• Journal of the Institute of Electronics Engineers of Korea CI
• /
• v.40 no.3
• /
• pp.156-163
• /
• 2003

Most watermarking techniques insert watermarks into transform coefficients in the frequency domain because we can consider robust or imperceptible frequency bands against malicious attacks to remove them. However, parameterization of 3-D data is not easy because of irregular attribution of connectivity information, while 1-I) or 2-D data is regular. In this paper we propose a new watermarking scheme for 3-D polygonal mesh models in the DCT domain. After we generate triangle strips by traversing the 3-D model and transform its vertex coordinates into the DCT domain, watermark signals are inserted into mid-frequency bands of AC coefficients for robustness and imperceptibility. We demonstrate that our scheme is robust against additive random noise, the affine transformation, and geometry compression by the MPEG-4 SNHC standard.

• Journal of the Korean Institute of Telematics and Electronics S
• /
• v.36S no.2
• /
• pp.46-56
• /
• 1999

A predictive controller is designed based upon stochastic methods for compensation time-delay effect on a system which has inherent time-delay caused by the spatial separation between controllers and actuators. The predictive controller estimates current outputs through linear prediction methods and probability functions utilizing previous outputs, and minimizes the malicious phenomena caused by the time-delay in precision control systems. To demonstrate effectiveness of this control methodology, we applied this algorithm for the control of a tele-operated DC servomotor. The experimental results show that this predictive controller is superior to the PID controller in terms of convergence-characteristics, and show that this controller expands the maximum allowable time-delay for a system maintaining the stability. Since the proposed predictor does not require models of plants - it requires only stochastic information for outputs --, it is a general scheme which can be applied for the control of systems which are difficult to model or the compensator of PID control.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.11 no.1
• /
• pp.536-551
• /
• 2017

With the advancement and deployment of leading-edge telecommunication technologies for sensing and collecting, computing related information, Cloud of Things (CoTs) has emerged as a typical application platform that is envisioned to revolutionize the daily activities of human society, such as intelligent transportation, modern logistics, food safety, environmental monitoring, etc. To avoid any possible malicious attack and resource abuse, employing hash functions is widely recognized as one of the most effective approaches for CoTs to achieve message integrity and data authentication. The Whirlpool hash function has served as part of the joint ISO/IEC 10118-3 International Standard by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). In this paper, we propose an effective differential fault analysis on Whirlpool in the byte-oriented random fault model. The mathematical analysis and experimental results show that 8 random faults on average are required to obtain the current 512-bit message input of whirlpool and the secret key of HMAC-Whirlpool. Our work demonstrates that Whirlpool and HMAC-Whirlpool are both vulnerable to the single byte differential fault analysis. It provides a new reference for the security analysis of the same structure of the hash functions in the CoTs.

• Journal of Internet Computing and Services
• /
• v.12 no.1
• /
• pp.1-10
• /
• 2011

The spectrum sensing is one of the fundamental functions to realize the cognitive radios. One of problems in the spectrum sensing is that the performance of spectrum sensing can be degraded due to fading and shadowing. In order to overcome the problem, cooperative spectrum sensing method is proposed, which uses a distributed detection model and can increase sensing performance. However, the performance of cooperative spectrum sensing can be still affected by the interference factors such as obstacle and malicious user. Especially, most of cooperative spectrum sensing methods only considered the stationary primary user. In the ubiquitous environment, however the mobile primary users should be considered. In order to overcome the aforementioned problem, in this paper we propose a robust spectrum detection method based on localization where we estimate the location of the mobile primary user, and then based on the location and transmission range of primary user we detect interference users if there are, and then the local sensing reporting from detected interference users are excluded in the decision fusion process. Through simulation, it is shown that the sensing performance of the proposed scheme is more accurate than that of conventional other schemes

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.8 no.4
• /
• pp.1307-1323
• /
• 2014

With the exhaustion of global IPv4 addresses, IPv6 technologies have attracted increasing attentions, and have been deployed widely. Meanwhile, new applications running over IPv6 networks will change the traditional traffic characteristics obtained from IPv4 networks. Traditional models obtained from IPv4 cannot be used for IPv6 network monitoring directly and there is a need to investigate those changes. In this paper, we explore the flow features of IPv6 traffic and compare its difference with that of IPv4 traffic from flow level. Firstly, we analyze the differences of the general flow statistical characteristics and users' behavior between IPv4 and IPv6 networks. We find that there are more elephant flows in IPv6, which is critical for traffic engineering. Secondly, we find that there exist many one-way flows both in the IPv4 and IPv6 traffic, which are important information sources for abnormal behavior detection. Finally, in light of the challenges of analyzing massive data of large-scale network monitoring, we propose a group flow model which can greatly reduce the number of flows while capturing the primary traffic features, and perform a comparative measurement analysis of group users' behavior dynamic characteristics. We find there are less sharp changes caused by abnormity compared with IPv4, which shows there are less large-scale malicious activities in IPv6 currently. All the evaluation experiments are carried out based on the traffic traces collected from the Northwest Regional Center of CERNET (China Education and Research Network), and the results reveal the detailed flow characteristics of IPv6, which are useful for traffic management and anomaly detection in IPv6.

• Journal of KIISE:Information Networking
• /
• v.29 no.6
• /
• pp.654-662
• /
• 2002

As the Internet technology becomes a major information infrastructure, an emerging problem is the tremendous increase of malicious computer intrusions. The present Intrusion Detection System (IDS) serves a useful purpose for detecting such intrusions, but the current situation requires more active response mechanism other than simple detection. This paper describes a multi-agent based tracing system against the intruders when the system is attacked. The focus of the study lies on the secure communication mechanism for the agent message communication. We have extended parameters on the KQML protocol, and apt)lied the public key encryption approach, The limitation might be the requirements of two-way authentication for every communication through the broker agent. This model ma)r not improve the efficiency, but it provides a concrete secure communication. Also this is one important factor to protect the agent and the tracing server during the tracing process.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.5
• /
• pp.1077-1086
• /
• 2017

Malware mutants based on existing malware is widely used because it can easily avoid the existing security system even with a slight pattern change. These malware appear on average more than 1.6 million times a day, and they are gradually expanding to IoT / ICS as well as cyber space, which has a large scale of damage. In this paper, we propose an analytical method based on features of PE Section and DLL that do not give much significance, rather than pattern-based analysis, Sandbox-based analysis, and CFG, Strings-based analysis. It is expected that the proposed model will be able to cope with effective malicious code in case of combined operation of various existing analysis technologies.

• Journal of the Korea Society of Computer and Information
• /
• v.26 no.12
• /
• pp.123-132
• /
• 2021

Malicious activities of Botnets are responsible for huge financial losses to Internet Service Providers, companies, governments and even home users. In this paper, we try to confirm the possibility of detecting botnet traffic by applying the deep learning model Convolutional Neural Network (CNN) using the CTU-13 botnet traffic dataset. In particular, we classify three classes, such as the C&C traffic between bots and C&C servers to detect C&C servers, traffic generated by bots other than C&C communication to detect bots, and normal traffic. Performance metrics were presented by accuracy, precision, recall, and F1 score on classifying both known and unknown botnet traffic. Moreover, we propose a stackable botnet detection system that can load modules for each botnet type considering scalability and operability on the real field.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.16 no.10
• /
• pp.3438-3457
• /
• 2022

As location-based services (LBS) are widely used in vehicular ad-hoc networks (VANETs), location privacy has become an utmost concern. Spatial cloaking is a popular location privacy protection approach, which uses a cloaking area containing k-1 collaborative vehicles (CVs) to replace the real location of the requested vehicle (RV). However, all CVs are assumed as honest in k-anonymity, and thus giving opportunities for dishonest CVs to submit false location information during the cloaking area construction. Attackers could exploit dishonest CVs' false location information to speculate the real location of RV. To suppress this threat, an edge-assisted Trusted Collaborative Anonymity construction scheme called TCA is proposed with trust mechanism. From the design idea of trusted observations within variable radius r, the trust value is not only utilized to select honest CVs to construct a cloaking area by restricting r's search range but also used to verify false location information from dishonest CVs. In order to obtain the variable radius r of searching CVs, a multiple linear regression model is established based on the privacy level and service quality of RV. By using the above approaches, the trust relationship among vehicles can be predicted, and the most suitable CVs can be selected according to RV's preference, so as to construct the trusted cloaking area. Moreover, to deal with the massive trust value calculation brought by large quantities of LBS requests, edge computing is employed during the trust evaluation. The performance analysis indicates that the malicious response of TCA is only 22% of the collaborative anonymity construction scheme without trust mechanism, and the location privacy leakage is about 32% of the traditional Enhanced Location Privacy Preserving (ELPP) scheme.

• The Journal of Korea Institute of Information, Electronics, and Communication Technology
• /
• v.16 no.3
• /
• pp.161-166
• /
• 2023

In recent years, new and variant hacking of binary codes has increased, and the limitations of techniques for detecting malicious codes in source programs and defending against attacks are often exposed. Advanced software security vulnerability detection technology using machine learning and deep learning technology for binary code and defense and response capabilities against attacks are required. In this paper, we propose a malware clustering method that groups malware based on the characteristics of the taint information after entering dynamic taint information by tracing the execution path of binary code. Malware vulnerability detection was applied to a three-layered Few-shot learning model, and F1-scores were calculated for each layer's CPU and GPU. We obtained 97~98% performance in the learning process and 80~81% detection performance in the test process.