• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.11 no.6
• /
• pp.3230-3253
• /
• 2017

Android malware steals users' private information, and embedded unsafe advertisement (ad) libraries, which execute unsafe code causing damage to users. The majority of such traffic is HTTP and is mixed with other normal traffic, which makes the detection of malware and unsafe ad libraries a challenging problem. To address this problem, this work describes a novel HTTP traffic flow mining approach to detect and categorize Android malware and unsafe ad library. This work designed AndroCollector, which can automatically execute the Android application (app) and collect the network traffic traces. From these traces, this work extracts HTTP traffic features along three important dimensions: quantitative, timing, and semantic and use these features for characterizing malware and unsafe ad libraries. Based on these HTTP traffic features, this work describes a supervised classification scheme for detecting malware and unsafe ad libraries. In addition, to help network operators, this work describes a fine-grained categorization method by generating fingerprints from HTTP request methods for each malware family and unsafe ad libraries. This work evaluated the scheme using HTTP traffic traces collected from 10778 Android apps. The experimental results show that the scheme can detect malware with 97% accuracy and unsafe ad libraries with 95% accuracy when tested on the popular third-party Android markets.

• Journal of Korea Multimedia Society
• /
• v.8 no.7
• /
• pp.974-987
• /
• 2005

As the ad hoc networks have been received a great deal of attention to not only the military but also the industry applications, some security mechanisms are required for implementing a practical ad hoc application. In this paper, we propose a security architecture in ad hoc networks for the purpose of supporting ID-based public key cryptosystems because of the advantage that ID-based schemes require less complex infrastructure compared with the traditional public key cryptosystems. We assume a trusted key generation center which only issues a private key derived from IDs of every nodes in the system setup phase, and use NIL(Node ID List) and NRL(Node Revocation List) in order to distribute the information about IDs used as public keys in our system. Furthermore, we propose a collaborative status checking mechanism that is performed by nodes themselves not by a central server in ad-hoc network to check the validity of the IDs.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.1
• /
• pp.5-15
• /
• 2015

Electronic transactions have been increasing with the development of the high-speed Internet and wireless communication. However, in recent years financial corporations and mobile carriers were attacked by hackers. And large numbers of privacy information have been leaked. In particular, in the case of credit card information can be misused in the online transaction, and the damage of this given to cardholder. To prevent these problems, it has been proposed to use a virtual card number instead of the actual card number. But it has security vulnerability and requires additional security infrastructure. In this paper, we analyzed the proposed virtual card number schemes. and we propose a new virtual credit card number scheme. In the newly proposed scheme, cardholder generates a key pair (public key/private key) and pre-register public key to the issuer. then, cardholder can pay no additional security infrastructure while still efficiently satisfy the security requirements.

• The Transactions of the Korea Information Processing Society
• /
• v.7 no.9
• /
• pp.2903-2912
• /
• 2000

The paper is a design and implementation of the Hybrid Messaging System as integrating electronic mail system and common mail system based on PKI(Public Key Infrastructure), A user writes mail through Web Browser and sends the mail to Web Server. CGHCommon Gateway Interface) program sends the mail that was received through the Web Sever to Post Office Electronic Mail Server using SMTP(SimpleMail Transfer Protocol), The End Process program of the Hybrid Messaging System in a Post Office fetches the mail from the Post Office Electronic Mail Server using POP3 (Post Office Protocol 3), prints it and deliver it to recipients, Also, the Hybrid Messaging System is able to sign the mail with a sign private key that the Certificate Authority publics for users and encrypts the mail with a public key of the Post Office Web Server.

• Journal of the Institute of Electronics Engineers of Korea SD
• /
• v.40 no.9
• /
• pp.702-713
• /
• 2003

The importance of protection for data and information is increasing by the rapid development of information communication and network. And the concern for protecting private information is also growing due to the increasing demand for lots of services by users. Asymmetric cryptosystem is the mainstream in encryption system rather than symmetric cryptosystem by above reasons. But asymmetric cryptosystem is restricted in applying fields by the reason it takes more times to process than symmetric cryptosystem. In this paper, encryption system which executes authentication works of asymmetric cryptosystem by means of symmetric cryptosystem. The proposed cryptosystem uses an algorithms combines that combines block cipherment with stream cipherment and has a high stability in aspect of secret rate by means of transition of key sequence according to the information of plaintext while symmetric/asymmetric cryptosystem conducts encipherment/deciphermeent using a fixed key. Consequently, it is very difficult to crack although unauthenticator acquires the key information. So, the proposed encryption system which has a certification function of asymmetric cryptosystem and a processing time equivalent to symmetric cryptosystems will be highly useful to authorize data or exchange important information.

• Journal of the Institute of Electronics and Information Engineers
• /
• v.50 no.6
• /
• pp.167-172
• /
• 2013

In a paper recently published in the International Journal of Parallel, Emergent and Distributed Systems, Biswas et al. proposed a VANET message authentication scheme which uses an identity-based proxy signature mechanism as an underlying primitive. The authors claimed that their scheme supports various security features including the security of proxy-key, the security against message forgery and the security against replay attack, with non-repudiation and resistance to proxy-key compromise. Here, we show how an active attacker, who has no knowledge of an original message sender's private key, can compute the proxy-signature key of the corresponding message sender, meaning that the scheme is completely insecure. We also suggest an enhanced version of the protocol capable of solving such serious security holes.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.9 no.2
• /
• pp.370-378
• /
• 2008

The CEDA(Certified E-Document Authority) is a reliable third party that deposit electronic document having legal effects securely, and verify contents of document or transmission. This paper focuses on a function of secure transmission among several important functions, and implements public key encryption system for secure transmission when server and user communicate for image transmission. This paper follows a standard fundamental rule of X.509 in ITU-T, and it uses symmetric encryption algorithm to raise speed of a large data operation. A key of symmetric encryption algorithm is encrypted by private key in public key system, it protects to be modified using digital signature for data integrity. Also it uses certificates for mutual authentication.

• Journal of Convergence for Information Technology
• /
• v.8 no.3
• /
• pp.63-69
• /
• 2018

Recently, healthcare services are using cloud services to efficiently manage users' healthcare data. However, research to ensure the stability of the user's healthcare data processed in the cloud environment is insufficient. In this paper, we propose a partial random encryption scheme that efficiently encrypts healthcare data in a cloud environment. The proposed scheme generates two random keys (p, q) generated by the user to optimize for the hospital medical service and reflects them in public key and private key generation. The random key used in the proposed scheme improves the efficiency of user 's healthcare data processing by encrypting only part of the data without encrypting the whole data. As a result of the performance evaluation, the proposed method showed 21.6% lower than the existing method and 18.5% improved the user healthcare data processing time in the hospital.

• Journal of the Society of Disaster Information
• /
• v.18 no.2
• /
• pp.405-417
• /
• 2022

Purpose: As an administrative organization that directly affects the safety and livelihood of the people, local governments are important to ensure the continuity of key functions in the event of a disaster. The purpose of this study is to review effective methods for establishing and implementing a continuity of operations plan to protect and maintain the key functions of local governments. Method: In order to improve the inefficiency of the ISO22301-based continuity of operation plan, applying the organizational-oriented functional continuity method and set up the planning method, key functions, required resources, and basic education and training forms, and apply to local governments and review their feasibility. Result: The proposed organization-oriented continuity of operation plan preparation method reflects the characteristics of bureaucratic local governments and makes it easy to prepare and apply in practice. Conclusion: Compared to the private sector, in the public sector, where work is organization-oriented, it can be a more efficient way to fully reflect the organizational point of view in establishing a continuity of Opertaions plan.

• Journal of Agricultural Extension & Community Development
• /
• v.21 no.2
• /
• pp.1-28
• /
• 2014

Private consulting firms that are currently participating in rural area development projects with a bottom-up approach are involved in nearly all areas of rural area development, and the policy environment that emphasizes the bottom-up approach will further expand their participation. Reviews of private consulting firms, which started out with high expectations in the beginning, are now becoming rather negative. Expertise is the key issue in the controversy over private consulting firms, and the analysis tends to limit the causes of the problems within firms. This study was conducted on the premise that the fixation on cause and structure results in policy issues in the promotion process. That is because the government authorities are responsible for managing and supervising the implementation of policies, not developing the policies. The current issues with consulting firms emerged because of the hasty implementation of private consulting through the government policy trend without sufficient consideration, as well as the policy environment that demanded short-term outcomes even though the purpose of bottom-up rural area development lies in the ideology of endogenous development focused on the changes in residents' perceptions. Research was conducted to determine how the problems of private consulting firms that emerged and were addressed in this context influenced the consulting market, using current data and based on the firms' business performance. In analyzing the types, firms were divided into three groups: top performers including market leaders (9), excellent performers (36), and average performers (34). An analysis of the correlation between the business performance of each type and managerial resources such as each firm's expertise revealed that there was only a correlation between human resources and regional development in excellent performers, and none was found with the other types. These results imply that external factors other than a firm's capabilities (e.g., expertise) play a significant role in the standards of selecting private consulting firms. Thus, government authorities must reflect on their error of hastily adopting private consulting firms without sufficient consideration and must urgently establish response measures.