• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.8 no.7
• /
• pp.2512-2531
• /
• 2014

We propose a new Distributed Denial of Service (DDoS) defense mechanism that protects http web servers from application-level DDoS attacks based on the two methodologies: whitelist-based admission control and busy period-based attack flow detection. The attack flow detection mechanism detects attach flows based on the symptom or stress at the server, since it is getting more difficult to identify bad flows only based on the incoming traffic patterns. The stress is measured by the time interval during which a given client makes the server busy, referred to as a client-induced server busy period (CSBP). We also need to protect the servers from a sudden surge of attack flows even before the malicious flows are identified by the attack flow detection mechanism. Thus, we use whitelist-based admission control mechanism additionally to control the load on the servers. We evaluate the performance of the proposed scheme via simulation and experiment. The simulation results show that our defense system can mitigate DDoS attacks effectively even under a large number of attack flows, on the order of thousands, and the experiment results show that our defense system deployed on a linux machine is sufficiently lightweight to handle packets arriving at a rate close to the link rate.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.3
• /
• pp.521-530
• /
• 2017

In this paper, we propose a protection solution against intelligent Ransomware attacks by encrypting not only source files but also backup files of external storage. The system is designed to automatically back up to the cloud server at the time of file creation to perform monitoring and blocking in case a specific process affects the original file. When client creates or saves a file, both process identifiers, parent process identifiers, and executable file hash values are compared and protected by the whitelist. The file format that is changed by another process is monitored and blocked to prevent from suspicious behavior. By applying the system proposed in this paper, it is possible to protect against damage caused by the modification or deletion of files by Ransomware.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2014.01a
• /
• pp.349-352
• /
• 2014

본 논문에서는 WCDMA, LTE에 이르기까지 USIM을 사용한 국내 이동통신서비스 시장에서 단말기정보를 사용하여 USIM에 의한 사용자 인증을 제한하여 이용자의 정상적인 통신서비스의 이용을 제한하는 현상이 벌어지고 있는것과 관련하여 국내에서 USIM을 사용하기 시작한 뒤부터 최근에 이르기까지 어떻게 이용자의 USIM 사용을 제한하여 장치 활용성을 저해하여 왔는지에 대한 방법과, 이로 인하여 유비쿼터스 컴퓨팅의 5-Any 중(中) 하나인 Any-Device성(性)을 저해하는 현상과 영향에 대하여 논한다.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.20 no.2
• /
• pp.29-37
• /
• 2020

Conventional firewalls cannot cope with attacks immediately. It is because security professionals or administrators need to analyze them and enter relevant policies to the firewalls. In addition, those policies may often block even normal accesses. Even though the packet themselves are normal, there exist many attacks that cause denial of service due to the inflow of a large amount of those packets. In this paper, we propose a method to block attacks such as Flooding, Spoofing and Scanning while allowing normal accesses based on whitelist policies which are automatedly generated by learning normal access patterns.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2019.10a
• /
• pp.156-159
• /
• 2019

The damage from voice phishing reaches one trillion won in the past 5 years following report of Business Korea on August 28, 2018. Voice phishing and mobile phone scams are recognized as a top concern not only in Korea but also in over the world in recent years. In this paper, we propose an efficient system to identify the caller and alert or prevent of dangerous to users. Our system includes a mobile application and web server using client and server architecture. The main purpose of this system is to automatically display the information of unidentified callers when a user receives a call or message. A mobile application installs on a mobile phone to automatically get the caller phone number and send it to the server through web services to verify. The web server applies a machine learning to a global phone book with Blacklist and Whitelist to verify the phone number getting from the mobile application and returns the result.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2014.10a
• /
• pp.346-349
• /
• 2014

Currently, the growing cyber threat continues, the damage caused by the evolution of malicious code incidents become more bigger. Such advanced attacks as APT using 'zero-day vulnerability' bring easy way to steal sensitive data or personal information. However it has a lot of limitation that the traditional ways of defense like 'access control' with blocking of application ports or signature base detection mechanism. This study is suggesting a way of controlling application activities focusing on keeping integrity of applications, authorization to running programs and changes of files of operating system by hardening of legitimate resources and programs based on 'white-listing' technology which analysis applications' behavior and its usage.

• Korea Trade Review
• /
• v.44 no.6
• /
• pp.327-344
• /
• 2019

This paper explores the hub-and-spoke system as the structure of the global economic network that presents obstacles for international cooperation. With its exclusive jurisdiction and control over the hub, a powerful state can employ coercive economic measures to compel and deter unwanted behavior of rogue states and even its allies. Against this backdrop, this study analyzes the cases of the US blocking access to its market by Chinese Huawei as well as the case of Japan in restricting trade for highly advanced goods to South Korea. This analysis reveals that both measures are forms of secondary boycotts, which affect not only the entities within their jurisdiction but also others located in third countries. In addition, this paper extends its findings to free trade agreements and offers implications on the outward processing scheme for the Gaeseong Industrial Complex in the KORUS FTA and the Korea-China FTA. These events result in a gray-risk for South Korea, a country that aims to resolve North Korea's denuclearization and inter-Korean economic cooperation.

• The Journal of the Korea Contents Association
• /
• v.18 no.8
• /
• pp.102-108
• /
• 2018

The existing data transmission technology applied between the non-secure external internet and the secure internal business network has various problems when applied to the building facility management SCADA system control network. Traditional inter-network data transfer technologies involve high complexity and high costs because blacklist-based security techniques are applied to all data. However, whitelist-based security techniques can be applied to data distributed in Building Facility Management SCADA control systems because a small number of structured control data are repeatable and periodic. This simplifies the security technology applied to inter-network data transmission, enabling building facility management SCADA system control network deployment at low cost. In this paper, we proposed building control networks specialized in building facility management SCADA control systems by providing solutions to address and address these problems.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.6
• /
• pp.1205-1214
• /
• 2021

Edge Computing is used as a solution to the cost problem and transmission delay problem caused by network bandwidth consumption that occurs when IoT/CPS devices are integrated into the cloud by performing artificial intelligence (AI) in an environment close to the data source. Since edge computing runs on devices that provide high-performance computation and network connectivity located in the real world, it is necessary to consider application integrity so that it is not exploited by cyber terrorism that can cause human and material damage. In this paper, we propose a technique to protect the integrity of edge computing applications implemented in a script language that is vulnerable to tampering, such as Python, which is used for implementing artificial intelligence, as container images and then digitally signed. The proposed method is based on the integrity protection technology (Docker Contents Trust) provided by the open source container technology. The Docker Client was modified and used to utilize the whitelist for container signature information so that only containers allowed on edge computing devices can be operated.

• Journal of Internet of Things and Convergence
• /
• v.10 no.1
• /
• pp.7-12
• /
• 2024

To trade cryptocurrency, traders require a personal cryptocurrency wallet. Cryptocurrency itself using blockchain technology is guaranteed excellent security and reliability, so the threat of blockchain hacking is almost impossible, but the exchange environment used by traders for transactions is most subject to hacking threats. Even if transactions are made safely through blockchain during the transaction process, if the trader's wallet information itself is hacked, security cannot be secured in these processes. Exchange hacking is mainly done by stealing a trader's wallet information, giving the hacker access to the victim's wallet assets. In this paper, to prevent this, we would like to reconstruct the existing Hyperledger Fabric structure and propose a system that verifies the identity integrity of traders during the transaction process using whitelisting. The advantage is that through this process, damage to cryptocurrency assets caused by hackers can be prevented and recognized. In addition, we aim to point out and correct problems in the transaction process that may occur if the victim's wallet information is stolen from the existing Hyperledger Fabric.