• Journal of the Korea Society of Computer and Information
• /
• v.8 no.3
• /
• pp.34-39
• /
• 2003

There have been several researches to trace intruders on the Internet. But, up to now, few of them has shown a satisfactory and practicable result of the study. Recently, a little bit more active methods such as 'counter-attacking' have been considered to be an alternative to solve the problem of hacking, and some people showed a tendency to accept the method as one possible way to protect their systems. And the new intruder-retracing method suggested in this study is an improved AIAA(Autonomous Intrusion Analysis Agent) model which has been achieved by attaching the counter-attacking method to the existing tracing system. In this paper, the automatic intruder-tracking system is proposed, which was achieved through the design of the following three modules, such as the intruder-retracing module, intruder-tracing module and AIAA dispatch module.

• Journal of KIISE:Information Networking
• /
• v.29 no.6
• /
• pp.654-662
• /
• 2002

As the Internet technology becomes a major information infrastructure, an emerging problem is the tremendous increase of malicious computer intrusions. The present Intrusion Detection System (IDS) serves a useful purpose for detecting such intrusions, but the current situation requires more active response mechanism other than simple detection. This paper describes a multi-agent based tracing system against the intruders when the system is attacked. The focus of the study lies on the secure communication mechanism for the agent message communication. We have extended parameters on the KQML protocol, and apt)lied the public key encryption approach, The limitation might be the requirements of two-way authentication for every communication through the broker agent. This model ma)r not improve the efficiency, but it provides a concrete secure communication. Also this is one important factor to protect the agent and the tracing server during the tracing process.

• Convergence Security Journal
• /
• v.5 no.2
• /
• pp.43-50
• /
• 2005

This paper is about the method that chases the Linux kernel backdoor intruder and copes with the kernel backdoor attack. We have a limit to trace the hacker with the current log analysing method because the hacker generally removes the log file and use the forge IP information. I propose the solution to solve the problem with the DeFor system. Through the restoration of the deleted log file, analysis of it and full HDD image, promptly quick response, it is possible to trace hacker spot and reduce hacking damage.

• Journal of KIISE:Information Networking
• /
• v.28 no.4
• /
• pp.489-497
• /
• 2001

In the coming age of information warfare, information security patterns take on a more offensive than defensive stance. It is necessary to develop an active form of offensive approach to security protection in order to guard vital information infrastructures and thwart hackers. Information security products need to support an automatic response facility without human intervention in order to minimize damage to the attacked system and cope with the intrusion immediately. This paper presents an automatic intrusion response model which is developed on a Self-Extension Monitoring. It also proposes an ARTEMIS(Advanced Realtime Emergency Management and Intruder Identification System), which is designed and implemented based on the suggested model. The Self-Extension Monitoring using self-protection and replication minimizes spatial limitations on collection of monitoring information and intruder tracing. It enhances the accuracy of intrusion detection and tracing.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.11 no.4
• /
• pp.45-54
• /
• 2001

It is necessary to control security management consistently and respond to an intrusion automatically in order to use the network securely in the single administrative domain. This paper presents a Shadowing Mechanism supporting a dynamic extension of security scheme and proposes an ARTEMIS(Advanced Realtime Emergency Management and Intruder Identification System), which is designed and implemented based on the suggested technique. It is possible for security management system developed on the basis of the Shadowing Mechanism to make all network components working under the same security scheme. It enhances the accuracy of intrusion tracing and automatic response through dynamic extension of space and time for security management.

• 제어로봇시스템학회:학술대회논문집
• /
• 2003.10a
• /
• pp.2151-2154
• /
• 2003

Internet is deeply rooted in everyday life and many things are performed using internet in real-world, therefore internet users increased because of convenience. Also internet accident is on the increase rapidly. The security vendor developed security system to protect network and system from intruder. Many hackings can be prevented and detected by using these security solutions. However, the new hacking methods and tools that can detour or defeat these solutions have been emerging and even script kids using these methods and tools can easily hack the systems. In consequence, system has gone through various difficulties. So, Necessity of intruder trace-back technology is increased gradually. Trace-back technology is tracing back a malicious hacker to his real location. trace-back technology is largely divided into TCP connection trace-back and IP packet trace-back to trace spoofed IP of form denial-of-service attacks. TCP connection trace-back technology that autonomously traces back the real location of hacker who attacks system using stepping stone at real time. In this paper, We will describe watermark trace-back system using TCP hijacking technique to supplement difficult problem of connection maintenance happened at watermark insertion. Through proposed result, we may search attacker's real location which attempt attack through multiple connection by real time.

• Proceedings of the Korean Information Science Society Conference
• /
• 2000.10c
• /
• pp.352-354
• /
• 2000

인터넷에서 해커 등 침입자를 추적하기 위한 방안들이 연구되고 있으나 아직 실용적인 연구성과가 거의 드문 실정이다. 지금까지는 침해사고대응팀(CERT)간의 협력과 상호 정보교류를 통한 대응체계를 통하여 이루어지고 있으나 실제 역추적으로서는 효과적인 방법이 아니며, 에이전트를 이용한 분석방법(AIAA)와 같은 경우도 에이전트의 수동적인 이동이 전제되어야 하는 것이다. 최근 해킹공격에 대한 적극적인 대응 방안으로 역공격 등의 적극적인 방법들이 고려되고 자신의 시스템에 대한 보호방법의 하나로서 받아들여지고 있는 경향이 있으므로 이러한 역공격 방법을 추적시스템에 접목하여 개량된 AIAA 모델로서 침입자 역추적방법을 설계하고 구현하였다. 여기에는 침입자 역공격 모듈과 침입자 미행모듈, AIAA 파견모듈등을 구현하여 자동적인 침입자 추적을 실현하였다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2002.04b
• /
• pp.899-902
• /
• 2002

본 논문에서는 정책기반의 네트워크 보안 프레임워크 내에서 동작하는 침입자 역 추적 방안을 제안하고, 필요한 기능 구성요소에 대해 논한다. 제안한 역 추적 방안에서는 라우터, 스위치 등과 같은 기존의 네트워크 노드에서 tracing 기능을 직접 수행하지 않고도 위조된 유해 패킷의 송신 근원지 파악이 가능하다. 특히 정책기반의 네트워크 보안 프레임워크 내의 구성요소(보안제어서버, 보안게이트웨이)만으로 근원지 주소를 파악할 수 있기 때문에 망 구성 환경에 영향을 받지 않으며 네트워크 서비스 성능에 영향을 끼치지 않고도 침입 근원지를 파악하여 대응 할 수 있는 능동적인 보안 기능이 가능하다.

• Proceedings of the Korea Information Assurance Society Conference
• /
• 2004.05a
• /
• pp.233-239
• /
• 2004

In this paper, we describe a defense mechanism to cope with stepping stones attacks in high-speed networks. (Stepping stones Attacker launches attacks not from their own computer but from intermediary hosts that they previously compromised.) We aim at tracing origin hacker system, which attack target system via stepping stones. There are two kind of traceback technology ; IP packet traceback, or connection traceback. We are concerned with connection traceback in this paper. We propose a new host-based traceback. The purpose of this paper is that distinguish between origin hacker system and stepping stones by using process structure of OS(Operating System).

• Journal of KIISE:Computing Practices and Letters
• /
• v.11 no.3
• /
• pp.235-245
• /
• 2005

The rapid development of computer network technology has brought the Internet as the major infrastructure to our society. But the rapid increase in malicious computer intrusions using such technology causes urgent problems of protecting our information society. The recent trends of the intrusions reflect that the intruders do not break into victim host directly and do some malicious behaviors. Rather, they tend to use some automated intrusion tools to penetrate systems. Most of the unknown types of the intrusions are caused by using such tools, with some minor modifications. These tools are mostly similar to the Previous ones, and the results of using such tools remain the same as in common patterns. In this paper, we are describing design and implementation of attacker-traceback system, which traces the intruder based on the multi-agent architecture. The system first applied SOM to classify the unknown types of the intrusion into previous similar intrusion classes. And during the intrusion analysis stage, we formalized the patterns of the tools as a knowledge base. Based on the patterns, the agent system gets activated, and the automatic tracing of the intrusion routes begins through the previous attacked host, by finding some intrusion evidences on the attacked system.