• Journal of KIISE
• /
• v.41 no.12
• /
• pp.1035-1049
• /
• 2014

This paper presents a new method to detect attack patterns in security-critical systems, based on a new notion of Behavior Ontology. Generally security-critical systems are large and complex, and they are subject to be attacked in every possible way. Therefore it is very complicated to detect various attacks through a semantic structure designed to detect such attacks. This paper handles the complication with Behavior Ontology, where patterns of attacks in the systems are defined as a sequences of actions on the class ontology of the systems. We define the patterns of attacks as sequences of actions, and the attack patterns can then be abstracted in a hierarchical order, forming a lattice, based on the inclusion relations. Once the behavior ontology for the attack patterns is defined, the attacks in the target systems can be detected both semantically and hierarchically in the ontology structure. When compared to other attack models, the behavior ontology analysis proposed in this paper is found to be very effective and efficient in terms of time and space.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.5
• /
• pp.1141-1151
• /
• 2018

In an APT attack, the communication stage between infected hosts and C&C(Command and Control) server is the key stage for intrusion into the attack target. Attackers can control multiple infected hosts by the C&C Server and direct intrusion and exploitation. If the C&C Server is exposed at this stage, the attack will fail. Therefore, in recent years, the Domain Generation Algorithm (DGA) has replaced DNS in C&C Server with a short time interval for making detection difficult. In particular, it is very difficult to verify and detect all the newly registered DNS more than 5 million times a day. To solve these problems, this paper proposes a model to judge DGA-DNS detection by the morphological similarity analysis of normal DNS and DGA-DNS, and to determine the sign of APT attack through it, then we verify its validity.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.3
• /
• pp.411-422
• /
• 2021

The autonomous driving system mounted on the unmanned vehicle recognizes the external environment through several sensors and derives the optimum control value through it. Recently, studies on physical level attacks that maliciously manipulate sensor data by performing signal-injection attacks have been published. signal-injection attacks are performed at the physical level and are difficult to detect at the software level because the sensor measures erroneous data by applying physical manipulations to the surrounding environment. In order to detect a signal-injection attack, it is necessary to verify the dependability of the data measured by the sensor. As so far, various methods have been proposed to attempt physical level attacks against sensors mounted on autonomous driving systems. However, it is still insufficient that methods for defending and detecting the physical level attacks. In this paper, we demonstrate signal-injection attacks targeting MEMS sensors that are widely used in unmanned vehicles, and propose a method to detect the attack. We present a signal-injection detection model to analyze the accuracy of the proposed method, and verify its effectiveness in a laboratory environment.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.5
• /
• pp.975-986
• /
• 2022

Deep learning is attracting great attention, showing excellent performance in image processing, but is vulnerable to adversarial attacks that cause the model to misclassify through perturbation on input data. Adversarial examples generated by adversarial attacks are minimally perturbated where it is difficult to identify, so visual features of the images are not generally changed. Unlikely deep learning models, people are not fooled by adversarial examples, because they classify the images based on such visual features of images. This paper proposes adversarial attack detection method using Symbolic Representation, which is a visual and symbolic features such as color, shape of the image. We detect a adversarial examples by comparing the converted Symbolic Representation from the classification results for the input image and Symbolic Representation extracted from the input images. As a result of measuring performance on adversarial examples by various attack method, detection rates differed depending on attack targets and methods, but was up to 99.02% for specific target attack.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.16 no.11
• /
• pp.3738-3760
• /
• 2022

Due to increasing spectrum demand for new wireless devices applications, cooperative spectrum sensing (CSS) paradigm is the most promising solution to alleviate the spectrum shortage problem. However, in the interweave cognitive radio (CR) system, the inherent nature of CSS opens a hole to Byzantine attack, thereby resulting in a significant drop of the CSS security and efficiency. In view of this, a weighted differential sequential single symbol (WD3S) algorithm based on MATLAB platform is developed to accurately identify malicious users (MUs) and benefit useful sensing information from their malicious reports in this paper. In order to achieve this, a dynamic Byzantine attack model is proposed to describe malicious behaviors for MUs in an interweave CR system. On the basis of this, a method of data transmission consistency verification is formulated to evaluate the global decision's correctness and update the trust value (TrV) of secondary users (SUs), thereby accurately identifying MUs. Then, we innovatively reuse malicious sensing information from MUs by the weight allocation scheme. In addition, considering a high spectrum usage of primary network, a sequential and differential reporting way based on a single symbol is also proposed in the process of the sensing information submission. Finally, under various Byzantine attack types, we provide in-depth simulations to demonstrate the efficiency and security of the proposed WD3S.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.6
• /
• pp.1243-1252
• /
• 2012

Due to the widespread use of smart devices, threats of direct observation attacks such as shoulder surfing and recording attacks, by which user secrets can be stolen at user interfaces, are increasing greatly. Although formal security models are necessary to evaluate the possibility of and security against those attacks, such a model does not exist. In this paper, based on the previous work in which a HCI cognitive model was firstly utilized for analyzing security, we propose STM-GOMS model as an improvement of GOMS-based model with regard to memory limitations. We then apply STM-GOMS model for analyzing usability and security of a password entry scheme commonly used in smart devices and show the scheme is vulnerable to the shoulder-surfing attack. We finally conduct user experiments to show the results that support the validity of STM-GOMS modeling and analysis.

• Journal of the Korea Society of Computer and Information
• /
• v.17 no.5
• /
• pp.33-40
• /
• 2012

In this paper we propose an anomaly detection scheme to detect new attack paths or new attack methods without false positives by monitoring HTTP Outbound Traffic after efficient training. Our proposed scheme detects web-based attacks by comparing tags or javascripts of HTTP Outbound Traffic with normal behavioral models which apply HMM(Hidden Markov Model). Through the verification analysis under the real-attacked environment, we show that our scheme has superior detection capability of 0.0001% false positive and 96% detection rate.

• Journal of Communications and Networks
• /
• v.14 no.1
• /
• pp.104-110
• /
• 2012

Group key agreement protocols allow a group of users, communicating over a public network, to establish a shared secret key to achieve a cryptographic goal. Protocols based on certificateless public key cryptography (CL-PKC) are preferred since CL-PKC does not need certificates to guarantee the authenticity of public keys and does not suffer from key escrow of identity-based cryptography. Most previous certificateless group key agreement protocols deploy signature schemes to achieve authentication and do not have constant rounds. No security model has been presented for group key agreement protocols based on CL-PKC. This paper presents a security model for a certificateless group key agreement protocol and proposes a constant-round group key agreement protocol based on CL-PKC. The proposed protocol does not involve any signature scheme, which increases the efficiency of the protocol. It is formally proven that the proposed protocol provides strong AKE-security and tolerates up to $n$-2 malicious insiders for weak MA-security. The protocol also resists key control attack under a weak corruption model.

• Advances in aircraft and spacecraft science
• /
• v.6 no.3
• /
• pp.225-238
• /
• 2019

A spike attached to a blunt nosed body significantly alters its flow field and influences the aerodynamic coefficients at hypersonic speed. The basic body is an axisymmetric, with a hemisphere nose followed by a cylindrical portion. Five different types of spikes, namely, conical aerospike, hemisphere aerospike, flat-face aerospike, hemisphere aerodisk and flat-face aerodisk are attached to the basic body in order to assess the aerodynamic characteristic. The spiked blunt body without the aerospike or aerodisk has been set to be a basic model. The coefficients of drag, lift and pitching moment were measured with and without blunt spike body for the length-to-diameter ratio (L/D) of 0.5, 1.0, 1.5 and 2.0, at Mach 6 and angle of attack up to 8 degrees using a strain gauge balance. The measured forces and moment data are employed to determine the relative performance of the aerodynamic with respect to the basic model. A maximum of 77 percent drag reduction was achieved with hemisphere aerospike of L/D = 2.0. The comparison of aerodynamic coefficients between the basic model and the spiked blunt body reveals that the aerodynamic drag and pitching moment coefficients decrease with increasing the L/D ratio and angle of attack but the lift coefficient has increasing characteristics.

• Journal of the military operations research society of Korea
• /
• v.12 no.2
• /
• pp.22-36
• /
• 1986

The study is to design optimal aircraft allocation model for sufficing the required level of damage, minimizing attrition cost when the aircrafts attack the enemy's fixed target. When friendly aircraft attacks enemy target, the aircraft will suffer the loss due to the enemy's anti-aircraft weapons and aircraft. For this study, it is required that the probability of target damage by the type of aircraft, level of target damage and attrition cost are computed for the application of this model.