article attempts, first, to find out some essential prototypical elements of a monster narrative and, second, to relate it with a catastrophic narrative. Correspondingly, the word 'monster' has been used as a conceptual prototype category that denies universal and clear definition, which makes it as one of the most widely used and familiar subjects of the use of metaphor. The prototypical meanings of various monster figures can be converged on a certain creature of being in this way held out as bizarre, curious, and abnormal. The monster figure that surpasses existing normality is also connected to 'abjection,' such as something that is cast aside from the body such as the bodily functions seen in its associated blood, tears, vomit, excrement, or semen, and so on. Nevertheless, both the monster figure and abjection produce disgust and horror in the minds of ordinary spectators or readers of media using this metaphor to heighten excitement for the viewers. The abject characteristic of the monster figure also has something in common with the posthuman figure, meaning to apply to a category of inhuman others who are held outside of the normal category of human beings. In the similar vein, it is natural that the most typical monster figures in our times are posthuman creatures embodied in such forms as seen with zombies, humanoids, cyborgs, robots, and so on. In short, the monster figure includes all of the creatures and beings that disarray normalized humanist categories and values. The monster narrative, in the same sense, is a type of story that tells about others outside modern, anthropocentric, male-centered, and Westernized categories of thought. It can be argued that a catastrophic narrative, a literary genre which depicts the world where a series of catastrophic events demolish the existing human civilization, ought to be seen as a typical modern-day monster narrative, because it also discounts and criticizes normalized humanist categories and values as is the result of the monster narrative. Going beyond the prevailing humanist realist narrative that are so familiar with existing values, the catastrophic narrative is not only a monster narrative per se, but also a monstrous narrative which disrupts and reinvents currently mainstream narratives and ways of thinking.

Implementation and Validation of the Web DDoS Shelter System(WDSS) (웹 DDoS 대피소 시스템(WDSS) 구현 및 성능검증)

  • Park, Jae-Hyung;Kim, Kang-Hyoun
    • KIPS Transactions on Computer and Communication Systems
    • /
    • v.4 no.4
    • /
    • pp.135-140
    • /
    • 2015
  • The WDSS improves defensive capacity against web application layer DDoS attack by using web cache server and L7 switch which are added on the DDoS shelter system. When web DDoS attack occurs, security agents divert traffic from backbone network to sub-network of the WDSS and then DDoS protection device and L7 switch block abnormal packets. In the meantime, web cache server responds only to requests of normal clients and maintains stable web service. In this way, the WDSS can counteract the web DDoS attack which generates small traffic and depletes server-client session resource. Furthermore, the WDSS does not require IP tunneling because it is not necessary to retransfer the normal requests to original web server. In this paper, we validate operation of the WDSS and verify defensive capability against web application layer DDoS attacks. In order to do this, we built the WDSS on backbone network of an ISP. And we performed web DDoS tests by using a testing system that consists of zombie PCs. The tests were performed by three types and various amounts of web DDoS attacks. Test results suggest that the WDSS can detect small traffic of the web DDoS attacks which do not have repeat flow whereas the formal DDoS shelter system cannot.