• Proceedings of the Korean Information Science Society Conference
• /
• 1999.10c
• /
• pp.321-323
• /
• 1999

UNIX 시스템에서 로그 시스템은 공격시 쉽게 변경 및 삭제되는 위험성이 있고 제한된 시스템 및 네트워크 정보를 제공하므로, 보다 안전하고 풍부한 정보의 제공을 위해 패킷 필터링을 이용한 로그 시스템 등이 제안되어 왔다. 그러나 기존의 패킷 필터링을 이용한 로그 시스템에서는 모든 패킷을 기록하여 많은 양의 데이터가 발생하였으므로, 관리자가 그 정보를 분석하기란 어려웠다. 본 논문에서는 패킷을 처리하는 과정에서 각종 유형의 침입에 대한 사전 조사와 분석으로 얻은 명령어와 인자들의 결합에 의한 판정 규칙을 적용하여, 위험가능성이 내재된 패킷만을 수집, 기록함으로서 데이터의 양을 줄이고 보다 효율적인 로그 정보를 기록할 수 있었다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2002.11b
• /
• pp.905-908
• /
• 2002

기존의 브리지들은 여러 네트워크를 하나의 네트워크로 묶어주는 역할 만을 하였지만, 패킷을 검사하고 필터링하는 기능은 포함하지 않았다. 본 논문에서는 브리지상에서 패킷을 검사하고 필터링하는 기능을 포함하는 브리지에 대하여 구현하였다.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2003.12a
• /
• pp.128-131
• /
• 2003

본 논문에서는 IP Fragment 패킷을 이용한 공격에 대해서 소개하고, 현재 사용되고 있는 패킷필터링 방법의 문제점을 극복하기 위한 동적인 패킷필터링 기법을 제안하고 있다. 기존 패킷필터링 방법이 IP 주소 또는 프로토콜 기반의 정적인 규칙에 의한 필터링 방법을 이용하는 반면, 본 논문에서 제안하는 방법은 IP Fragment 패킷에 대해서 단위 시간당 데이터 양으로 표현되는 트래픽에 기반한 패킷필터링 규칙이 동적으로 생성되도록 한다. 이렇게 동적으로 생성된 규칙은 이후 이상 트래픽이 발생되면 자동으로 차단규칙으로 변경되어 IP Fragment 패킷 공격으로부터 네트워크 호스트의 시스템 자원을 보호할 수 있도록 한다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2002.10c
• /
• pp.469-471
• /
• 2002

인터넷의 급속한 발전은 우리 생활의 많은 변화를 가져왔다. 특히 사용상의 편리함과 유용성으로 인해 컴퓨터를 전공하지 않은 사랑도 쉽게 접속하여 사용할 수 있게 됨에 따라 악의적인 사용자도 증가하기 시작하였다. 따라서 본문에서는 악의적인 사용자의 접근을 차단할 수 있는 침입 차단 시스템을 설계하고 침입 차단 시스템의 취약점인 TCP Hijacking, IP Spoofing등에도 견딜 수 있는 침입 차단 시스템의 패킷필터링 모듈을 제안한다.

• The KIPS Transactions:PartC
• /
• v.13C no.7 s.110
• /
• pp.821-830
• /
• 2006

As internet worms are spread out worldwide, the detection and filtering of worms becomes one of hot issues in the internet security. As one of implementation methods to detect worms, the Linux Netfilter kernel module can be used. Its basic operation for worm detection is a string matching where coming packet(s) on the network is/are compared with predefined worm signatures(patterns). A worm can appear in a packet or in two (or more) succeeding packets where some part of worm is in the first packet and its remaining part is in its succeeding packet(s). Assuming that the maximum length of a worm pattern is less than 1024 bytes, we need to perform a string matching up to two succeeding packets of 2048 bytes. To do so, Linux Netfilter keeps the previous packet in buffer and performs matching with a combined 2048 byte string of the buffered packet and current packet. As the number of concurrent connections to be handled in the worm detection system increases, the total size of buffer (memory) increases and string matching speed becomes low In this paper, to reduce the memory buffer size and get higher speed of string matching, we propose a string matching scheme without using buffer. The proposed scheme keeps the partial matching result of the previous packet with signatures and has no buffering for previous packet. The partial matching information is used to detect a worm in the two succeeding packets. We implemented the proposed scheme by modifying the Linux Netfilter. Then we compared the modified Linux Netfilter module with the original Linux Netfilter module. Experimental results show that the proposed scheme has 25% lower memory usage and 54% higher speed compared to the original scheme.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.36 no.9A
• /
• pp.790-795
• /
• 2011

The need for broadband wireless data networks such as IEEE 802.16e WiMAX systems increases as a variety of wireless information devices like smart phones are adopted rapidly in everyday life. Since most of mobile applications employ TCP as their transport layer protocol, the performance improvement of TCP in WiMAX systems is crucial. This paper proposes an efficient method to transmit uplink piggyback ACK packets by exploiting the uplink packet buffering which happens because of the resource allocation scheme of the WiMAX systems. The proposed method can support not only the ACK filtering but also the merging of the piggyback ACK packets. As a result, the bandwidth reduction in the piggyback ACK packet transmission leads to the improvement of the downlink throughput. The simulation results show that the bandwidth for the ACK packets reduces more than 90%, and the downlink throughput increases at least 30%.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.13 no.6
• /
• pp.2964-2985
• /
• 2019

Global data center IP traffic is expected to reach 20.6 zettabytes (ZB) by the end of 2021. Intra-data center networks (Intra-DCN) will account for 71.5% of the data center traffic flow and will be the largest portion of the traffic. The understanding of traffic distribution in IntraDCN is still sketchy. It causes significant amount of bandwidth to go unutilized, and creates avoidable choke points. Conventional transport protocols such as Optical Packet Switching (OPS) and Optical Burst Switching (OBS) allow a one-sided view of the traffic flow in the network. This therefore causes disjointed and uncoordinated decision-making at each node. For effective resource planning, there is the need to consider joining the distributed with centralized management which anticipates the system's needs and regulates the entire network. Methods derived from Kalman filters have proved effective in planning road networks. Considering the network available bandwidth as data transport highways, we propose an intelligent enhanced SDN concept applied to OBS architecture. A management plane (MP) is added to conventional control (CP) and data planes (DP). The MP assembles the traffic spatio-temporal parameters from ingress nodes, uses Kalman filtering prediction-based algorithm to estimate traffic demand. Prior to packets arrival at edges nodes, it regularly forwards updates of resources allocation to CPs. Simulations were done on a hybrid scheme (1+1) and on the centralized OBS. The results demonstrated that the proposition decreases the packet loss ratio. It also improves network latency and throughput-up to 84 and 51%, respectively, versus the traditional scheme.

• Journal of Internet Computing and Services
• /
• v.11 no.2
• /
• pp.85-98
• /
• 2010

An advanced and proactive response mechanism against diverse attacks on All-IP network should be proposed for enhancing its security and reliability on open network. There are two main research works related to this study. First one is the SPIE system with hash function on Bloom filter and second one is the Sinkhole routing mechanism using BGP protocol for verifying its transmission path. Therefore, advanced traceback and network management mechanism also should be necessary on All-IP network environments against DDoS attacks. In this study, we studied and proposed a new IP traceback mechanism on All-IP network environments based on existing SPIE and Sinkhole routing model when diverse DDoS attacks would be happen. Proposed mechanism has a Manager module for controlling the regional router with using packet monitoring and filtering mechanism to trace and find the attack packet's real transmission path. Proposed mechanism uses simplified and optimized memory for storing and memorizing the packet's hash value on bloom filter, with which we can find and determine the attacker's real location on open network. Additionally, proposed mechanism provides advanced packet aggregation and monitoring/control module based on existing Sinkhole routing method. Therefore, we can provide an optimized one in All-IP network by combining the strength on existing two mechanisms. And the traceback performance also can be enhanced compared with previously suggested mechanism.

• Journal of Communications and Networks
• /
• v.10 no.4
• /
• pp.455-464
• /
• 2008

To provide network services consistently under various network failures, enterprise networks increasingly utilize path diversity through multi-homing. As a result, multi-homed non-transit autonomous systems become to surpass single-homed networks in number. In this paper, we address an inevitable problem that occurs when networks with multiple entry points deploy firewalls in their borders. The majority of today's firewalls use stateful inspection that exploits connection state for fine-grained control. However, stateful inspection has a topological restriction such that outgoing and incoming traffic of a connection should pass through a single firewall to execute desired packet filtering operation. Multi-homed networking environments suffer from this restriction and BGP policies provide only coarse control over communication paths. Due to these features and the characteristics of datagram routing, there exists a real possibility of asymmetric routing. This mismatch between the exit and entry firewalls for a connection causes connection establishment failures. In this paper, we formulate this phenomenon into a state-sharing problem among multiple fire walls under asymmetric routing condition. To solve this problem, we propose a stateful inspection protocol that requires very low processing and messaging overhead. Our protocol consists of the following two phases: 1) Generation of a TCP SYN cookie marked with the firewall identification number upon a SYN packet arrival, and 2) state sharing triggered by a SYN/ACK packet arrival in the absence of the trail of its initial SYN packet. We demonstrate that our protocol is scalable, robust, and simple enough to be deployed for high speed networks. It also transparently works under any client-server configurations. Last but not least, we present experimental results through a prototype implementation.

• Journal of the Korean Society of Systems Engineering
• /
• v.12 no.2
• /
• pp.101-114
• /
• 2016

A model-based systems engineering (MBSE) approach to implementing hardware-based network cybersecurity controls for APR1400 non-safety data network is presented in this work. The proposed design was developed by implementing packet filtering and deep packet inspection functions to control the unauthorized traffic and malicious contents. Denial-of-Service (DoS) attack was considered as a potential cybersecurity issue that may threaten the data availability and integrity of DCS gateway servers. Logical design architecture was developed to simulate the behavior of functions flow. HDL-based physical architecture was modelled and simulated using Xilinx ISE software to verify the design functionality. For effective modelling process, enhanced function flow block diagrams (EFFBDs) and schematic design based on FPGA technology were together developed and simulated to verify the performance and functional requirements of network security controls. Both logical and physical design architectures verified that hardware-based cybersecurity controls are capable to maintain the data availability and integrity. Further works focus on implementing the schematic design to an FPGA platform to accomplish the design verification and validation processes.