• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.35 no.1B
• /
• pp.8-19
• /
• 2010

In this paper, we propose the NCP (Network Control Platform)-based defense mechanism against DDoS (Distributed Denial of Service) attacks in order to guarantee the transmission of normal traffic and prevent the flood of abnormal traffic. We also define defense modules, the threshold and packet drop-rate used for the response against DDoS attacks. NCP analyzes whether DDoS attacks are occurred or not based on the flow and queue information collected from SR (Source Router) and VR (Victim Router). Attack packets are dopped according to drop rate decided from NCP. The performance is simulated using OPNET and evaluated in terms of the queue size of both SR and VR, the transmitted volumes of legitimate and attack packets at SR.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.10 no.12
• /
• pp.5529-5552
• /
• 2016

Mobile cloud computing (MCC) has revolutionized the way in which the services can be obtained from the cloud service providers. Manifold increase in the number of mobile devices and subscribers in MCC has further enhanced the need of an efficient and robust authentication solution. Earlier, the subscribers could get cloud-computing services from the cloud service providers only after having consulted the trusted third party. Recently, Tsai and Lo has proposed a multi-server authenticated key agreement solution for MCC based on bilinear pairing, to eliminate the trusted third party for mutual authentication. The scheme has been novel as far as the minimization of trusted party involvement in authenticating the user and service provider, is concerned. However, the Tsai and Lo scheme has been found vulnerable to server spoofing attack (misrepresentation attack), de-synchronization attack and denial-of-service attack, which renders the scheme unsuitable for practical deployment in different wireless mobile access networks. Therefore, we have proposed an improved model based on bilinear pairing, countering the identified threats posed to Tsai and Lo scheme. Besides, the proposed work also demonstrates performance evaluation and formal security analysis.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2011.04a
• /
• pp.1001-1004
• /
• 2011

Denial of Service (DoS) 공격은 현재 심각한 국가적 보안 문제로 떠오르고 있다. DoS 란, 많은양의 네트워크 트래픽을 발생시켜 속도를 매우 느리게 만들거나, 가용 자원을 고갈시켜 사용자에게 서비스를 정상적으로 제공하지 못하도록 만드는 공격이다. 그 중에서 Distributed Denial of Service (DDoS)는 네트워크에 분산된 컴퓨터들을 감염시켜 공격에 사용하기 때문에 더 위험하다. DDoS 종류 중 한가지인 Smurf Attack 은 ICMP ECHO 와 IP 브로드캐스트를 이용하여 많은 양의 트래픽을 발생시킨다. 본 논문에서는 Smurf Attack 에 쓰이는 ICMP ECHO REQUEST 패킷을 조각화시켜서 전송할 시, 피해자에게 전송되는 패킷의 숫자가 기존 방법보다 증가하고 피해자 컴퓨터의 IP 스택에서 발생하는 취약점을 도출하고 그로 인한 피해를 분석하였다. 끝으로 ICMP ECHO 패킷의 조각화를 방지하기 위한 방안을 제시하였다.

• Journal of Korea Multimedia Society
• /
• v.17 no.8
• /
• pp.988-994
• /
• 2014

Software Defined Network (SDN) is a new technology in computer network area which enables user to centralize control plane. The security issue is important in computer network to protect system from attackers. SYN flooding attack is one of Distributed Denial of Service attack methods which are popular to degrade availability of targeted service on Internet. There are many methods to protect system from attackers, i.e. firewall and IDS. Even though firewall is designed to protect network system, but it cannot mitigate DDoS attack well because it is not designed to do so. To improve performance of DDOS mitigation we utilize another mechanism by using SDN technology such as OpenFlow and sFlow. The methodology of sFlow to detect attacker is by capturing and sum cumulative traffic from each agent to send to sFlow collector to analyze. When sFlow collector detect some traffics as attacker, OpenFlow controller will modify the rule in OpenFlow table to mitigate attacks by blocking attack traffic. Hence, by combining sum cumulative traffic use sFlow and blocking traffic use OpenFlow we can detect and mitigate SYN flooding attack quickly and cheaply.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.15 no.8
• /
• pp.5256-5262
• /
• 2014

Recently, Distributed Denial of Service (DDoS) attacks, such as spreading malicious code, cyber-terrorism, have occurred in government agencies, the press and the financial sector. DDoS attacks are the simplest Internet-based infringement attacks techniques that have fatal consequences. DDoS attacks have caused bandwidth consumption at the network layer. These attacks are difficult to detect defend against because the attack packets are not significantly different from normal traffic. Abnormal traffic is threatening the stability of the network. Therefore, the abnormal traffic by generating indications will need to be detected in advance. This study examined the abnormal traffic detection technique using a forecasting model-based trend model.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.10c
• /
• pp.637-639
• /
• 2003

인터넷이 널리 보급되면서 이용자들간에는 편리하고 빠른 정보교환이 가능하게 되었지만 이를 방해하는 해커들의 활동 또한 크게 증가하고 있다. 그 중 DDoS(Distributed Denial of Service) 공격은 인터넷 서비스를 하고 있는 서버에 심각한 해를 주며 탐지와 대응이 어려운 해킹방법중의 하나이다. 본 연구에서는 DDoS 공격 대응을 위해 액티브 네트워크를 이용해 개발한 DDoS 보안시스템[1][2]을 이용할 때 얼마나 효과적인 성능을 낼 수 있는지에 대한 분석 결과를 제공한다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.04a
• /
• pp.302-304
• /
• 2003

최근 인터넷을 통하여 급속히 확산되고 있는 분산 서비스 거부 공격은 전 세계 웹 사이트들에 큰 피해를 입히면서 세계적인 문제로 부상되었다. 현재 이에 대한 대책으로 방화벽이나 침입 탐지 시스템을 이용하지만. 전 세계에서 동시 다발적으로 일어나는 이 공격을 근본적으로 방지하는 데는 적합지 않다. 이에 본 논문에서는 공격 트래픽의 송신자 주소를 임의의 IP 주소를 사용하여 공격의 발원지를 추적할 수 없는 기존 문제점을 해결할 수 있는 분산 서비스 거부 공격 발원지 자동 추적 모델을 제시하고자 한다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.11 no.4
• /
• pp.2149-2170
• /
• 2017

Application-layer Distributed Denial-of-Service (DDoS) attack is one of the leading security problems in the Internet. In recent years, the attack strategies of application-layer DDoS have rapidly developed. This paper introduces a new attack strategy named Path Vulnerabilities-Based (PVB) attack. In this attack strategy, an attacker first analyzes the contents of web pages and subsequently measures the actual response time of each webpage to build a web-resource-weighted-directed graph. The attacker uses a Top M Longest Path algorithm to find M DDoS vulnerable paths that consume considerable resources when sequentially accessing the pages following any of those paths. A detection mechanism for such attack is also proposed and discussed. A finite-state machine is used to model the dynamical processes for the state of the user's session and monitor the PVB attacks. Numerical results based on real-traffic simulations reveal the efficiency of the attack strategy and the detection mechanism.

• KIPS Transactions on Computer and Communication Systems
• /
• v.2 no.3
• /
• pp.125-132
• /
• 2013

In this paper, We send DDoS(Distributed Denial of Service) attack traffic to real homepages in real networks. We analyze the results of DDoS attack and propose mitigation method against DDoS Attacks. In order to analyze the results of DDoS Attacks, We group three defense level by administrative subjects: Top level defense, Middle level defense, Bottom level defense. Also We group four attack methods by feature. We describe the results that average of attack success rate on defense level and average of attack success rate on attack categories about 48ea homepages and 2ea exceptional cases. Finally, We propose mitigation method against DDoS attack.

• Proceedings of the Korean Information Science Society Conference
• /
• 2004.04a
• /
• pp.310-312
• /
• 2004

분산 서비스 거부 공격(Distributed Denial of Service, DDoS attack)의 목적은 정상적인 사용자가 서비스를 이용하는 것을 거부하는 것이다. 특히 범람 서비스 거부 공격(flooding-based DDoS attack)은 아직까지 방어하기 어려운 공격 형태이다. 그 이유는 공격 시 정상적인 트래픽이 왕복하는 것처럼 보이므로 공격 트래픽과 정상 트래픽을 구별하기 어렵기 때문이다. 하지만, 범람 서비스 거부 공격의 특징을 잘 이용하면 공격을 방어할 수 있다. 범람 서비스 거부 공격의 특징은 단독의 공격 호스트로부터의 트래픽 양이 여러 개의 정상 호스트들로부터의 트래픽 양보다 훨씬 많다는 것이다. 이러한 특징을 이용하여 특정 호스트로부터의 트래픽 양이 많은지 아닌지에 따라 공격이 발생했는지 여부를 결정할 수 있다. 이 논문에서는 Pi(Path Identification) 라는 메커니즘을 이용한 분산 서비스 거부 공격의 방어 기법을 제안한다.