• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2004.05b
• /
• pp.412-415
• /
• 2004

As computers and networks become popular, corporation or country organization composes security network including various kinds information protection system to protect informations and resources from internet and is operating system and network. But current firewall and IDS(Intrusion Detection System) of the network level suffers from many vulnerabilities in internal computing informations and resources. In this paper, we design of ICMP-based Traceback System using a ICMP Traceback Message for efficiently traceback without change structure of routers. ICMP-based Traceback System. Create of ICMP message is managed by “Traceback Agent” mirroring port for router. Victim's systems that are received the message store it and “Traceback Manager” is detect a attack(like a DDoS). Using a information of this message starting a traceback and detecting a source of attacker, so response a attack.

• Proceedings of the KAIS Fall Conference
• /
• 2010.05a
• /
• pp.214-217
• /
• 2010

DDoS(distributed denial of service)공격은 1990년 중반에 처음 나타나기 시작하여 1,2세대 네트워크 자체에 대한 트래픽 폭주형태의 공격에서부터 3세대 봇넷을 이용하여 특정 서버와 특정서비스를 마비시키기 위한 공격을 거쳐 4세대의 분산 형식의 C&C를 이용하는 공격의 유형으로 발전 하고 있다. DDoS공격은 점점 지능화 되고 있으며 기존의 IDS(Intrusion Detection System) 시스템을 이용한 탐지방법으로 공격을 탐지하기에는 어려움이 존재한다. 본 논문은 IDS시스템을 보다 더 지능화시키기 위한 논문으로 IDS는 내부시스템으로부터 쿼리를 넘겨받아 업데이트를 수행하고 업데이트를 수행함과 동시에 라우터에게 C&C서버로부터 나오는 패킷을 차단하도록 알려 준다. 즉, IDS에서 일어나는 False Negative문제를 줄여줌으로써 DDoS 공격에 대하여 Zombie시스템을 생성하지 못하도록 하고자 하는데 그 목적이 있으며 점점 지능화되어 가고 있는 DDoS공격에 대하여 차단을 하고자 하는 방향성을 제시하고 있다.

• The Transactions of the Korea Information Processing Society
• /
• v.6 no.12
• /
• pp.3606-3612
• /
• 1999

System(IDS) hasn't Protection capability for various security attacks perfectly. Because, It is probably affected by IDS's workload caused by treating all kind of the characteristics and attack patterns of system and can't probe all of the attack types being intelligently different with attack patterns. In this paper, we propose a new taxonomy criteria about DoS(denial of service attacks) to make more efficient and new real time probing system. It's started with an idea that most of the goal oriented systems make the state of system operation more unambiguous than general purpose system. A new event caused the state of the system operation to change and classifying a category of the new events may contribute to design the IDS.

• Korean Security Journal
• /
• no.60
• /
• pp.113-135
• /
• 2019

Despite being one of the most important national facilities, the National Assembly building of the Republic of Korea has become increasingly vulnerable to potential terrorist attacks, and the instances of demonstrations occurring around and banned items taken into the building are continuing to rise. In addition, promoting the idea of "open assembly" has led to increased visitors and weakened access control. Furthermore, while there is a significant symbolic value attached to attacking the National Assembly building, the level of security management is relatively very low, making it a suitable target for terrorism. In order to address such vulnerability, an appropriate access control system should be in place from the areas surrounding the building. However, the National Assembly Security Service which oversees security around the building is scheduled to disband in June 2020 following the abolition of the conscripted police force in 2023. Therefore, there needs to be an alternative option to bolster the security system outside the facility. In this research, the perceptions of 114 government officials in charge of security at the National Assembly Secretariat toward the protection and security system of the areas surrounding the National Assembly building were examined. Results showed that the respondents believed it was highly likely that risky situations could occur outside the building, and the use of advanced technologies such as intelligent video surveillance, intrusion detection system, and drones was viewed favorably. Moreover, a mid- to long-term plan of establishing a unified three-layer protection system and designating a department in charge of the security outside the building were perceived positively. Lastly, the participants supported the idea of employing private police to replace the National Assembly Security Service for the short term and introducing parliamentary police for the mid- to long-term.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2007.06a
• /
• pp.773-777
• /
• 2007

Very various infusion by development of systems that is based on network is spread. Therefore, Evaluation Tool has been an active research area to reduce the risk from intrusion. On this thesis, during threat assesment, we have planned possible an equal-weight applied assesment and considering the characteristics of the organization an assesment which security factor's weight is variably applied to, and respective organizations to examine its security by itself in order to support the easy findings of the vulnerabilities on the management point of view, and to show the advices to practice.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.10a
• /
• pp.745-747
• /
• 2003

RBAC(Role-Base Access Control)은 호스트상의 유저(User)들에게 Role을 적용하여 호스트를 분산 관리하는 방식이다. 본 논문에서는 RBAC방식을 응용하여 Role을 네트워크의 호스트에 적용해서 네트워크 자원 사용에 제한을 두는 침입차단 방식을 제안한다. 그리고 Rule의 적용을 메뉴화하여 선택함으로 Rule적용의 편이성에 기여하는 불법적이고 불필요한 사용을 방어할 수 있는 네트워크 침입차단 시스템을 설계 및 구현을 한다.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.14 no.2
• /
• pp.11-17
• /
• 2018

IDS/IPS and networked computer systems are playing an increasingly important role in our society. They have been the targets of a malicious attacks that actually turn into intrusions. That is why computer security has become an important concern for network administrators. Recently, various Detection/Prevention System schemes have been proposed based on various technologies. However, the techniques, which have been applied in many systems is useful for existing intrusion patterns on standard-only systems. Therefore, probe detection of private clouds using BlockChain has become a major security protection technology to detection potential attacks. In addition, BlockChain and Probe detection need to take into account the relationship between the various factors. We should develop a new probe detection technology that uses BlockChain to fine new pattern detection probes in cloud service security in the end. In this paper, we propose a probe detection using Fuzzy Cognitive Map(FCM) and Self Adaptive Module(SAM) based on service security using BlockChain technology.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.10 no.3
• /
• pp.1229-1248
• /
• 2016

With the feature of convenience and low cost, remote healthcare monitoring (RHM) has been extensively used in modern disease management to improve the quality of life. Due to the privacy of health data, it is of great importance to implement RHM based on a secure and dependable network. However, the network connectivity of existing RHM systems is unreliable in disaster area because of the unforeseeable damage to the communication infrastructure. To design a secure RHM system in disaster area, this paper presents a Secure VANET-Assisted Remote Healthcare Monitoring System (SVC) by utilizing the unique "store-carry-forward" transmission mode of vehicular ad hoc network (VANET). To improve the network performance, the VANET in SVC is designed to be a two-level network consisting of two kinds of vehicles. Specially, an innovative two-level key management model by mixing certificate-based cryptography and ID-based cryptography is customized to manage the trust of vehicles. In addition, the strong privacy of the health information including context privacy is taken into account in our scheme by combining searchable public-key encryption and broadcast techniques. Finally, comprehensive security and performance analysis demonstrate the scheme is secure and efficient.

• The Journal of the Korea institute of electronic communication sciences
• /
• v.17 no.2
• /
• pp.219-228
• /
• 2022

One of the most pressing and demanding issues today in the conditions of widespread transformation and digitalization of spheres of human activity is information security and ensuring the integrity of data. The main research and development in the field of information security is aimed at improving efficiency and rationalization. One of the main means of data transmission and operation of information complexes are fiber-optic systems. To date, there have been incidents of illegal intrusion and theft of information, passing through this type of communication. Thus, today there is a problem associated with insufficient information security in fiber-optic data transmission systems. One of the most effective tools to counter acts of illegal interference in systems are artificial intelligence and cryptographic algorithms of information protection. It is the symbiosis of these two tools that can qualitatively improve the level of information security in fiber-optic data transmission systems. Thus, the authors of this article pursue the goal associated with the description of an innovative system for protecting information from violations in fiber-optic data transmission systems based on the integration of intelligent cryptographic algorithms.

• Journal of Internet Computing and Services
• /
• v.19 no.1
• /
• pp.1-10
• /
• 2018

Network threats such as Internet worms and computer viruses have been significantly increasing. In particular, APTs(Advanced Persistent Threats) and ransomwares become clever and complex. IDSes(Intrusion Detection Systems) have performed a key role as information security solutions during last few decades. To use an IDS effectively, IDS rules must be written properly. An IDS rule includes a key signature and is incorporated into an IDS. If so, the network threat containing the signature can be detected by the IDS while it is passing through the IDS. However, it is challenging to find a key signature for a specific network threat. We first need to analyze a network threat rigorously, and write a proper IDS rule based on the analysis result. If we use a signature that is common to benign and/or normal network traffic, we will observe a lot of false alarms. In this paper, we propose a scheme that analyzes a network threat and extracts key signatures corresponding to the threat. Specifically, our proposed scheme quantifies the degree of correspondence between a network threat and a signature using the LDA(Latent Dirichlet Allocation) algorithm. Obviously, a signature that has significant correspondence to the network threat can be utilized as an IDS rule for detection of the threat.