• Annual Conference of KIPS
• /
• 2024.05a
• /
• pp.786-787
• /
• 2024

Large Language Model은 그 기능으로 말미암아 여러 애플리케이션에 통합되고 있다. 특히 OpenAI는 ChatGPT에 여러 세부 사항을 설정함으로써 차별화된 기능을 사용자가 제공할 수 있도록 한다. 하지만 최근 제시되는 프롬프트 연출 공격은 서비스의 핵심 요소를 쉽게 탈취할 수 있는 가능성을 제시한다. 본 연구는 지침 우회 방법론을 통해 기본 대비 공격의 성공률을 10%p 올렸다. 또한 유출공격을 평가할 수 있는 유효성과 성공률을 통해 모델의 방어 성능을 일반화한다.

• Journal of National Security and Military Science
• /
• s.1
• /
• pp.391-421
• /
• 2003

While the social activities using Internet become generalized, the side effect of the information security violation is increasing steadily and threaten the countries which is not ready to prevent from offensive penetration such as the Information-fighter or Cyber-military. In this paper, we define the concept and characteristics of the modern Information-Warfare and analyze various kinds of threatened elements and also examine the recent trend in other countries. And introducing Computer Forensics raised recently for the confrontation against the security violation in the future, we will show the developing strategies and the necessity in order to response cyber attacks. These developing strategies can be used to ensure and re-trace the technical evidence for the security violation and to achieve the disaster relief effectively. So we hope that can apply them to the actual preparation through developing cyber trial test of the defense and attack for the Information-Warfare.

• International Journal of Internet, Broadcasting and Communication
• /
• v.15 no.4
• /
• pp.128-133
• /
• 2023

Satellite based communication is networks in which users in a wide area can access without wired-based ground infrastructure. In particular, the need is emerging due to the recent Ukraine-Russia war. Satellite network systems acquire data that is difficult to observe on Earth as well as communication networks and are also used for research and development, which allows additional data to be produced. However, due to the nature of communication networks existing in outer space, certain vulnerabilities are revealed, and attacks based on them can be exposed. In this paper, we analyze vulnerabilities that may arise due to the nature of satellite communication networks and describes current research, countermeasures, and future research directions.

• Journal of Information Processing Systems
• /
• v.15 no.4
• /
• pp.865-889
• /
• 2019

The need for cyber resilience is increasingly important in our technology-dependent society where computing devices and data have been, and will continue to be, the target of cyber-attackers, particularly advanced persistent threat (APT) and nation-state/sponsored actors. APT and nation-state/sponsored actors tend to be more sophisticated, having access to significantly more resources and time to facilitate their attacks, which in most cases are not financially driven (unlike typical cyber-criminals). For example, such threat actors often utilize a broad range of attack vectors, cyber and/or physical, and constantly evolve their attack tactics. Thus, having up-to-date and detailed information of APT's tactics, techniques, and procedures (TTPs) facilitates the design of effective defense strategies as the focus of this paper. Specifically, we posit the importance of taxonomies in categorizing cyber-attacks. Note, however, that existing information about APT attack campaigns is fragmented across practitioner, government (including intelligence/classified), and academic publications, and existing taxonomies generally have a narrow scope (e.g., to a limited number of APT campaigns). Therefore, in this paper, we leverage the Cyber Kill Chain (CKC) model to "decompose" any complex attack and identify the relevant characteristics of such attacks. We then comprehensively analyze more than 40 APT campaigns disclosed before 2018 to build our taxonomy. Such taxonomy can facilitate incident response and cyber threat hunting by aiding in understanding of the potential attacks to organizations as well as which attacks may surface. In addition, the taxonomy can allow national security and intelligence agencies and businesses to share their analysis of ongoing, sensitive APT campaigns without the need to disclose detailed information about the campaigns. It can also notify future security policies and mitigation strategy formulation.

• Journal of Internet Computing and Services
• /
• v.22 no.6
• /
• pp.99-113
• /
• 2021

In these days, as cyberspace has been recognized as the fifth battlefield area following the land, sea, air, and space, attention has been focused on activities that view cyberspace as an operational and mission domain in earnest. Also, in the 21st century, cyber operations based on cyberspace are being developed as a 4th generation warfare method. In such an environment, the success of the operation is determined by the commander's decision. Therefore, in order to increase the rationality and objectivity of such decision-making, it is necessary to systematically establish and select a course of action (COA). In this study, COA is established by using the method of classifying operational elements necessary for cyber operation, and it is intended to suggest a direction for quantitative evaluation of COA. To this end, we propose a method of composing the COES (Cyber Operational Elements Set), which becomes the COA of operation, and classifying the cyber operational elements identified in the target development process based on the 5W1H Method. In addition, by applying the proposed classification method to the cyber operation elements used in the STUXNET attack case, the COES is formed to establish the attack COAs. Finally, after prioritizing the established COA, quantitative evaluation of the policy was performed to select the optimal COA.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.15 no.5
• /
• pp.1891-1908
• /
• 2021

Cyber deception defense mitigates Advanced Persistent Threats (APTs) with deploying deceptive entities, such as the Honeyfile. The Honeyfile distracts attackers from valuable digital documents and attracts unauthorized access by deliberately exposing fake content. The effectiveness of distraction and trap lies in the enticement of fake content. However, existing studies on the Honeyfile focus less on this perspective. In this work, we seek to improve the enticement of fake text content through enhancing its readability, indistinguishability, and believability. Hence, an enticing deceptive-content generator, EDGE, is presented. The EDGE is constructed with three steps: extracting key concepts with a semantics-aware K-means clustering algorithm, searching for candidate deceptive concepts within the Word2Vec model, and generating deceptive text content under the Integrated Readability Index (IR). Furthermore, the readability and believability performance analyses are undertaken. The experimental results show that EDGE generates indistinguishable deceptive text content without decreasing readability. In all, EDGE proves effective to generate enticing deceptive text content as deception defense against APTs.

• Journal of the Korea Society of Computer and Information
• /
• v.25 no.8
• /
• pp.31-37
• /
• 2020

In this paper, we propose a system architecture and methodology based on cyber kill chain and MITRE ATT&CK for experiment analysis on cyber warfare simulation. Threat analysis is possible by applying various attacks that have actually occurred with continuous updates to reflect newly emerging attacks. In terms of cyber attack and defense, the current system(AS-IS) and the new system(TO-BE) are analyzed for effectiveness and quantitative results are presented. It can be used to establish proactive cyber COA(Course of Action) strategy, and also for strategic decision making. Through a case study, we presented the usability of the system architecture and methodology proposed in this paper. The proposed method will contribute to strengthening cyber warfare capabilities by increasing the level of technology for cyber warfare experiments.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.3
• /
• pp.501-519
• /
• 2017

With the revolution of IT technology, cyber threats and crimes are also increasing. In the recent years, many large-scale APT attack executed domestically and internationally. Specially, many of the APT incidents were not recognized by internal organizations, were noticed by external entities. With fourth industrial revolution(4IR), advancement of IT technology produce large scale of sensitive data more than ever before; thus, organizations invest a mount of budget for various methods such as encrypting data, access control and even SIEM for analyzing any little sign of risks. However, enhanced intelligent APT it's getting hard to aware or detect. These APT threats are too much burden for SMB, Enterprise and Government Agencies to respond effectively and efficiently. This paper will research what's the limitation and weakness of current defense countermeasure base on Cyber Kill Chain process and will suggest effective and efficient APT defense operation model with considering of organization structure and human resources for operation.

• Electronics and Telecommunications Trends
• /
• v.35 no.1
• /
• pp.12-24
• /
• 2020

To keep pace with other powerful nations in this era of the era of digitalization and to emerge stronger in the world, the defense forces of South Korea aim to innovate and prepare themselves for digital battlefields of possible wars in the future. The resources in the defense sector, which is the core of defense intelligence, is based on an intelligent mission collaboration tactical network system via cyber, command, control, communication, and computer (C4), and military and non-human weapons. Defense intelligence depends on the degree of the convergence of advanced Information and communication technologies (ICTs). Considering this aspect of defense intelligence, We plan to determine the application status of defense blockchain technology and examine the feasibility of applying blockchain technology and the core of applied technology. Generally, a key feature of blockchain technology is its data integrity in untrusted environments. There are various types of core technologies for the blockchain depending on the target areas of application in the defense sector, and it is also essential to derive new application strategies for core technologies that are applied in combination with other ICT technologies. We plan to demonstrate new defense ICT converged technologies (DNAB2: Data, Network, AI, BigData, Blockchain) and DNAB2-As-Services in the defense strategy.

• Proceedings of the Korean Information Science Society Conference
• /
• 2006.06c
• /
• pp.253-255
• /
• 2006

국방정보보호 통합관리 기술을 개발하기 위한 테스트베드 구축에서 중요한 부분 중에 하나인 정보보호 가상망 모델링 시뮬레이션 시스템을 개발하였다. 본 시스템은 실재 망과 유사한 정보보호 환경을 제공하기 위하여 정보보호 환경을 구성하는 정보보호 객체(호스트, 네트워크, IDS, IPS, FW, VW 등)를 모의하고 망의 트래픽(평상시, 사이버 공격 시)을 모의하는 등의 기능을 제공하고 외부의 보안관제 체계 및 모의 공격기와 연동하는 인터페이스를 제공하여 외부 침입탐지체계의 성능을 검증하거나 취약점 분석을 위한 환경을 제공한다.