• Journal of KIISE:Computer Systems and Theory
• /
• v.29 no.4
• /
• pp.220-231
• /
• 2002

Trojan-horse programs are the programs that disguise normal and useful programs but do malicious thing to the hosts. This paper proposes an anti-Trojan horse mechanism using the information attached to the code by the developers. In this mechanism, each code is accompanied with the information on their possible accesses to resources, and based on this information users determine whether the code is malicious or not. Even in the case a code is accepted by users due to its non-malicious appearance, its runtime behaviors are monitored and halted whenever any attempts to malicious operations are detected. By hiring such runtime monitoring system, this mechanism enables detecting unknown Trojan horses and reduces the decision-making overhead being compared to the previous monitoring-based approaches. We describe the mechanism in a formal way to show the advantages and the limitations of the security this mechanism provides.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2018.07a
• /
• pp.470-473
• /
• 2018

본 논문에서는 스마트폰과 스마트폰이 블루투스로 연결할 때 페어링 진행을 최초 1회만 하는 것에 대한 위험성에 관하여 연구하였다. 본 연구를 통하여 구현한 트로이목마 어플리케이션은 희생자 스마트폰과 페어링이 되어 있을 경우, 실행과 동시에 공격자의 스마트폰과 블루투스로 연결되도록 하였다. 희생자 스마트폰의 어플리케이션은 스마트폰의 카메라를 작동시켜 사진을 촬영하고 스마트폰에 저장된 주소록 데이터를 추출하며, 촬영한 사진과 추출한 주소록 데이터를 공격자의 스마트폰으로 전송한다. 공격자는 희생자의 스마트폰에서 탈취한 정보를 확인할 수 있다.

• Electronics and Telecommunications Trends
• /
• v.36 no.6
• /
• pp.78-87
• /
• 2021

Information technology (IT) has been applied to various fields, and currently, IT devices and systems are used in very important areas, such as aviation, industry, and national defense. Such devices and systems are subject to various types of malicious attacks, which can be software or hardware based. Compared to software-based attacks, hardware-based attacks are known to be much more difficult to detect. A hardware Trojan horse is a representative example of hardware-based attacks. A hardware Trojan horse attack inserts a circuit into an IC chip. The inserted circuit performs malicious actions, such as causing a system malfunction or leaking important information. This has increased the potential for attack in the current supply chain environment, which is jointly developed by various companies. In this paper, we discuss the future direction of research by introducing attack cases, the characteristics of hardware Trojan horses, and countermeasure trends.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2002.11a
• /
• pp.48-52
• /
• 2002

본 논문에서는 자바의 샌드박스 개념을 이용하여 실행되는 프로그램에 제한을 가하고 모니터링을 수행함으로써 악의적인 행위를 방지하는 샌드박스 메커니즘을 제안한다. 또한 시스템 자원을 논리적 자원과 물리적 자원으로 분리하여 트로이목마 프로그램의 자원에 대한 불법적인 접근을 감시하여 기밀성(Confidentiality)과 무결성(Integrity)을 보장할 뿐만 아니라 물리적인 자원 사용량을 제한하여 DOS 공격에 대한 방지와 같이 가용성(Availability)까지 고려하는 샌드박스 메커니즘을 제안하고, 리눅스 커널 2.4.19에 샌드박스 메커니즘을 구현한다.

• Convergence Security Journal
• /
• v.14 no.5
• /
• pp.37-47
• /
• 2014

A Trojan malicious code is one of largest malicious codes and has been known as a virus that causes damage to a system as itself. However, it has been changed as a type that picks user information out stealthily through a backdoor method, and worms or viruses, which represent a characteristic of the Trojan malicious code, have recently been increased. Although several modeling methods for analyzing the diffusion characteristics of worms have proposed, it allows a macroscopic analysis only and shows limitations in estimating specific viruses and malicious codes. Thus, in this study an ESP model that can estimate future occurrences of Trojan malicious codes using the previous Trojan data is proposed. It is verified that the estimated value obtained using the proposed model is similar to the existing actual frequency in causes of the comparison between the obtained value and the result obtained by the Markov chain.

• Journal of Internet Computing and Services
• /
• v.15 no.3
• /
• pp.31-43
• /
• 2014

Large number of Android mobile application has been developed and deployed through the Android open market by increasing android-based smart work device users recently. But, it has been discovered security vulnerabilities on malicious applications that are developed and deployed through the open market or 3rd party market. There are issues to leak user's personal and financial information in mobile devices to external server without the user's knowledge in most of malicious application inserted Trojan Horse forms of malicious code. Therefore, in order to minimize the damage caused by malignant constantly increasing malicious application, it is required a proactive detection mechanism development. In this paper, we analyzed the existing techniques' Pros and Cons to detect a malicious application and proposed discrimination and detection result using malicious application discrimination mechanism based on Jaccard similarity after collecting events occur in real-time execution on android-mobile devices.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2003.07a
• /
• pp.223-226
• /
• 2003

정보화 사회에서 네트워크는 현실과 밀접한 관련이 있고 사람들이 많이 이용하는 네트워크에 있어서 알고는 있지만 잘 인지하지 못하고 있는 악성 코드 및 프로그램인 바이러스, 웜, 트로이목마에 대하여 설명하고 이들이 보안과 어떤 관계가 있는가에 대하여 알아본다. 본 논문에서는 이들의 공격 및 전파 방법을 알아보고 이를 통하여 해킹의 위험성이 존재함을 밝힌다.

• Journal of Scientific & Technological Knowledge Infrastructure
• /
• s.4
• /
• pp.74-79
• /
• 2001

사이버 테러리스트들은 전세계적으로 연결된 인터넷 등의 정보통신망을 통하여 소리없이 목표를 공격하고 있다. 이들이 가장 흔히 사용하고 있는 수단으로는 해킹과 컴퓨터 바이러스, 트로이목마 등을 포함하는 악성코드가 있으며, 최근에는 기존의 방식과는 다른 새로운 물리적 기법도 시도되고 있다.

• Journal of Convergence Society for SMB
• /
• v.5 no.1
• /
• pp.13-18
• /
• 2015

The malware, as hackers generic name of executable code that is created for malicious purposes, depending on the presence or absence of a self-replicating ability infected subjects, and are classified as viruses, worms, such as the Trojan horse. Mainly Web page search and P2P use, such as when you use a shareware, has become penetration is more likely to occur in such a situation. If you receive a malware attack, whether the e-mail is sent it is automatically, or will suffer damage such as reduced system performance, personal information leaks. While introducing the current malware, let us examine the measures and describes the contents related to the malicious code.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2002.11a
• /
• pp.177-182
• /
• 2002

본 논문에서는 컴퓨터 바이러스(이하 바이러스) 및 웜 그리고 트로이목마 등 악성코드의 명명법 차이를 설명하고, 200l년 10월부터 2002년 10월까지, 주요 악성 코드의 기법을 분석하고 전반적인 바이러스 발견 동향 및 향후 전망에 대해 기술하고 향후 악성코드 대응 방법에 관한 연구 방향을 제시하고 논문을 맺는다.