• Journal of the Korea Society of Computer and Information
• /
• v.23 no.9
• /
• pp.57-64
• /
• 2018

In recent years, a new approach to cyber security, called the moving target defense, has emerged as a potential solution to the challenge of static systems. In this paper, we design a protected server network with a large number of decoys to anonymize the protected servers that dynamically mutate their IP address and port numbers according to Hidden Tunnel Networking, which is a network-based moving target defense scheme. In the network, a protected server is one-to-one mapped to a decoy-bed that generates a number of decoys, and the decoys share the same IP address pool with the protected server. First, the protected server network supports mutating the IP address and port numbers of the protected server very frequently regardless of the number of decoys. Second, it provides independence of the decoy-bed configuration. Third, it allows the protected servers to freely change their IP address pool. Lastly, it can reduce the possibility that an attacker will reuse the discovered attributes of a protected server in previous scanning. We believe that applying Hidden Tunnel Networking to protected servers in the proposed network can significantly reduce the probability of the protected servers being identified and compromised by attackers through deploying a large number of decoys.

• 한국IT서비스학회:학술대회논문집
• /
• 2008.05a
• /
• pp.572-577
• /
• 2008

The information protection security diagnosis institution was applied services since 2004, for the leveling up of public information protection and the establishment of the stability and reliability of information communication. And this security diagnosis was however, recognized by the some firms as one of the unnecessary regulations. And there are some difficulties with collecting the subjective and reliable source data for establishing the information protection security diagnosis target. In this research, the enhanced model on the selection of information protection security diagnosis target firms was suggested by the interview with some expert and the analysis for the related actual data. By the model which are introduced from the statistical analysis of the related data and the summary of some expert's suggestions, information protection security diagnosis target can include the information telecommunication service providers taking 5 billion won as sales in a year, and web service providers like as shopping mall site, with the personal records of 2 million subscribers.

• Journal of Information Processing Systems
• /
• v.17 no.4
• /
• pp.834-850
• /
• 2021

IT security companies have been releasing file system filter driver security solutions based on the whitelist, which are being used by several enterprises in the relevant industries. However, in February 2019, a whitelist vulnerability was discovered in Microsoft Edge browser, which allows malicious code to be executed unknown to users. If a hacker had inserted a program that executed malicious code into the whitelist, it would have resulted in considerable damage. File system filter driver security solutions based on the whitelist are discretionary access control (DAC) models. Hence, the whitelist is vulnerable because it only considers the target subject to be accessed, without taking into account the access rights of the file target object. In this study, we propose an industrial device security system for Windows to address this vulnerability, which improves the security of the security policy by determining not only the access rights of the subject but also those of the object through the application of the mandatory access control (MAC) policy in the Windows industrial operating system. The access control method does not base the security policy on the whitelist; instead, by investigating the setting of the security policy not only for the subject but also the object, we propose a method that provides improved stability, compared to the conventional whitelist method.

• Convergence Security Journal
• /
• v.16 no.3_2
• /
• pp.55-63
• /
• 2016

The purpose of this study is that there viewing at the future development direction and awareness of the cultural contents industry targeting college students for the activation of the domestic cultural content industry. And we want to find the need of the security industry & Concert Hall Safety. Recent worldwide it has occurred 'Soft target' terror targeting unspecified civilian in the cultural space of theater and music venues, stadiums etc. But security and safety systems against terror in Korea are very deficient situation. US security market has increased sales significantly interest in increasing against crime and terrorism prevention and depending on the price cut and technology development. It is expected to require a security industry in a variety of applications to the cultural contents industry development about Korean pop music and theatrical performances, and internet and mobile games stc.

• Journal of the Korea Society of Computer and Information
• /
• v.24 no.10
• /
• pp.25-32
• /
• 2019

In this paper, we propose a method to apply the attack surface expansion through decoy traps to a protected server network. The network consists of a large number of decoys and protected servers. In the network, each protected server dynamically mutates its IP address and port numbers based on Hidden Tunnel Networking that is a network-based moving target defense scheme. The moving target defense is a new approach to cyber security and continuously changes system's attack surface to prevent attacks. And, the attack surface expansion is an approach that uses decoys and decoy groups to protect attacks. The proposed method modifies the NAT table of the protected server with a custom chain and a RETURN target in order to make attackers waste all their time and effort in the decoy traps. We theoretically analyze the attacker success rate for the protected server network before and after applying the proposed method. The proposed method is expected to significantly reduce the probability that a protected server will be identified and compromised by attackers.

• Journal of the Korea Society of Computer and Information
• /
• v.23 no.12
• /
• pp.95-105
• /
• 2018

As the IT industry developed, the information held by the company soon became a corporate asset. As this information has value as an asset, the number and scale of various cyber attacks which targeting enterprises and institutions is increasing day by day. Therefore, research are being carried out to protect the assets from cyber attacks by using the attack graph to identify the possibility and risk of various attacks in advance and prepare countermeasures against the attacks. In the attack graph, security metric is used as a measure for determining the importance of each asset or the risk of an attack. This is a key element of the attack graph used as a criterion for determining which assets should be protected first or which attack path should be removed first. In this survey, we research trends of various security metrics used in attack graphs and classify the research according to application viewpoints, use of CVSS(Common Vulnerability Scoring System), and detail metrics. Furthermore, we discussed how to graft the latest security technologies, such as MTD(Moving Target Defense) or SDN(Software Defined Network), onto the attack graphs.

• Convergence Security Journal
• /
• v.3 no.2
• /
• pp.57-65
• /
• 2003

A protection profile is the required specification document by consumer groups to specify what security purpose they would like to have in their specialized products. A protection profile assumption is the document that specifies consumer environment in the physical, artificial, network perspective and the contents of intended usage which include usage limitation, the value of latent asset, and additional applications for a TOE (Target of Evaluation). In this paper, we compare the assumptions of the NSA IDS PP and the IDS PP for government.

• Journal of the Korean Society of Radiology
• /
• v.14 no.3
• /
• pp.193-201
• /
• 2020

The purpose of this study is to evaluate the photon characteristics according to the material and thickness of the electrons incidented through a linear accelerator. The computer simulation design is a linear accelerator target consisting of a 2 mm thick tungsten single material and a 1.8 mm and 2.3 mm thick tungsten and copper composite material. In the research method, First, the behavior of primary particles in the target was evaluated by electron fluence and electron energy deposition. Second, photons occurring within the target were evaluated by photon fluence. Finally, the photon angle-energy distribution at a distance of 1 m from the target was evaluated by photon fluence. As a result, first, electrons, which are primary particles, were not released out of the target for electron fluence and energy deposition in the target of a single material and a composite material. Then, electrons were linearly attenuated negatively according to the target thickness. Second, it was found that the composite material target had a higher photon generation than the single material target. This confirmed that the material composition and thickness influences photon production. Finally, photon fluence according to the angular distribution required for shielding analysis was calculated. These results confirmed that the photon generation rate differed depending on the material and thickness of the linear accelerator target. Therefore, this study is necessary for designing and operating a linear accelerator use facility for container security screening that is being introduced in the country. In addition, it is thought that it can be used as basic data for radiation protection.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.6
• /
• pp.1489-1497
• /
• 2018

Web application services have diversified. At the same time, research on intrusion detection is continuing due to the surge of cyber threats. Also, As a single-defense system evolves into multi-level security, we are responding to specific intrusions by correlating security events that have become vast. However, it is difficult to check the OS, service, web application type and version of the target system in real time, and intrusion detection events occurring in network-based security devices can not confirm vulnerability of the target system and success of the attack A blind spot can occur for threats that are not analyzed for problems and associativity. In this paper, we propose the validation of effectiveness for intrusion detection events using TF-IDF. The proposed scheme extracts the response traffics by mapping the response of the target system corresponding to the attack. Then, Response traffics are divided into lines and weights each line with an TF-IDF weight. we checked the valid intrusion detection events by sequentially examining the lines with high weights.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.23 no.4
• /
• pp.477-485
• /
• 2019

As the drones industry evolved, the security of the drone network has been important. In this paper, MTD (Moving Target Detection) technique is applied to the drone network for improving security. The existing MTD scheme has a risk that the hash value is exposed during the wireless communication process, and it is restricted to apply the one-to-many network. Therefore, we proposed PHT (Preposition Hash Table) scheme to prevent exposure of hash values during wireless communication. By reducing the risk of cryptographic key exposure, the use time of the cryptographic key can be extended and the security of the drone network will be improved. In addition, the cryptographic key exchange is not performed during flight, it is advantageous to apply PHT for a swarm drone network. Through simulation, we confirmed that the proposed scheme can contribute to the security of the drone network.