• Proceedings of the Korean Society of Computer Information Conference
• /
• 2010.07a
• /
• pp.525-526
• /
• 2010

2000년 대규모 DDoS 공격이래, 2009년 7월 7일 국가주요정부기관 및 인터넷 포털, 금융권 등의 웹사이트 대상으로 1차, 2차, 3차로 나누어 대규모 사이버 공격이 발생하였다. 지속적으로 발전되는 행태를 보이고 DDoS 공격에 대해 본 논문에서는 계층적인 침입탐지시스템을 설계하였다. 네트워크 패킷을 분석하기 위해 e-Watch, NetworkMiner등의 패킷, 프로토콜 분석도구를 이용하여 TCP/IP의 Layer별 공격을 분석한 후 패킷의 유입량, 로그정보, 접속정보, Port, Address 정보를 분석하고 계층침입에 대한 방어를 수행하도록 설계하였다. 본 논문은 DDoS(Distributed Denial of Service)에 대한 패킷 전송에 대해 계층적인 방어를 통해 보다 안정적인 패킷수신이 이루어진다.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.25 no.1
• /
• pp.69-74
• /
• 2021

Internet access is also increasing as online activities increase due to the influence of Corona 19. However, network attacks are also diversifying by malicious users, and DDoS among the attacks are increasing year by year. These attacks are detected by intrusion detection systems and can be prevented at an early stage. Various data sets are used to verify intrusion detection algorithms, but in this paper, CICIDS2017, the latest traffic, is used. DDoS attack traffic was analyzed using the decision tree. In this paper, we analyzed the traffic by using the decision tree. Through the analysis, a decisive feature was found, and the accuracy of the decisive feature was confirmed by proceeding the decision tree to prove the accuracy of detection. And the contents of false positive and false negative traffic were analyzed. As a result, learning the feature and the two features showed that the accuracy was 98% and 99.8% respectively.

• The Transactions of the Korea Information Processing Society
• /
• v.13 no.4
• /
• pp.157-165
• /
• 2024

The evolution of the Distributed Denial of Service Attack(DDoS Attack) method has increased the difficulty in the detection process. One of the solutions to overcome the problems caused by the limitations of the existing victim-side detection method was the source-side detection technique. However, there was a problem of performance degradation due to network traffic irregularities. In order to solve this problem, research has been conducted to detect attacks using a collaborative network between several nodes based on artificial intelligence. Existing methods have shown limitations, especially in nonlinear traffic environments with high Burstness and jitter. To overcome this problem, this paper presents a collaborative source-side DDoS attack detection technique introduced with an attention mechanism. The proposed method aggregates detection results from multiple sources and assigns weights to each region, and through this, it is possible to effectively detect overall attacks and attacks in specific few areas. In particular, it shows a high detection rate with a low false positive of about 6% and a high detection rate of up to 4.3% in a nonlinear traffic dataset, and it can also confirm improvement in attack detection problems in a small number of regions compared to methods that showed limitations in the existing nonlinear traffic environment.

• Proceedings of the Korean Information Science Society Conference
• /
• 2004.04a
• /
• pp.310-312
• /
• 2004

분산 서비스 거부 공격(Distributed Denial of Service, DDoS attack)의 목적은 정상적인 사용자가 서비스를 이용하는 것을 거부하는 것이다. 특히 범람 서비스 거부 공격(flooding-based DDoS attack)은 아직까지 방어하기 어려운 공격 형태이다. 그 이유는 공격 시 정상적인 트래픽이 왕복하는 것처럼 보이므로 공격 트래픽과 정상 트래픽을 구별하기 어렵기 때문이다. 하지만, 범람 서비스 거부 공격의 특징을 잘 이용하면 공격을 방어할 수 있다. 범람 서비스 거부 공격의 특징은 단독의 공격 호스트로부터의 트래픽 양이 여러 개의 정상 호스트들로부터의 트래픽 양보다 훨씬 많다는 것이다. 이러한 특징을 이용하여 특정 호스트로부터의 트래픽 양이 많은지 아닌지에 따라 공격이 발생했는지 여부를 결정할 수 있다. 이 논문에서는 Pi(Path Identification) 라는 메커니즘을 이용한 분산 서비스 거부 공격의 방어 기법을 제안한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.1
• /
• pp.147-153
• /
• 2015

Since the DoS(Denial of Service) attack is still an important vulnerable element in many web service sites, sites including public institution should try their best in constructing defensive systems. Recently, DDoS(Distributed Denial of Service) has been raised by prompting mass network traffic that uses NTP's monlist function or DoS attack has been made related to the DNS infrastructure which is impossible for direct defense. For instance, in June 2013, there has been an outbreak of an infringement accident where Computing and Information Agency was the target. There was a DNS application DoS attack which made the public institution's Information System impossible to run its normal services. Like this, since there is a high possibility in having an extensive damage due to the characteristics of DDoS in attacking unspecific information service and not being limited to a particular information system, efforts have to be made in order to minimize cyber threats. This thesis proposes a method for using TTL (Time To Live) value in IP header to detect DDoS attack with IP spoofing, which occurs when data is transmitted under the agreed regulation between the international and domestic information system.

• Annual Conference of KIPS
• /
• 2011.04a
• /
• pp.862-865
• /
• 2011

지난 3 월 3 일 발생한 분산서비스 거부 공격의 경우 보안 패치 업데이트를 방해하는 현상이 신고되어 공격 시작 전에 악성코드가 분석됨으로 초동 대응이 가능하였다. 하지만 일반적인 분산서비스 거부 공격은 이러한 초동 분석이 불가능한 경우가 대부분이다. 따라서 네트워크에서 공격 트래픽을 효과적으로 탐지 차단하는 DDoS 탐지 엔진이 필요하다. 또한 빠른 트래픽 증가로 인하여 10Gbps Ethernet 사용이 일반화 되고 있고, 이미 수 백 Gbps 의 공격 트래픽이 수시로 발생하고 있다. 본 논문에서는 선로 속도 10Gbps 성능의 분산서비스거부 공격 탐지 칩 셋의 구현에 대해 기술한다. 칩 구현을 위한 고려 사항, 엔진 구조, 하드웨어 합성 결과 및 시스템에 장착된 칩의 성능에 대하여 소개하고자 한다.

• Journal of the Korea Society of Computer and Information
• /
• v.11 no.6 s.44
• /
• pp.185-192
• /
• 2006

By mistaking normal packets for harmful traffic, it may not offer service according to the intention of attacker with harmful traffic, because it is not easy to classify network traffic for normal service and it for DUoS(Distributed DoS) attack like the Internet worm. And in the IPv6 environment these researches on harmful traffic are weak. In this dissertation, hosts in the IPv6 environment are attacked by NETWIB and their attack traffic is monitored, then the statistical information of the traffic is obtained from MIB(Management Information Base) objects used in the IPv6. By adapting the ESM(Exponential Smoothing Method) to this information, a normal traffic boundary, i.e., a threshold is determined. Input traffic over the threshold is thought of as attack traffic.

• Convergence Security Journal
• /
• v.9 no.4
• /
• pp.7-12
• /
• 2009

It is very difficult to completely block the DDoS attack, which paralyzes services by depleting resources or occupying the network bandwidth by transmitting a vast amount of traffic to the specific website or server from normal users' PCs that have been already infected by an outside attacker. In order to defense or endure the DDoS attack, we usually use various solutions such as IDS (Intrusion Detection System), IPS (Intrusion Prevention System), ITS (Intrusion Tolerance System), FW (Firewall), and the dedicated security equipment against DDoS attack. However, diverse types of security appliances cause the cost problem, besides, the full function of the equipments are not performed well owing to the unproper setting without considering connectivity among systems. In this paper, we present the effective connectivity of security equipments and countermeasure methodology against DDoS attack. In practice, it is approved by experimentation that this designed methdology is better than existing network structure in the efficiency of block and endurance. Therefore, we would like to propose the effective security control measures responding and enduring against discriminated DDoS attacks through this research.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.17 no.10
• /
• pp.732-742
• /
• 2016

This study suggests methods of defense against low-level high-bandwidth DDoS attacks by adding a solution with a time limit factor (TLF) to an existing high-bandwidth DDoS defense system. Low-level DDoS attacks cause faults to the service requests of normal users by acting as a normal service connection and continuously positioning the connected session. Considering this, the proposed method makes it possible for users to show a down-related session by considering it as a low-level DDoS attack if the abnormal flow is detected after checking the amount of traffic. However, the service might be blocked when misjudging a low-level DDoS attack in the case of a communication fault resulting from a network fault, even with a normal connection status. Thus, we made it possible to reaccess the related information through a certain period of blocking instead of a drop through blacklist. In a test of the system, it was unable to block the session because it recognized sessions that are simply connected with a low-level DDoS attack as a normal communication.

• Proceedings of the Korean Information Science Society Conference
• /
• 2008.06a
• /
• pp.124-127
• /
• 2008

DoS/DDoS로 대표되는 트래픽 폭주 공격은 대상 시스템뿐만 아니라 네트워크 대역폭, 프로세서 처리능력, 시스템 자원 등에 악영향을 줌으로써 네트워크에 심각한 장애를 유발할 수 있다. 따라서 신속한 트래픽 폭주 공격의 탐지는 안정적인 서비스 제공 및 시스템 운영에 필수요건이다. 전통적인 패킷 수집을 통한 DoS/DDoS의 탐지방법은 공격에 대한 상세한 분석은 가능하나 설치의 확장성 부족, 고가의 고성능 분석시스템의 요구, 신속한 탐지를 보장하지 못한다는 문제점을 갖고 있다. 본 논문에서는 15초 단위의 SNMP MIB 객체 정보를 바탕으로 SVDD(support vector data description)를 이용하여 보다 빠르고 정확한 침입탐지와 쉬운 확장성, 저비용탐지 및 정확한 공격유형별 분류를 가능케 하는 새로운 시스템을 설계 및 구현하였다. 실험을 통하여 만족스러운 침입 탐지율과 안전한 false negative rate, 공격유형별 분류율 수치 등을 확인함으로써 제안된 시스템의 성능을 검증하였다.