• International Journal of Computer Science & Network Security
• /
• 제23권12호
• /
• pp.1-12
• /
• 2023

Ensuring the security of Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS) is paramount to safeguarding the reliability and safety of critical infrastructure. This paper addresses the significant threat posed by reconnaissance attacks on SCADA/ICS networks and presents an innovative methodology for enhancing their protection. The proposed approach strategically employs imbalance dataset handling techniques, ensemble methods, and feature engineering to enhance the resilience of SCADA/ICS systems. Experimentation and analysis demonstrate the compelling efficacy of our strategy, as evidenced by excellent model performance characterized by good precision, recall, and a commendably low false negative (FN). The practical utility of our approach is underscored through the evaluation of real-world SCADA/ICS datasets, showcasing superior performance compared to existing methods in a comparative analysis. Moreover, the integration of feature augmentation is revealed to significantly enhance detection capabilities. This research contributes to advancing the security posture of SCADA/ICS environments, addressing a critical imperative in the face of evolving cyber threats.

• International Journal of Computer Science & Network Security
• /
• 제22권2호
• /
• pp.341-347
• /
• 2022

This research is designed to help and offer hold up to complete the requirements of aged and disable in a home. The control approach and the tone approach are used to manage the house appliances. The major organize system implementation in technology of wireless to offer distant contact from a phone Internet Protocol connectivity for access and calculating strategy and appliance remotely. The planned system no need a committed server PC with value of parallel systems and offers a new communication-protocol to observe and control a house environment with more than just the switch functionality. To express the possibility and efficiency of this system, devices like as lights switches, power plugs, and motion-sensors have been included with the planned home control system and supply more security manage on the control with low electrical energy activate method. The rank of switches is corresponding in all this control system whereby all user interfaces indicate the real time existing status. This system planned to manage electrical-appliances and devices in house with reasonably low cost of design, user friendly interface, easily install and provide high security. Research community generally specified that the network "Reconnaissance Attacks" in IPv6 are usually impossible due to they will take huge challenge to carry out address scanning of 264 hosts in an IPv6 subnet."It being deployed of IPv6 shows that it definitely enhances security and undermines the probability". This research of the IPv6 addressing-strategies at present utilizes and planned a new strategy and move toward to "mitigate reconnaissance attacks".

• Journal of Information Processing Systems
• /
• 제11권1호
• /
• pp.104-115
• /
• 2015

Along with the evolution of Internet and its new emerging services, the quantity and impact of attacks have been continuously increasing. Currently, the technical capability to attack has tended to decrease. On the contrary, performances of hacking tools are evolving, growing, simple, comprehensive, and accessible to the public. In this work, network penetration testing and auditing of the Redhat operating system (OS) are highlighted as one of the most popular OS for Internet applications. Some types of attacks are from a different side and new attack method have been attempted, such as: scanning for reconnaissance, guessing the password, gaining privileged access, and flooding the victim machine to decrease availability. Some analyses in network auditing and forensic from victim server are also presented in this paper. Our proposed system aims confirmed as hackable or not and we expect for it to be used as a reference for practitioners to protect their systems from cyber-attacks.

• 융합보안논문지
• /
• 제10권3호
• /
• pp.29-41
• /
• 2010

전장 지역에서 각종 전술정보를 실시간으로 수집할 수 있는 센서기반의 감시체계인 감시정찰 센서네트워크는 Sensor-to-Shooter 개념의 네트워크 중심전 환경에서 핵심 역할을 수행한다. 그러나 네트워크를 구성하는 센서노드들의 자원제약적 특성과 무선통신 사용 등 센서네트워크 자체의 특성으로 인해 감시정찰 센서네트워크는 일반 네트워크에 비해 보안이 취약해 질 수 있다. 이에 본 논문에서는 감시정찰 센서네트워크 운용 간 기밀성, 무결성, 가용성 및 인증 등을 보장하기 위한 기반이 되는 그룹 키 관리 기법을 제안한다. 제안된 키 관리 기법은 감시정찰 센서네트워크의 토폴로지 특성과 확률론적 키 공유를 기반으로 그룹 키를 생성하고 분배하며, 그룹 키분배에 소요되는 통신 비용은 O(logn)이다.

• 한국컴퓨터정보학회논문지
• /
• 제22권10호
• /
• pp.83-92
• /
• 2017

Reconnaissance is performed gathering information from a series of scanning probes where the objective is to identify attributes of target hosts. Network reconnaissance of IP addresses and ports is prerequisite to various cyber attacks. In order to increase the attacker's workload and to break the attack kill chain, a few proactive techniques based on the network-based moving target defense (NMTD) paradigm, referred to as IP address mutation/randomization, have been presented. However, there are no commercial or trial systems deployed in real networks. In this paper, we propose a threat model and the request for requirements for developing NMTD techniques. For this purpose, we first examine the challenging problems in the NMTD mechanisms that were proposed for the legacy TCP/IP network. Secondly, we present a threat model in terms of attacker's intelligence, the intended information scope, and the attacker's location. Lastly, we provide seven basic requirements to develop an NMTD mechanism for the legacy TCP/IP network: 1) end-host address mutation, 2) post tracking, 3) address mutation unit, 4) service transparency, 5) name and address access, 6) adaptive defense, and 7) controller operation. We believe that this paper gives some insight into how to design and implement a new NMTD mechanism that would be deployable in real network.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제11권11호
• /
• pp.5556-5573
• /
• 2017

As a main component of Internet of Things (IoTs), the wireless sensor networks (WSNs) have been widely applied to various areas, including environment monitoring, health monitoring of human body, farming, commercial manufacture, reconnaissance mission in military, and calamity alert etc. Meanwhile, the privacy concerns also arise when the users are required to get the real-time data from the sensor nodes directly. To solve this problem, several user authentication and key agreement schemes with a smart card and a password have been proposed in the past years. However, these schemes are vulnerable to some attacks such as offline password guessing attack, user impersonation attack by using attacker's own smart card, sensor node impersonation attack and gateway node bypassing attack. In this paper, we propose an improved scheme which can resist a wide variety of attacks in WSNs. Cryptanalysis and performance analysis show that our scheme can solve the weaknesses of previously proposed schemes and enhance security requirements while maintaining low computational cost.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제15권8호
• /
• pp.2805-2826
• /
• 2021

In most cases, the routing policy of networks shows a preference for a static one-to-one mapping of communication pairs to routing paths, which offers adversaries a great advantage to conduct thorough reconnaissance and organize an effective attack in a stress-free manner. With the evolution of network intelligence, some flexible and adaptive routing policies have already proposed to intensify the network defender to turn the situation. Routing mutation is an effective strategy that can invalidate the unvarying nature of routing information that attackers have collected from exploiting the static configuration of the network. However, three constraints execute press on routing mutation deployment in practical: insufficient route mutation space, expensive control costs, and incompatibility. To enhance the availability of route mutation, we propose an OpenFlow-based route mutation technique called Polymorphic Path Transferring (PPT), which adopts a physical and virtual path segment mixed construction technique to enlarge the routing path space for elevating the security of communication. Based on the Markov Decision Process, with considering flows distribution in the network, the PPT adopts an evolution routing path scheduling algorithm with a segment path update strategy, which relieves the press on the overhead of control and incompatibility. Our analysis demonstrates that PPT can secure data delivery in the worst network environment while countering sophisticated attacks in an evasion-free manner (e.g., advanced persistent threat). Case study and experiment results show its effectiveness in proactively defending against targeted attacks and its advantage compared with previous route mutation methods.

• 문화기술의 융합
• /
• 제10권2호
• /
• pp.167-172
• /
• 2024

21세기의 주요 전쟁에서 드론은 감시정찰을 넘어 정밀타격 또는 자폭공격, 인지전 등의 목적으로 지상 및 공중은 물론 해상 및 수중으로 그 영역이 확장되고 있다. 이러한 드론은 다영역작전을 수행할 것이며 이를 위해 자율화 수준을 향상하고 High-Low Mix 개념에 기반한 확장성을 강화하는 등의 발전을 이어 나갈 것이다. 최근 드론은 세계의 주요 전쟁에서 주요한 수단으로 활용되고 있으며 향후 게임체인저(Game-Changer)로 진화할 개연성이 충분해 보인다. 북한 또한 오래전부터 정찰 및 공격드론을 운용하기 위해 상당한 노력을 기울여 왔다. 북한은 근래에 들어 드론을 활용한 도발을 지속하고 있고, 그 능력도 점차 고도화되고 있다. 또한, 최근 새로운 전략 드론의 등장으로 이를 활용한 북한의 대남 감시정찰 및 조기경보 능력 확보와 새로운 유형의 도발 등 전·평시 위협이 강화될 것으로 보인다. 이에 이번 연구에서는 북한 전략 드론의 능력을 분석하고 운용 양상을 예측하여 시사점을 제공하고, 이후 우리 군의 드론 전력화 및 대드론체계 솔루션 등 종합적인 전략 수립에 대한 활발한 후속 연구가 이루어지길 바란다.

• International Journal of Aerospace System Engineering
• /
• 제2권1호
• /
• pp.1-5
• /
• 2015

The Unmanned Air Vehicle (UAV) systems are indispensable tools of air surveillance and reconnaissance nowadays. Via this systems, hazardous end risky intelligence gathering activities are handled easily. Although they are named as "Unmanned" the UAV systems are commanded by pilots/operators. So, because of weather conditions, enemy attacks etc. as well as pilot error it is possible to face with sudden Round per Minute (RPM) drops and subsequently engine cut/stop during a mission flight at high altitudes. In this case, there are some very urgent decisions to make and rapid "emergency procedure" steps to take in a very short time before Line of Sight (LOS) is lost. The time before crash and the distance to landing air base need to be calculated, the Return Home route need to be checked and the landing/crash side need to be determined. Therefore it is a vital necessity that UAV pilots have some extra qualifications like being determined, well instructed and trained, experienced apart from operating ability. Within this scope, for an education process of a UAV pilot experience sharing and lessons learned are as important as simulators even more. By means of lessons learned it is possible to find out the reasons, mistakes and prevent the likely UAV accidents. In this study it is told about a real UAV crash, experienced of the pilot, the dos and don'ts and the difficulties. Thus it is aimed to help the people who can experience the same or similar situations in future.

• 디지털융복합연구
• /
• 제19권9호
• /
• pp.463-468
• /
• 2021

IoT는 기술의 발전과 IoT 기기의 보급 및 서비스의 활성화로 폭발적인 증가세를 보이고 있지만, 최근 다양한 봇넷의 활동에 의해 심각한 보안 위험과 재정적 피해가 발생하고 있다. 따라서 이러한 봇넷의 활동을 정확하고 빠르게 탐지하는 것이 중요하다고 할 수 있다. IoT 환경에서의 보안은 최소한의 프로세싱 성능과 메모리로 운영을 해야 하는 특성이 있는 만큼, 본 논문에서는 탐지를 위한 최소한의 특성을 선택하고, KNN(K-Nearest Neighbor), Naïve Bayes, Decision Tree, Random Forest와 같은 머신러닝 알고리즘이 봇넷의 활동을 탐지하는 성능을 비교연구 하였다. Bot-IoT 데이터셋을 사용한 실험 결과는 적용한 머신러닝 알고리즘 중 KNN이 DDoS, DoS, Reconnaissance 공격을 가장 효과적이고 효율적으로 탐지할 수 있음을 보여주었다.