• Proceedings of the Korea Multimedia Society Conference
• /
• 2002.11b
• /
• pp.690-693
• /
• 2002

차세대 인터넷에서 DiffServ 네트워크는 서비스 품질(QoS: Quality of Service) 제공을 위한 확장성이 높은 구조를 제시하고 있다. 차세대 네트워크에서는 음성이나 비디오 전송 같은 많은 응용들을 지원하기 위하여 QoS 보장 서비스가 필요하다. 차세대 인터넷에서 QoS 제공을 위하여 RSVP(Resource Reservation Protocol), MPLS(Multi-Protocol Label Switching), DiffServ 및 QoS 라우팅 등의 기법이 개발되고 표준화되고 있다. 원격 교육 역시 주로 인터넷이 주도하고 있다는 면에서는 QoS의 문제를 피해 갈 수 없는 것이다. 그러나, 국내에서는 이러한 QoS 능력을 안전하게 제공하기 위한 기법에 대한 연구가 거의 없는 실정이다. 따라서, 본 논문에서는 QoS를 안전하게 제공하기 위한 보안 기법을 DiffServ 네트워크를 중심으로 제시하고 원격교육에 적용시의 문제들을 고려하고자 한다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.12 no.6
• /
• pp.2895-2921
• /
• 2018

Security has become one of the major concerns in mobile adhoc networks (MANETs). Data and voice communication amongst roaming battlefield entities (such as platoon of soldiers, inter-battlefield tanks and military aircrafts) served by MANETs throw several challenges. It requires complex securing strategy to address threats such as unauthorized network access, man in the middle attacks, denial of service etc., to provide highly reliable communication amongst the nodes. Intrusion Detection and Prevention System (IDPS) undoubtedly is a crucial ingredient to address these threats. IDPS in MANET is managed by Command Control Communication and Intelligence (C3I) system. It consists of networked computers in the tactical battle area that facilitates comprehensive situation awareness by the commanders for timely and optimum decision-making. Key issue in such IDPS mechanism is lack of Smart Learning Engine. We propose a novel behavioral based "Smart Multi-Instance Multi-Label Intrusion Detection and Prevention System (MIML-IDPS)" that follows a distributed and centralized architecture to support a Robust C3I System. This protocol is deployed in a virtually clustered non-uniform network topology with dynamic election of several virtual head nodes acting as a client Intrusion Detection agent connected to a centralized server IDPS located at Command and Control Center. Distributed virtual client nodes serve as the intelligent decision processing unit and centralized IDPS server act as a Smart MIML decision making unit. Simulation and experimental analysis shows the proposed protocol exhibits computational intelligence with counter attacks, efficient memory utilization, classification accuracy and decision convergence in securing C3I System in a Tactical Battlefield environment.

• Journal of Korea Multimedia Society
• /
• v.13 no.4
• /
• pp.504-511
• /
• 2010

In this paper, we propose the face region recognition system for City-Security CCTV(Closed Circuit Television) using hippocampal neural network which is modelling of human brain's hippocampus. This system is composed of feature extraction, learning and recognition part. The feature extraction part is constructed using PCA(Principal Component Analysis) and LDA(Linear Discriminants Analysis). In the learning part, it can label the features of the image-data which are inputted according to the order of hippocampal neuron structure to reaction-pattern according to the adjustment of a good impression in a dentate gyrus and remove the noise through the auto-associative memory in the CA3 region. In the CA1 region receiving the information of the CA3, it can make long-term memory learned by neuron. Experiments confirm the each recognition rate, that are shape change and light change. The experimental results show that we can compare a feature extraction and learning method proposed in this paper of any other methods, and we can confirm that the proposed method is superior to existing methods.

• Journal of Internet Computing and Services
• /
• v.23 no.6
• /
• pp.15-26
• /
• 2022

Various subjects are carrying out cyberattacks using a variety of tactics and techniques. Additionally, cyberattacks for political and economic purposes are also being carried out by groups which is sponsored by its nation. To deal with cyberattacks, researchers used to classify the malware family and the subjects of the attack based on malware signature. Unfortunately, attackers can easily masquerade as other group. Also, as the attack varies with subject, techniques, and purpose, it is more effective for defenders to identify the attacker's purpose and goal to respond appropriately. The essential goal of cyberattacks is to threaten the information security of the target assets. Information security is achieved by preserving the confidentiality, integrity, and availability of the assets. In this paper, we relabel the attacker's goal based on MITRE ATT&CK® in the point of CIA triad as well as classifying cyber security reports to verify the labeling method. Experimental results show that the model classified the proposed CIA label with at most 80% probability.

• Journal of Information Science Theory and Practice
• /
• v.10 no.spc
• /
• pp.143-153
• /
• 2022

With the development of networks and the increase in the number of network devices, the number of cyber attacks targeting them is also increasing. Since these cyber-attacks aim to steal important information and destroy systems, it is necessary to minimize social and economic damage through early detection and rapid response. Many studies using machine learning (ML) and artificial intelligence (AI) have been conducted, among which payload learning is one of the most intuitive and effective methods to detect malicious behavior. In this study, we propose a preprocessing method to maximize the performance of the model when learning the payload in term units. The proposed method constructs a high-quality learning data set by eliminating unnecessary noise (stopwords) and preserving important features in consideration of the machine language and natural language characteristics of the packet payload. Our method consists of three steps: Preserving significant special characters, Generating a stopword list, and Class label refinement. By processing packets of various and complex structures based on these three processes, it is possible to make high-quality training data that can be helpful to build high-performance ML/AI models for security monitoring. We prove the effectiveness of the proposed method by comparing the performance of the AI model to which the proposed method is applied and not. Forthermore, by evaluating the performance of the AI model applied proposed method in the real-world Security Operating Center (SOC) environment with live network traffic, we demonstrate the applicability of the our method to the real environment.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.3
• /
• pp.491-501
• /
• 2019

In side-channel analysis, which exploit physical leakage from a cryptographic device, deep learning based attack has been significantly interested in recent years. However, most of the state-of-the-art methods have been focused on classifying side-channel information in a profiled scenario where attackers can obtain label of training data. In this paper, we propose a new method based on deep learning to improve non-profiling side-channel attack such as Differential Power Analysis and Correlation Power Analysis. The proposed method is a signal preprocessing technique that reduces the noise in a trace by modifying Auto-Encoder framework to the context of side-channel analysis. Previous work on Denoising Auto-Encoder was trained through randomly added noise by an attacker. In this paper, the proposed model trains Auto-Encoder through the noise from real data using the noise-reduced-label. Also, the proposed method permits to perform non-profiled attack by training only a single neural network. We validate the performance of the noise reduction of the proposed method on real traces collected from ChipWhisperer board. We demonstrate that the proposed method outperforms classic preprocessing methods such as Principal Component Analysis and Linear Discriminant Analysis.

• KIPS Transactions on Software and Data Engineering
• /
• v.12 no.2
• /
• pp.99-110
• /
• 2023

This study proposed a classification of malicious network traffic using the cyber threat framework(Mitre ATT&CK) and machine learning to solve the real-time traffic detection problems faced by current security monitoring systems. We applied a network traffic dataset called UNSW-NB15 to the Mitre ATT&CK framework to transform the label and generate the final dataset through rare class processing. After learning several boosting-based ensemble models using the generated final dataset, we demonstrated how these ensemble models classify network traffic using various performance metrics. Based on the F-1 score, we showed that XGBoost with no rare class processing is the best in the multi-class traffic environment. We recognized that machine learning ensemble models through Mitre ATT&CK label conversion and oversampling processing have differences over existing studies, but have limitations due to (1) the inability to match perfectly when converting between existing datasets and Mitre ATT&CK labels and (2) the presence of excessive sparse classes. Nevertheless, Catboost with B-SMOTE achieved the classification accuracy of 0.9526, which is expected to be able to automatically detect normal/abnormal network traffic.

• Convergence Security Journal
• /
• v.13 no.4
• /
• pp.19-25
• /
• 2013

The increasing demand for fast, flexible and guaranteed Quality of Service (QoS) in core networks has caused to deploy MultiProtocol Label Switching (MPLS) and Generalized MPLS (GMPLS) control plane. In GMPLS control plane, path computation and cooperation processes are one of the crucial element to maintain an acceptable level of service. The Internet Engineering Task Force (IETF) has proposed the Path Computation Element (PCE) architecture. The PCE is a dedicated network element devoted to path computation process and communications between Path Computation Clients (PCC) and PCEs is realized through the PCE Protocol (PCEP). This paper examines the PCE-based path computation architecture to include the design and implementation of PCEP. The functional modules including Finite State Machine (FSM) and related key design issues of each state are presented. In particular we also discuss internal/external protocol interfaces that efficiently control the communication channels.

• Journal of KIISE:Information Networking
• /
• v.29 no.1
• /
• pp.31-39
• /
• 2002

The VPN(Virtual Private Network) is a private network constructed logically on a public network infrastructure. There have been numerous studies to support the VPN services by using different technologies such as IP in IP, GRE, L2TP, MPLS and so on. Among these technologies, MPLS has shown many merits in aspects of QoS, security, and management, compared with other technologies. As an enhancement of the VPN that is controlled by MPLS PE(Provider Edge) routers, this paper presents the VPN controlled by MPLS CE(Customer Edge) routers. The functional architecture of the CE based VPN and operations of the CE routers are described along with the performance comparison of CE based MPLS VPN. It has been shown that the CE based VPN has more advantages than PE based VPN with respect to independency, scalability, security, and complexity.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.6
• /
• pp.1045-1057
• /
• 2022

Recently, the National Institute of Standards and Technology (NIST) announced four cryptographic algorithms as a standard candidates of Post-Quantum Cryptography (PQC). In this paper, we show that private key can be exposed by a non-profiling-based power analysis attack such as Correlation Power Analysis (CPA) and Differential Deep Learning Analysis (DDLA) on CRYSTALS-KYBER algorithm, which is decided as a standard in the PKE/KEM field. As a result of experiments, it was successful in recovering the linear polynomial coefficient of the private key. Furthermore, the private key can be sufficiently recovered with a 13.0 Normalized Maximum Margin (NMM) value when Hamming Weight of intermediate values is used as a label in DDLA. In addition, these non-profiling attacks can be prevented by applying countermeasures that randomly divides the ciphertext during the decryption process and randomizes the starting point of the coefficient-wise multiplication operation.