• Convergence Security Journal
• /
• v.23 no.4
• /
• pp.33-41
• /
• 2023

In recent years, advanced persistent threat (APT) attack organizations have exploited various vulnerabilities and attack techniques to target companies and institutions with national core technologies, distributing ransomware and demanding payment, stealing nationally important industrial secrets and distributing them on the black market (dark web), selling them to third countries, or using them to close the technology gap, requiring national-level security preparations. In this paper, we analyze the attack methods of attack organizations such as Kimsuky and Lazarus that caused industrial secrets leakage damage through APT attacks in Korea using the MITRE ATT&CK framework, and derive 26 cybersecurity-related administrative, physical, and technical security requirements that a company's security system should be equipped with. We also proposed a security framework and system configuration plan to utilize the security requirements in actual field. The security requirements presented in this paper provide practical methods and frameworks for security system developers and operators to utilize in security work to prevent leakage of corporate industrial secrets. In the future, it is necessary to analyze the advanced and intelligent attacks of various APT attack groups based on this paper and further research on related security measures.

• Convergence Security Journal
• /
• v.24 no.3
• /
• pp.153-163
• /
• 2024

Despite the increasing hacking threats and security threats as IT technology advances and many companies adopt security solutions, cyberattacks and threats still persist for years. APT attack is a technique of selecting a specific target and continuing to attack. The threat of an APT attack uses all possible means through the electronic network to perform APT for years. Zero-day attacks, malicious code distribution, and social engineering techniques are performed, and some of them directly invade companies. These techniques have been in effect since 2000, and are similarly used in voice phishing, especially for social engineering techniques. Therefore, it is necessary to study countermeasures against APT attacks. This study analyzes the attack cases of Korean-based APT groups in Korea and suggests the correct method of using intelligence to analyze APT attack groups.

• Journal of Internet Computing and Services
• /
• v.12 no.5
• /
• pp.47-61
• /
• 2011

Recently, the importance of digital forensic has been magnified because of the dramatic increase of cyber crimes and the increasing complexity of the investigation of target systems such as PCs, servers, and database systems. Moreover, some systems have to be investigated with live forensic techniques. However, even though live forensic techniques have been improved, they are still vulnerable to anti-forensic activities when the target systems are remotely accessible by criminals or their accomplices. To solve this problem, we first suggest a layer-based model and the anti-forensic scenarios which can actually be applicable to each layer. Our suggested model, the Anti-Forensic Activites layer-based model, has 5 layers - the physical layer, network layer, OS layer, database application layer and data layer. Each layer has possible anti-forensic scenarios with detailed commands. Second, we propose a fuzzy expert system for effectively detecting anti-forensic activities. Some anti-forensic activities are hardly distinguished from normal activities. So, we use fuzzy logic for handling ambiguous data. We make rule sets with extracted commands and their arguments from pre-defined scenarios and the fuzzy expert system learns the rule sets. With this system, we can detect anti-forensic activities in real time when performing live forensic.

• Radiation Oncology Journal
• /
• v.24 no.1
• /
• pp.11-20
• /
• 2006

Puroose: In order to find out whether stereotactic radiation therapy (RT) using CyberKnife (CK) could improve survival rate and lower acute toxicity compared to conventional RT. Materials and Methods: From April 2003 through April 2004, 19 patients with Eastern Cooperative Oncology Group (ECOG) performance status ${\leq}3$ and locally advanced pancreas cancer without distant metastasis, evaluated by CT or PET/CT, were included. We administered stereotactic RT consisting of either 33 Gy, 36 Gy or 39 Gy in 3 fractions to 6, 4 and 9 patients, respectively, in an effort to increase the radiation dose step by step, and analyzed the survival rate and gastrointestinal toxicities by the acute radiation morbidity criteria of Radiation Therapeutic Oncology Group (RTOG). Prognostic factors of age, sex, ECOG performance score, chemotherapy, bypass surgery, radiation dose, CA 19-9, planning target volume (PTV), and adjacent organ and vessel invasion on CT scan were evaluated by Log Rank test. Results: The median survival time was 11 months with 1-year survival rate of 36.8%. During follow-up period (range $3{\sim}20$ months, median 10 months), no significant gastrointestinal acute toxicity (RTOG grade 3) was observed. In univariate analysis, age, sex, ECOG performance score, chemotherapy, bypass surgery, radiation dose, CA 19-9 level, and adjacent organ and vessel invasion did not show any significant changes of survival rate, however, patients with PTV (80 cc showed more favorable survival rate than those with PTV>80 cc (p-value<0.05). In multivariate analysis, age younger than 65 years and PTV>80 cc showed better survival rate. Conclusion: In terms of survival, the efficacy of stereotactic radiation therapy using CK was found to be superior or similar to other recent studies achieved with conventional RT with intensive chemotherapy, high dose conformal RT, intraoperative RT (IORT), or intensity modulated RT (IMRT). Furthermore, severe toxicity was not observed. Short treatment time in relation to the short life expectancy gave patients more convenience and, finally, quality of life would be increased. Consequently, this could be regarded as an effective novel treatment modality for locally advanced, unresectable pancreas cancer. PTV would be a helpful prognostic factor for CK.

• Korean Security Journal
• /
• no.39
• /
• pp.185-215
• /
• 2014

Since North Korea has used terror crime as a means of unification under communism against South Korea, South Korea has been much damaged until now. And the occurrence possibility of terror crime by North Korean authority is now higher than any other time. The North Korean terror crimes of Kim Il Sung era had been committed by the dictator's instruction with the object of securing governing fund. However, looking at the terror crimes committed for decades during Kim Jung Il authority, it is revealed that these terror crimes are expressed as a criminal behavior because of the conflict to accomplish the power and economic advantage non powerful groups target. This study focused on the power conflict in various causes of terror crimes by applying George B. Vold(1958)'s theory which explained power conflict between groups became a factor of crime, and found the aspect by ages of terror crime behavior by North Korean authority and responding plan to future North Korean terror crime. North Korean authority high-ranking officials were the Labor Party focusing on Juche Idea for decades in Kim Il Sung time. Afterwards, high-ranking officials were formed focusing on military authorities following Military First Policy at the beginning of Kim Jung Il authority, rapid power change has been done for recent 10 years. To arrange the aspect by times of terror crime following this power change, alienated party executives following the support of positive military first authority by Kim Jung Il after 1995 could not object to forcible terror crime behavior of military authority, and 1st, 2nd Yeongpyeong maritime war which happened this time was propelled by military first authority to show the power of military authority. After 2006, conservative party union enforced censorship and inspection on the trade business and foreign currency-earning of military authority while executing drastic purge. The shooting on Keumkangsan tourists that happened this time was a forcible terror crime by military authority following the pressure of conservative party. After October, 2008, first military reign union executed the launch of Gwanmyungsung No.2 long-range missile, second nuclear test, Daechung marine war, and Cheonanham attacking terror in order to highlight the importance and role of military authority. After September 2010, new reign union went through severe competition between new military authority and new mainstream and new military authority at this time executed highly professionalized terror crime such as cyber/electronic terror unlike past military authority. After July 2012, ICBM test launch, third nuclear test, cyber terror on Cheongwadae homepage of new mainstream association was the intention of Km Jung Eun to display his ability and check and adjust the power of party/military/cabinet/ public security organ, and he can attempt the unexpected terror crime in the future. North Korean terror crime has continued since 1980s when Kim Jung Il's power succession was carried out, and the power aspect by times has rapidly changed since 1994 when Kim Il Sung died and the terror crime became intense following the power combat between high-ranking officials and power conflict for right robbery. Now South Korea should install the specialized department which synthesizes and analyzes the information on North Korean high-ranking officials and reinforce the comprehensive information-collecting system through the protection and management of North Korean defectors and secret agents in order to determine the cause of North Korean terror crime and respond to it. And South Korea should participate positively in the international collaboration related to North Korean terror and make direct efforts to attract the international agreement to build the international cooperation for the response to North Korean terror crime. Also, we should try more to arrange the realistic countermeasure against North Korean cyber/electronic terror which was more diversified with the expertise terror escaping from existing forcible terror through enactment/revision of law related to cyber terror crime, organizing relevant institute and budget, training professional manpower, and technical development.

• Radiation Oncology Journal
• /
• v.25 no.4
• /
• pp.268-277
• /
• 2007

Purpose: Respiratory motion is a considerable inhibiting factor for precise treatment with stereotactic radiosurgery using the CyberKnife (CK). In this study, we developed a moving phantom to simulate three-dimensional breathing movement and investigated the distortion of dose profiles between the use of a moving phantom and a static phantom. Materials and Methods: The phantom consisted of four pieces of polyethylene; two sheets of Gafchromic film were inserted for dosimetry. Treatment was planned to deliver 30 Gy to virtual tumors of 20, 30, 40, and 50 mm diameters using 104 beams and a single center mode. A specially designed robot produced three-dimensional motion in the right-left, anterior-posterior, and craniocaudal directions of 5, 10 and 20 mm, respectively. Using the optical density of the films as a function of dose, the dose profiles of both static and moving phantoms were measured. Results: The prescribed isodose to cover the virtual tumors on the static phantom were 80% for 20 mm, 84% for 30 mm, 83% for 40 mm and 80% for 50 mm tumors. However, to compensate for the respiratory motion, the minimum isodose levels to cover the moving target were 70% for the $30{\sim}50$ mm diameter tumors and 60% for a 20 mm tumor. For the 20 mm tumor, the gaps between the isodose curves for the static and moving phantoms were 3.2, 3.3, 3.5 and 1.1 mm for the cranial, caudal, right, and left direction, respectively. In the case of the 30 mm tumor, the gaps were 3.9, 4.2, 2.8, 0 mm, respectively. In the case of the 40 mm tumor, the gaps were 4.0, 4.8, 1.1, and 0 mm, respectively. In the case of the 50 mm diameter tumor, the gaps were 3.9, 3.9, 0 and 0 mm, respectively. Conclusion: For a tumor of a 20 mm diameter, the 80% isodose curve can be planned to cover the tumor; a 60% isodose curve will have to be chosen due to the tumor motion. The gap between these 80% and 60% curves is 5 mm. In tumors with diameters of 30, 40 and 50 mm, the whole tumor will be covered if an isodose curve of about 70% is selected, equivalent of placing a respiratory margin of below 5 mm. It was confirmed that during CK treatment for a moving tumor, the range of distortion produced by motion was less than the range of motion itself.

• Radiation Oncology Journal
• /
• v.29 no.1
• /
• pp.28-35
• /
• 2011

Purpose: Recently, the use of radiosurgery as a local therapy in patients with early stage non-small cell lung cancer has become favored over surgical resection. To evaluate the efficacy of radiosurgery, we analyzed the results of stereotactic body radiosurgery in patients with primary or recurrent non-small cell lung cancer. Materials and Methods: We reviewed medical records retrospectively of total 24 patients (28 lesions) with non-small cell lung cancer (NSCLC) who received stereotactic body radiosurgery (SBRT) at Inha University Hospital. Among the 24 patients, 19 had primary NSCLC and five exhibited recurrent disease, with three at previously treated areas. Four patients with primary NSCLC received SBRT after conventional radiation therapy as a boost treatment. The initial stages were IA in 7, IB in 3, IIA in 2, IIB in 2, IIIA in 3, IIIB in 1, and IV in 6. The T stages at SBRT were T1 lesion in 13, T2 lesion in 12, and T3 lesion in 3. 6MV X-ray treatment was used for SBRT, and the prescribed dose was 15~60 Gy (median: 50 Gy) for PTV1 in 3~5 fractions. Median follow up time was 469 days. Results: The median GTV was 22.9 mL (range, 0.7 to 108.7 mL) and median PTV1 was 65.4 mL (range, 5.3 to 184.8 mL). The response rate at 3 months was complete response (CR) in 14 lesions, partial response (PR) in 11 lesions, and stable disease (SD) in 3 lesions, whereas the response rate at the time of the last follow up was CR in 13 lesions, PR in 9 lesions, SD in 2 lesions, and progressive disease (PD) in 4 lesions. Of the 10 patients in stage 1, one patient died due to pneumonia, and local failure was identified in one patient. Of the 10 patients in stages III-IV, three patients died, local and loco-regional failure was identified in one patient, and regional failure in 2 patients. Total local control rate was 85.8% (4/28). Local recurrence was recorded in three out of the eight lesions that received below biologically equivalent dose 100 $Gy_{10}$. Among 20 lesions that received above 100 $Gy_{10}$, only one lesion failed locally. There was a higher recurrence rate in patients with centrally located tumors and T2 or above staged tumors. Conclusion: SBRT using a CyberKnife was proven to be an effective treatment modality for early stage patients with NSCLC based on high local control rate without severe complications. SBRT above total 100 $Gy_{10}$ for peripheral T1 stage patients with NSCLC is recommended.

• Korean Security Journal
• /
• no.9
• /
• pp.99-131
• /
• 2005

Terrorism which became today's common phenomena over the world is one of the most serious threats the world confront. Although International society make and operate outstanding anti-terrorism system, terror would never end without solving fundamental problems. The main body of terrorism converts from nation to organization and from organization to cell, which makes it difficult for us to recognize the main body. Since the target of today's new terrorism is many and unspecified persons, terrorists will never hesitate to use mass destruction weapons such as nuclear, biological, chemical weapons, and also use cyber-technique or cyber-terrorism. So, effective counter-terrorism measures should be performed as follows. First, it must be better for international society should make long-time plan of solving fundamental problems of terrorism other than to operate directly on terror organization and its means. Second, preventive method should be made. The most effective method of eradicating terrorism is prevention. For this, it is necessary to remove environmental elements of terrorism and terrorist bases, and to stop inflow of money and mass destruction weapons to terrorists. Third, integrated anti-terror organization should be organized and operated for continuous counter-terrorism operations. Also international alliance for anti-terrorism should be maintained to share informations and measures. Fourth, concerned department in the government should prepare counter-terrorism plans in their own parts as follows and make efforts to integrate the plans. - Ministry of Government Administration and Home Affairs : conventional terror - Ministry of Health and Welfare : bio-terror - Ministry of Science and Technology : nuclear-terror Especially, they should convert their policy and operation from post-terror actions to pre-terror actions, designate terror as national disaster and organize integrated emergency response organization including civil, government, and military elements. In conclusion, pre-terror activities and remedy of fundamental causes is the best way to prevent terror. Also, strengthening of intelligence activities, international cooperations, and preventive and comprehensive counter-measures must not ignored.

• Asian Pacific Journal of Cancer Prevention
• /
• v.15 no.12
• /
• pp.4963-4968
• /
• 2014

Background: We evaluated whether providing health risk appraisal for Koreans (KHRA) in terms of 'health age' during smoking cessation program would effectively help smokers quit smoking or not. Materials and Methods: A total of 332 male smokers aged between 30-65 years old, registered for a smoking cessation program in a public health center in a city, were recruited and underwent a baseline survey from January 2010 to February 2011. They were then prospectively randomized to a conventional counseling group (n=165) or a KHRA group (n=167), and received conventional counseling or KHRA-based counseling for six months. Abstinence rates were identified through carbon monoxide measurement (at the $4^{th}$ and $24^{th}$ weeks) or urinary cotinine level (at the $12^th$ week). Results: The abstinence rate confirmed by exhaled carbon monoxide was significantly higher in the KHRA group (61.1%) than the control group (49.1%) at the $4^{th}$ week (absolute difference 12.0%, 95% CI: 1.4%-22.6%). However, there was no difference in abstinence rates between the two groups at the 12th and 24th weeks. The predicting factors of 24 week's smoking cessation success were age, older than 50 years old (OR 2.02, 95% CI: 1.16-3.52), lower Fagerstr$\ddot{o}$m Test for Nicotine Dependence score less than 4 (OR 1.84, 95% CI: 1.03-3.29), and higher Self Efficacy/Temptation score (OR 1.79, 95% CI: 1.05-3.06). Conclusions: Smoking cessation counseling with KHRA could be effective compared to conventional counseling in the short period of smoking cessation. Further study is needed to evaluate the long-term efficacy of KHRA in tobacco dependence treatment and to establish the indication and target population of this tool.

• The Journal of the Korea Contents Association
• /
• v.14 no.9
• /
• pp.362-370
• /
• 2014

This study measured and analyzed the correlation coefficient between movements of thoracoabdominal tumors and external respiration in a free-breathing state, using cyberknife image guided radiotherapy(IGRT). This study subjects included a total of 30 patients with lung tumors(n=10), liver tumors(n=10) and pancreatic tumor(n=10) who underwent radiotherapy, and the movements of tumors were analyzed using converted log data of the tumor motion tracking system(MTS). In a free-breathing state, In relation to Peason's correlation coefficient between external respiration and lung tumors in the entire treatment process, the correlation coefficient was 0.646(p<0.05) in the cranio-caudal direction, 0.365(p<0.088) in the left and right direction and 0.196(p<0.115) in the antero-posterior direction. The correlation coefficient of liver tumors was 0.841(p<0.000) in the cranio-caudal direction, 0.346 (p<0.179) in the left and right direction and 0.691(p<0.001) in the antero-posterior direction. The correlation coefficient of Pancreatic tumors was 0.683(p<0.000) in the cranio-caudal direction, 0.397(p<0.006) in the left and right direction and 0.268(p<0.127) in the antero-posterior direction. In conclusion, the measurement findings of thoracoabdominal tumor movement using IGRT would be helpful in determining an accurate target volume. Moreover, the analysis of correlation between external respiration and movements of internal tumors would provide important information to correct movements of tumors for diverse radiotherapy techniques.