• Journal of KIISE:Computing Practices and Letters
• /
• v.12 no.6
• /
• pp.339-348
• /
• 2006

Recently, many researches on detecting and responding worms due to the fatal infrastructural damages explosively damaged by automated attack tools, particularly worms. Network service vulnerability exploiting worms have high propagation velocity, exhaust network bandwidth and even disrupt the Internet. Previous worm researches focused on signature-based approaches however these days, approaches based on behavioral features of worms are more highlighted because of their low false positive rate and the attainability of early detection. In this paper, we propose a Distributed Worm Detection Model based on packet marking. The proposed model detects Worm Cycle and Infection Chain among which the behavior features of worms. Moreover, it supports high scalability and feasibility because of its distributed reacting mechanism and low processing overhead. We virtually implement worm propagation environment and evaluate the effectiveness of detecting and responding worm propagation.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.2
• /
• pp.345-351
• /
• 2023

As software development progresses and programs become increasingly complex, the cost of reducing and managing software vulnerabilities has also increased. To address this issue, the Rust programming language, which guarantees Memory Safety, has been suggested as an alternative for more error-prone languages such as traditional C/C++. However, Rust also supports the use of libraries written in C/C++ to enhance compatibility with older languages and avoid redundant development, compromising its original guarantees. For example, memory corruption happened in C/C++ can lead to exploits such as buffer overflow, Use-After-Free and null-pointer dereferecing. To tackle this problem, recent studies have been conducted to secure interactino between Rust and C/C++ by isolation. This paper uncovers areas that have not been fully explored in previous studies, following limitation analysis on each. Finally, this paper suggests the future direction of research on safe interaction between Rust and C/C++.

• Journal of KIISE:Computing Practices and Letters
• /
• v.8 no.2
• /
• pp.240-249
• /
• 2002

In the course of Internet proliferation, many network-related technologies are examined for possible growth and evolution. The use of Internet-based technologies in private networks has further fuelled the demand for network-based applications. The most promising among the new paradigms is use of mobile agents. The mobile agent is capable of migrating autonomously from node to node in the network, to perform some computation on behalf of the user. The mobile agent paradigm is attractive alternative to traditional client-server programming for a significant class of network-centric applications. It also however, suffers from a major drawback, namely, the potential for malicious attacks, abuse of resources pilfering of information, and other security issues. These issues are significantly hampering the acceptance of the mobile-agent paradigm. This paper describe the design & implementation of secure mobile agent gateway that split and merge the agent cede with security policy database. This mechanism will promote the security in mobile agent systems and mobile agent itself.

• Journal of Internet Computing and Services
• /
• v.14 no.3
• /
• pp.35-46
• /
• 2013

As mobile terminal environment gets matured, the use of Android platform based mobile terminals has been growing high. Recently, the number of attacks by malicious application is also increasing as Android platform is vulnerable to private information leakage in nature. Most of these malicious applications are easily distributed to general users through open market or internet and an attacker inserts malicious code into malicious app which could be harmful tool to steal private data and banking data such as SMS, contacts list, and public key certificate to a remote server. To cope with these security threats more actively, it is necessary to develop countermeasure system that enables to detect security vulnerability existing in mobile device and take an appropriate action to protect the system against malicious attacks. In this sense, this paper aggregates diverse system events from multiple mobile devices and also implements a system to detect attacks by malicious application.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.15 no.2
• /
• pp.1-7
• /
• 2015

As recent smartphone is used around the world, all of the subscribers of the mobile communication is up to 47.7% about 24 million people. Smartphone has a vulnerability to security, and security-related incidents are increased in damage with the smartphone. However, precautions have been made, rather than analysis of the infection of most of the damage occurs after the damaged except for the case of the expert by way of conventional post-countermeasure. In this paper, we implement a mobile-based malware analysis systems apply a virtualization technology. It is designed to analyze the behavior through it. Virtualization is a technique that provides a logical resources to the guest by abstracting the physical characteristics of computing resources. The virtualization technology can improve the efficiency of resources by integrating with cloud computing services to servers, networks, storage, and computing resources to provide a flexible. In addition, we propose a system that can be prepared in advance to buy a security from a user perspective.

• Journal of IKEEE
• /
• v.16 no.4
• /
• pp.389-394
• /
• 2012

Most current systems have ignored security vulnerability concerned with boot firmware. It is highly likely that boot firmware may cause serious system errors, such as hardware manipulations by malicious programs or code, the operating system corruption caused by malicious code and software piracy under a condition of no consideration of security mechanism because boot firmware has an authority over external devices as well as hardware controls. This paper proposed a structural security mechanism based on software equipped with encrypted bootstrap patterns different from pre-existing bootstrap methods in terms of securely loading an operating system, searching for malicious codes and preventing software piracy so as to provide reliability of boot firmware. Moreover, through experiments, it proved its superiority in detection capability and overhead ranging between 1.5 % ~ 3 % lower than other software security mechanisms.

• Journal of KIISE:Information Networking
• /
• v.37 no.4
• /
• pp.255-262
• /
• 2010

Recently, automated signature generation systems(ASGSs) have been developed in order to cope with zero-day attacks with malicious codes exploiting vulnerabilities which are not yet publically noticed. To enhance the usefulness of the signatures generated by (ASGSs) it is essential to identify signatures only with the high accuracy of intrusion detection among a number of generated signatures and to provide them to target security systems in a timely manner. This automated signature exchange, distribution, and update operations have to be performed in a secure and universal manner beyond the border of network administrations, and also should be able to eliminate the noise in a signature set which causes performance degradation of the security systems. In this paper, we present a system architecture to support the identification of high quality signatures and to share them among security systems through a scheme which can evaluate the detection accuracy of individual signatures, and also propose a set of algorithms dealing with exchanging, distributing and updating signatures. Though the experiment on a test-bed, we have confirmed that the high quality signatures are automatically saved at the level that the noise rate of a signature set is reduced. The system architecture and the algorithm proposed in the paper can be adopted to a automated signature sharing framework.

• Proceedings of the Korean Information Science Society Conference
• /
• 2011.06b
• /
• pp.52-54
• /
• 2011

급속하게 성장하고 있는 스마트폰 시장에서 사용자의 수가 늘어감에 따라 다양한 이슈들이 대두되고 있다. 특히 스마트폰에는 많은 개인정보들이 저장되어 있어, 분실 또는 악성 코드로 인한 정보 유출로 막대한 금전적 피해를 야기할 수 있기 때문에 보안 기법에 대한 연구 필요성이 강조되고 있다. 개방형플랫폼을 지향하고 있는 모바일 운영체제 안드로이드는 다른 폐쇄형 플랫폼보다 보안 취약점이 노출 될 가능성이 높고 실제로 이로 인한 피해 사례들이 보고되고 있다. 본 논문에서는 안드로이드를 플랫폼에서 보안을 강화하기 위해 연구된 여러 보안 기법들을 살펴보고 특징에 따라 분류해본다.

• Proceedings of KOSOMES biannual meeting
• /
• 2006.05a
• /
• pp.7-13
• /
• 2006

On the analysis of maritime security awareness of people who engage in the fields of domestic passenger ships, the security code is proposed in order to prevent and to response threats of security in the domestic passenger ships.

• Proceedings of the Korean Information Science Society Conference
• /
• 2008.06a
• /
• pp.343-344
• /
• 2008

최근 시스템의 복잡도가 증자함에 따라 보안 취약점 문제가 더욱 많이 발생하고 있다. 이를 해결하기 위해 보안 패치가 배포되고 있지만, 시스템 서비스의 중단이 필요하고 패치 자체의 안정성이 검증되지 못해 패치의 적용이 늦어지는 문제가 발생한다. 우리는 이러한 문제를 해결하기 위해 업데이트성이 없는 커널을 위한 함수 단위 동적 업데이트 시스템인 DUNK를 설계 하였다. DUNK는 서비스 중단 없는 업데이트를 가능케 하고, 보안 기법인 MAFIA를 이용해 안전한 업데이트를 수행한다. MAFIA는 바이너리 패치 코드의 접근 행위를 분석함으로써 패치된 함수가 기존 함수의 접근 권한을 상속받도록 하고, 이를 검증하는 기술을 제공한다. 본 논문에서는 DUNK의 설계와 MAFIA의 알고리즘 및 수행에 대해 기술한다.