• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.16 no.6
• /
• pp.287-294
• /
• 2016

APT attack aimed at the interruption of information and communication facilities and important information leakage of companies. it performs an attack using zero-day vulnerabilities, social engineering base on collected information, such as IT infra, business environment, information of employee, for a long period of time. Fragmentary response to cyber threats such as malware signature detection methods can not respond to sophisticated cyber-attacks, such as APT attacks. In this paper, we propose a cyber intrusion detection model for countermeasure of APT attack by utilizing heterogeneous system log into big-data. And it also utilizes that merging pattern-based detection methods and abnormality detection method.

• Review of KIISC
• /
• v.20 no.6
• /
• pp.73-87
• /
• 2010

정신한은행은 '10년 1 월부터 6월까지 약 6개월 동안 "위험관리 기반의 침해사고 조기 대응체계 구축" 프로젝트를 수행하여 침해 시도 조기 탐지 및 대응을 위한 "침해사고 조기 경보 시스템" 및 "침해 사고 대응 프로세스 전산화"와 침해 사고의 사전 예방 강화를 위한 "정보시스템 상시 취약점 점검 체계"를 모두 하나의 프레임웍으로 묶어 통합 구축하였다. 신한은행은 이를 통해 내부망 및 인터넷 서비스망에 대해서 이마 알려진 네트웍 침입 패턴뿐만 아니라 네트웍 트래픽 전반에 대한 모니터링을 대폭 강화하여 기존 침입탐지 시스템이나 디도스 대응 시스템 등에서 탐지가 불가능했던 신종 침입 유형이나 소규모 디도스 공격 트래픽도 자동화된 탐지가 가능하게 되었다. 그리고 탐지된 침입시도의 유행 및 위험 수준에 따라서 사전 정의된 침해사고 대응 프로세스를 통해, 정보보안 담당자가 관련 부서 및 경영진의 요구사항에 각각 최적화된 전용 상황 모니터링 화면을 공유하며 침해사고를 효과적으로 공동 대응할 수 있게 되었다. 또한 정보시스템 전반에 대하여 상시 취약점 점검을 실시하고 그 점검 결과를 데이터베이스로 구축하고 정보시스템의 위험 수준에 따른 체계화된 대응 방안을 수립할 수 있게 되었다. 신한은행은 금번 구축된 시스템을 정보보안 영역 전반으로 확대하여 동일 프레임웍에서 위험관리 기반의 내부 정보 유출 체계를 구축하고, 향후 그룹사에도 확대 적용하여 전체 그룹사의 보안 수준을 제고하는 데 활용할 계획이다. * 금번 구축 사례에서 소개된 침해사고 조기 대응체계는 구축 완료 시점에 사내 명칭 공모를 통해 "Ageis"로 선정되었으며, 본 사례에서도 전체 시스템을 가리킬 때 Ageis로 지칭한다. Aegis는 그라스 신화에서 Zeus 신이 딸 Athena 신에게 주었다는 방패로서 보호, 후원, 지도 등의 뜻을 가지며, 이지스 또는 아이기스 라고 발음된다.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.15 no.8
• /
• pp.5256-5262
• /
• 2014

Recently, Distributed Denial of Service (DDoS) attacks, such as spreading malicious code, cyber-terrorism, have occurred in government agencies, the press and the financial sector. DDoS attacks are the simplest Internet-based infringement attacks techniques that have fatal consequences. DDoS attacks have caused bandwidth consumption at the network layer. These attacks are difficult to detect defend against because the attack packets are not significantly different from normal traffic. Abnormal traffic is threatening the stability of the network. Therefore, the abnormal traffic by generating indications will need to be detected in advance. This study examined the abnormal traffic detection technique using a forecasting model-based trend model.

• Journal of the Korea Society of Computer and Information
• /
• v.20 no.6
• /
• pp.37-42
• /
• 2015

In this paper, we propose malware database in mobile memory for realtime malware URL detection and we support realtime malware URL detection engine, that is control the web service for more secure mobile service. Recently, mobile malware is on the rise and to be new threat on mobile environment. In particular the mobile characteristics, the damage of malware is more important, because it leads to monetary damages for the user. There are many researches in cybercriminals prevention and malware detection, but it is still insufficient. Additionally we propose the method for prevention Smishing within SMS, MMS. In the near future, mobile venders must build the secure mobile environment with fundamental measures based on our research.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.17 no.5
• /
• pp.1253-1258
• /
• 2013

This Paper deals with detection and defense methods for underwater weapons because there are so many dangers of underwater weapons not only in the war period but also in the peace time. Underwater mines are the representative strategic arms. The sensors and target detection methods, threat elimination method of mines included in this paper. Among the various sensors of mine, we use the magnetometor for target detection method in the simulation and execute the analysis of magnetic field of detected target ships. It will be also provided that effectiveness of target detection, sweeping method of mine, tactics of mine planning and mine sweeping and so on.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2019.01a
• /
• pp.7-8
• /
• 2019

자료경합은 두 개 이상의 스레드가 같은 공유메모리에 적절한 동기화 없이 접근하고, 적어도 한 개의 접근사건이 쓰기일 때 발생할 수 있는 동시성 오류이다. 자료경합은 프로그래머가 의도하지 않은 비결정적인 수행결과를 초래하여, 항공기 소프트웨어와 같은 고신뢰성이 요구되는 프로그램에서 치명적인 오류를 발생시켜 인적 물적 손해로 이어질 수 있다. 자료경합 탐지기법은 이러한 문제를 사전에 탐지하여 수정하는데 사용되어진다. 하지만 GPGPU 프로그램에서의 자료경합은 CPU 병행프로그램에서보다 복잡한 실행구조를 가지고 있어 스레드 및 메모리 계층, 스케줄링, 동기화 기법 등의 많은 변수가 존재한다. 이로 인해 실세계 프로그램에 자료경합 탐지기법을 적용하여 검증 시 이러한 변수들을 반영하여 실험하는데 많은 노력이 소요된다. 본 논문은 실세계 프로그램에서의 자료경합을 대표하는 4가지 패턴의 합성프로그램으로 이루어지고 실행 시 스레드 및 메모리 계층, 스레드 구조, 메모리 사용량 및 동기화 방안을 지정할 수 있는 벤치마크 모음을 제시한다.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2014.10a
• /
• pp.518-520
• /
• 2014

Radar Cross Section(RCS) is very important factor to detect target by radar. Even if the same target, RCS value is significantly different according to the direction facing the radar. Therefore, it is advantageous to place the radar, where RCS is larger to increase the probability of detecting a target with a radar. North Korean ballistic missiles are major threat to our security, ballistic missiles should be detected early and traced for ballistic missile defense. In this paper, it is analyzed that ballistic missile's RCS characteristics and trajectory and proposed a way of radar deployment to improve the detection probability of ballistic missile.

• Convergence Security Journal
• /
• v.18 no.4
• /
• pp.11-17
• /
• 2018

Hardware Keyloggers are available in a variety of modular keylogger products with small size and Wi-Fi communication capabilities that can be concealed inside the keyboard. Such keyloggers are more likely to leak important information and sensitive information from government, military, business and individuals because they are difficult to detect if they are used by a third party for malicious purposes. However, unlike software keyloggers, research on security solutions and detection methods are relatively small in number. This paper, we investigate security vulnerability caused by hardware keylogger and existing detection methods, and improve the detection possibility of modular hardware keylogger through non-destructive measurement methods, such as power consumption of keyboard, infrared temperature, and X-ray. Furthenmore, We propose a method that can be done with experimental results.

• Journal of the Korea Society of Computer and Information
• /
• v.14 no.9
• /
• pp.55-66
• /
• 2009

In this paper, I will discuss how the Internet has spread rapidly in our lives. Large portals and social networks experience service attacks that access personal customers' databases. This interferes with normal service through DDoS (Distribute Denial of Service Attack), which is the topic I want to discuss. Among the types of DDoS, TCP SYN Flooding attacks are rarely found because they use few traffics and its attacking type is regular transaction. The purpose of this study is to find and suggest the method for accurate detection of the attacks. Through the analysis of TCP SYN Flooding attacks, we find that these attacks cause Backscatter effect. This study is about the algorithm which detects the attacks of TCP SYN Flooding by the study of Backscatter effect.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.5
• /
• pp.1115-1122
• /
• 2015

In recent years, the use of game bots by illegal programs has been expanded from individual to group scale; this brings about serious problems in online game industry. The gold farmers group creates an in-game social community so-called "guild" to obtain a large amount of game money and manage game bots efficiently. Although game developers detect game bots by detection algorithms, the algorithms can detect only part of the gold farmers group. In this paper, we propose a detection method for the gold farmers group on a basis of normal and bot guilds characteristic analysis. In order to differentiate normal and bots guild, we analyze transaction patterns for individuals, auction house and chatting. With the analyzed results, we can detect game bot guilds. We demonstrate the feasibility of the proposed methods with real datasets from one of the popular online games named AION in Korea.