• 한국컴퓨터정보학회논문지
• /
• 제24권9호
• /
• pp.35-42
• /
• 2019

In this paper, we propose an approach to apply network-based moving target defense into Internet of Things (IoT) networks. The IoT is a technology that provides the high interconnectivity of things like electronic devices. However, cyber security risks are expected to increase as the interconnectivity of such devices increases. One recent study demonstrated a man-in-the-middle attack in the statically configured IoT network. In recent years, a new approach to cyber security, called the moving target defense, has emerged as a potential solution to the challenge of static systems. The approach continuously changes system's attack surface to prevent attacks. After analyzing IPv4 / IPv6-based moving target defense schemes and IoT network-related technologies, we present our approach in terms of addressing systems, address mutation techniques, communication models, network configuration, and node mobility. In addition, we summarize the direction of future research in relation to the proposed approach.

• 한국컴퓨터정보학회논문지
• /
• 제23권9호
• /
• pp.57-64
• /
• 2018

In recent years, a new approach to cyber security, called the moving target defense, has emerged as a potential solution to the challenge of static systems. In this paper, we design a protected server network with a large number of decoys to anonymize the protected servers that dynamically mutate their IP address and port numbers according to Hidden Tunnel Networking, which is a network-based moving target defense scheme. In the network, a protected server is one-to-one mapped to a decoy-bed that generates a number of decoys, and the decoys share the same IP address pool with the protected server. First, the protected server network supports mutating the IP address and port numbers of the protected server very frequently regardless of the number of decoys. Second, it provides independence of the decoy-bed configuration. Third, it allows the protected servers to freely change their IP address pool. Lastly, it can reduce the possibility that an attacker will reuse the discovered attributes of a protected server in previous scanning. We believe that applying Hidden Tunnel Networking to protected servers in the proposed network can significantly reduce the probability of the protected servers being identified and compromised by attackers through deploying a large number of decoys.

• 한국컴퓨터정보학회논문지
• /
• 제22권10호
• /
• pp.83-92
• /
• 2017

Reconnaissance is performed gathering information from a series of scanning probes where the objective is to identify attributes of target hosts. Network reconnaissance of IP addresses and ports is prerequisite to various cyber attacks. In order to increase the attacker's workload and to break the attack kill chain, a few proactive techniques based on the network-based moving target defense (NMTD) paradigm, referred to as IP address mutation/randomization, have been presented. However, there are no commercial or trial systems deployed in real networks. In this paper, we propose a threat model and the request for requirements for developing NMTD techniques. For this purpose, we first examine the challenging problems in the NMTD mechanisms that were proposed for the legacy TCP/IP network. Secondly, we present a threat model in terms of attacker's intelligence, the intended information scope, and the attacker's location. Lastly, we provide seven basic requirements to develop an NMTD mechanism for the legacy TCP/IP network: 1) end-host address mutation, 2) post tracking, 3) address mutation unit, 4) service transparency, 5) name and address access, 6) adaptive defense, and 7) controller operation. We believe that this paper gives some insight into how to design and implement a new NMTD mechanism that would be deployable in real network.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제14권10호
• /
• pp.4157-4175
• /
• 2020

Moving target defense, as a 'game-changing' security technique for network warfare, realizes proactive defense by increasing network dynamics, uncertainty and redundancy. How to select the best countermeasure from the candidate countermeasures to maximize defense payoff becomes one of the core issues. In order to improve the dynamic analysis for existing decision-making, a novel approach of selecting the optimal countermeasure using game theory is proposed. Based on the signal game theory, a multi-stage adversary model for dynamic defense is established. Afterwards, the payoffs of candidate attack-defense strategies are quantified from the viewpoint of attack surface transfer. Then the perfect Bayesian equilibrium is calculated. The inference of attacker type is presented through signal reception and recognition. Finally the countermeasure for selecting optimal defense strategy is designed on the tradeoff between defense cost and benefit for dynamic network. A case study of attack-defense confrontation in small-scale LAN shows that the proposed approach is correct and efficient.

• 한국컴퓨터정보학회논문지
• /
• 제24권10호
• /
• pp.25-32
• /
• 2019

본 논문에서는 보호대상 서버 네트워크에 디코이 트랩을 통한 공격 표면 확장의 적용 방법을 제안한다. 보호대상 서버 네트워크는 많은 수의 디코이들과 보호대상 서버로 구성되며, 각 보호대상 서버는 Hidden Tunner Networking이라는 네트워크 기반 이동 표적 방어 기법에 따라 IP 주소와 포트 번호를 변이한다. 이동 표적 방어는 공격을 막기 위하여 지속적으로 시스템의 공격 표면을 변경하는 사이버 보안에서의 새로운 접근방법이다. 공격 표면 확장은 공격을 막기 위해 디코이와 디코이 그룹을 활용하는 접근방법이다. 제안하는 방법에서는 공격자가 디코이 트랩에서 공격자의 모든 시간과 노력을 허비하도록 커스텀 체인과 RETURN 타켓을 사용하여 보호대상 서버의 NAT 테이블을 수정한다. 본 논문에서는 제안하는 방법이 적용되기 전과 후에 보호대상 서버 네트워크에서의 공격자 성공률을 수식으로 계산한다. 제안하는 방법은 보호대상 서버가 공격자에 의해 식별되고 공격당할 확률을 현저히 줄일 것으로 기대된다.

• 정보보호학회논문지
• /
• 제28권2호
• /
• pp.485-500
• /
• 2018

시스템 및 네트워크 환경의 규모가 확대되고, 네트워크 구조 및 시스템 구성이 빈번하게 변화함에 따라 네트워크 관리자가 현황을 수동으로 관리하고 실시간 변동사항을 식별하는 데에 많은 어려움이 발생하고 있다. 본 논문에서는 동적인 네트워크 정보를 실시간으로 스캔하고, 사전에 수집한 취약점 정보를 바탕으로 네트워크 내 장치의 취약성 정도를 점수화하고 최종적으로 공격자의 입장에서 공격 가능한 모든 경로를 도출하여 네트워크 관리자에게 공격 가능성이 높은 경로 목록을 제공하는 알고리즘을 제안하였다. 또한 제안하는 알고리즘을 토대로 한 Attack Graph를 실제로 구현하였으며, Software Defined Networking (SDN) 환경이 포함된 동적으로 변화하는 가상 네트워크 환경을 구축한 후 시뮬레이션을 진행하여 Moving Target Defense (MTD) 개념이 반영된 시스템에도 적용이 가능함을 입증하였다.

• 전자통신동향분석
• /
• 제32권6호
• /
• pp.73-82
• /
• 2017

Moving Target Defense(MTD) is a novel security technology concept in which the IT infrastructure changes its form actively and prevents various types of cyber attacks. Network address moving technology is the field that has been most actively researched in terms of MTD. A number of studies on network address moving published over the last decade have suggested a virtual address-based network address moving technology for efficiency in the implementation. However, virtual address-based network address moving technology has serious vulnerabilities in terms of security and availability. This paper examines the technological characteristics of the existing studies and analyzes their limitations. It suggests security requirements to be considered when designing the network address moving technology through a technological analysis.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제17권11호
• /
• pp.3163-3181
• /
• 2023

Eavesdropping attacks have seriously threatened network security. Attackers could eavesdrop on target nodes and link to steal confidential data. In the traditional network architecture, the static routing path and the important nodes determined by the nature of network topology provide a great convenience for eavesdropping attacks. To resist monitoring attacks, this paper proposes a random routing mutation defense method based on dynamic path weight (DPW-RRM). It utilizes network centrality indicators to determine important nodes in the network topology and reduces the probability of important nodes in path selection, thereby distributing traffic to multiple communication paths, achieving the purpose of increasing the difficulty and cost of eavesdropping attacks. In addition, it dynamically adjusts the weight of the routing path through network state constraints to avoid link congestion and improve the availability of routing mutation. Experimental data shows that DPW-RRM could not only guarantee the normal algorithmic overhead, communication delay, and CPU load of the network, but also effectively resist eavesdropping attacks.

• 정보보호학회논문지
• /
• 제33권6호
• /
• pp.939-946
• /
• 2023

IT 기술이 급속히 발전하는 현대 초연결 환경은 네트워크 장비들이 다양해지고 네트워크 구성이 복잡해짐에 따라 사이버 공격자가 침투경로로 활용될 수 있는 공격표면(attack surface) 또한 증가하게 되었다. 이러한 환경에서 사이버 공격을 원천적으로 방어하기 위해 공격표면을 변이하는 MTD(Moving Target Defense) 기술이 연구되고 있다. 그중에 네트워크를 통해 공격이 시작됨에 따라 주요 속성 네트워크 주소를 변이하는 기술이 있으나, 대부분 운용환경이 기존 고정 IP 기반으로 운용되기 때문에 주소변이 기술이 기존 네트워크 보호체계 내에 적용되었을 때 어떠한 영향이 있는지 연구가 필요하다. 본 논문에서는 기존 네트워크 보호체계에서 네트워크 주소변이 기술이 적용되었을 때의 영향성을 연구하였고 연구 결과로서 네트워크 보호체계의 주요 시스템인 방화벽, NAC, IPS와 네트워크 주소변이 기술이 동시 적용되었을 때 운용 측면에서 고려해야 할 요소를 도출하였다. 또한 사이버 대응체계 내에서 네트워크 분석시스템과의 연동성을 위해 네트워크 주소변이 기술에서 관리해야하는 요소를 제안하였다.

• 한국멀티미디어학회논문지
• /
• 제22권3호
• /
• pp.357-365
• /
• 2019

In this paper, we suggest the tracking method of moving multi-objects in maritime environments. The image acquisition is conducted using IR(InfraRed) camera sensors on an airborne platform. Under the circumstance of maritime, the qualities of IR images can be significantly degraded due to the clutter influence, which directly gives rise to a tracking loss problem. In order to reduce the effects from the clutters, we introduce a technical approach under Man-In-The-Loop(MITL) system for enhancing the tracking performance. To demonstrate the robustness of the proposed approach based on VTG(Valid Tracking Gate), the simulations are conducted utilizing the airborne IR video sequences: Then, the tracking performances are compared with the existing Kalman Filter tracking techniques.