• Journal of Korea Multimedia Society
• /
• v.15 no.2
• /
• pp.226-233
• /
• 2012

Recently, Like we saw with 3.4 DDoS Cyber Terror, a behavior of cyber terror becomes increasingly more complicated, sophisticated and larger, and there has been largely damage on industry, the general economy. For responding cyber terrors which occur in the future, we should recognize security holes of system which isn't exposed yet before attacker in advance as we anticipate and implement new technique of cyber attack which not exist hitherto. We design and implement a new technique of cyber attack; it seems to us that a server denies agent' service by altering value of registry in windows system. Network connections of agent are restricted to the new technique we suggest as the a value of registry is changed to a less value than a necessary value and there has happened packet loss by attacker.

• The Journal of Korea Institute of Information, Electronics, and Communication Technology
• /
• v.4 no.3
• /
• pp.182-188
• /
• 2011

Recently Yoon et al. proposed the remote user authentication scheme using smart cards. But their scheme has not satisfied security requirements which should be considered in the user authentication scheme using the password based smart card. In this paper, we prove that Yoon et al.'s scheme is vulnerable to a password guessing attack in case that the attacker steals the user's smart card and extracts the information from the smart card. Accordingly, this paper proposes the improved user authentication scheme based on the hash functin and random nonce that can withstand various possible attacks including a password guessing attack. The result of comparative analysis demonstrates that the proposed scheme is more secure and efficient than Yoon et al.'s scheme, with a trivial trade-off to require just a few more exclusive-OR operations.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.11 no.5
• /
• pp.131-137
• /
• 2011

Recently Lin et al. proposed a simple remote user authentication scheme using smart cards. But the proposed scheme has not satisfied security requirements which should be considered in the user authentication scheme using the password based smart card. In this paper, we show that Lin et al.'s scheme is insecure against off-line password guessing attack. In their scheme, any legal user's password may be derived from the password guessing when his/her smart card is stolen and the secret information is leaked from the smart card by an attacker. Accordingly, we demonstrate the vulnerability of their scheme and present an enhancement to resolve such security weakness. Our proposed scheme can withstand various possible attacks including password guessing attack. Furthermore, this improved scheme can provide mutual authentication to improve the security robustness. Performance evaluation shows that the proposed scheme is relatively more effective than Lin et al.'s scheme.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.23 no.2
• /
• pp.207-214
• /
• 2019

The speed of technological development is increasing, and high-performance digital devices are spreading. Wired digital devices such as PCs have been optimized for existing wired environments, but needs are shifting away from the constraints of space and space to smart work that enables efficient work anywhere and anytime. The Smart Work System security design is needed to secure integrity and availability in the face of various security threats including physical threats (lost, stolen, and damaged terminals), technical threats (data theft, DoS: denial of service), and unauthorized access outside the wired environment. In this study, we analyzed smart work network systems, wired / wireless link systems, and digital smart devices. We also studied cyber-attack analysis and cybersecurity design methods for a Smart Work wired system and a future wireless system. This study will be used as basic data for building a secure Smart Work system.

• KIPS Transactions on Computer and Communication Systems
• /
• v.4 no.4
• /
• pp.135-140
• /
• 2015

The WDSS improves defensive capacity against web application layer DDoS attack by using web cache server and L7 switch which are added on the DDoS shelter system. When web DDoS attack occurs, security agents divert traffic from backbone network to sub-network of the WDSS and then DDoS protection device and L7 switch block abnormal packets. In the meantime, web cache server responds only to requests of normal clients and maintains stable web service. In this way, the WDSS can counteract the web DDoS attack which generates small traffic and depletes server-client session resource. Furthermore, the WDSS does not require IP tunneling because it is not necessary to retransfer the normal requests to original web server. In this paper, we validate operation of the WDSS and verify defensive capability against web application layer DDoS attacks. In order to do this, we built the WDSS on backbone network of an ISP. And we performed web DDoS tests by using a testing system that consists of zombie PCs. The tests were performed by three types and various amounts of web DDoS attacks. Test results suggest that the WDSS can detect small traffic of the web DDoS attacks which do not have repeat flow whereas the formal DDoS shelter system cannot.

• Journal of Korea Multimedia Society
• /
• v.16 no.6
• /
• pp.678-688
• /
• 2013

Different Different from a single attack, in DDoS Attacks, the botnets that are distributed on network initiate attacks against the target server simultaneously. In such cases, it is difficult to take an action while denying the access of packets that are regarded as DDoS since normal user's convenience should also be considered at the target server. Taking these considerations into account, the DDoS botnet detection system that can reduce the strain on the target server by detecting DDoS attacks on each user network basis, and then lets the network administrator to take actions that reduce overall scale of botnets, has been implemented in this study. The DDoS botnet detection system proposed by this study implemented the program which detects attacks based on the database composed of faults and abnormalities collected through analyzation of hourly attack traffics. The presence of attack was then determined using the threshold of current traffic calculated with the standard deviation and the mean number of packets. By converting botnet-based detection method centering around the servers that become the targets of attacks to the network based detection, it was possible to contemplate aggressive defense concept against DDoS attacks. With such measure, the network administrator can cut large scale traffics of which could be referred as the differences between DDoS and DoS attacks, in advance mitigating the scale of botnets. Furthermore, we expect to have an effect that can considerably reduce the strain imposed on the target servers and the network loads of routers in WAN communications if the traffic attacks can be blocked beforehand in the network communications under the router equipment level.

• Convergence Security Journal
• /
• v.18 no.1
• /
• pp.117-128
• /
• 2018

The purpose of this paper is to analyze the behavior of North Korea's cyber attack against South Korea since 2009 based on major international security theories and suggest South Korea's policy option. For this purpose, this paper applied the behavioral domain and characteristics of 'cyber power' and 'coercion dynamics' model, which are attracting attention in international security studies. The types of cyber attacks from North Korea are classified into the following categories: power-based incarceration, leadership attacks and intrusions, military operations interference, and social anxiety and confusion. In terms of types and means of cyber power, North Korean GPS disturbance, the Ministry of Defense server hacking and EMP are hard power with high retaliation and threat and cyber money cashing and ransomware are analyzed by force in the act of persuasion and incentive in the point of robbing or asking for a large amount of money with software pawns. North Korea 's cyber attack has the character of escape from realistic sanctions based on the second nuclear test. It is important for South Korea to clearly recognize that the aggressive cyberpower of North Korea is changing in its methods and capabilities, and to ensure that North Korea's actions result in far greater losses than can be achieved. To do this, it is necessary to strengthen the cyber security and competence to simultaneously attack and defend through institutional supplement and new establishment such as cyber psychological warfare, EMP attack preparation, and enhancement of security expertise against hacking.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.3
• /
• pp.325-336
• /
• 2020

Nonlinear Invariant Attack is an attack that should be considered when constructing lightweight block ciphers with relatively simple key schedule. A shortcut to prove a block cipher's resistance against nonlinear invariant attack is checking the smallest dimension of linear layer-invariant linear subspace which contains all known differences between round keys is equal to the block size. In this paper, we presents the following results. We identify the structure and number of optimal bit-permutations which require only one known difference between round keys for a designer to show that the corresponding block cipher is resistant against nonlinear invariant attack. Moreover, we show that PRESENT-like block ciphers need at least two known differences between round keys by checking all PRESENT-like bit-permutations. Additionally, we verify that the variants of PRESENT-like bit-permutations requiring the only two known differences between round keys do not conflict with the resistance against differential attack by comparing the best differential trails. Finally, through the distribution of the invariant factors of all bit-permutations that maintain BOGI logic with GIFT S-box, GIFT-variant block ciphers require at least 8 known differences between round keys for the resistance.

• Journal of the Korea Society of Computer and Information
• /
• v.18 no.11
• /
• pp.39-49
• /
• 2013

In this paper, security mechanism of internal network(CAN) of vehicle is a very incomplete state and the possibility of external threats as a way to build a test environment that you can easily buy from the market by the vehicle's ECU(Electric Control Unit) to verify and obtain a CAN message. Then, by applying it to ECU of the real car to try to attack is proposed. A recent study, Anyone can see plain-text status of the CAN message in the vehicle. so that in order to verify the information is vulnerable to attack from outside, analyze the data in a vehicle has had a successful attack, but attack to reverse engineering in the stationary state and buying a car should attempt has disadvantages that spatial, financial, and time costs occurs. Found through the car's ECU CAN message is applied to a real car for Potential threats outside of the car to perform an experiment to verify and equipped with a wireless network environment, the experimental results, proposed method through in the car to make sure the attack is possible. As a result, reduce the costs incurred in previous studies and in the information absence state of the car, potential of vehicle's ECU attack looks.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.04a
• /
• pp.287-289
• /
• 2003

최근 인터넷을 통한 사이버 공격의 형태가 다양해지고 복잡해지면서 효과적인 탐지 및 대응이 어려워지고 있다. 특히 UDP 계열의 DoS. DDoS 공격에서 IP 패킷 내의 근원지 IP 주소를 타인의 IP 주소로 위조하여 공격하는 경우 패킷의 실제 송신자를 추적하고 고립화 시키는 것은 불가능하다. 본 논문에서는 이러한 공격에 쉽게 대응할 수 있는 보안 구조로서 액티브 네트워크를 이용한 보안 관리 프레임워크를 설계하고, 위조 IP 공격에 보다 능동적인 대응이 가능한 메커니즘을 제안한다.