• 한국융합학회논문지
• /
• 제3권4호
• /
• pp.1-5
• /
• 2012

최근 IT기술의 발전에 따라 언제 어디서나 이용할 수 있는 U-Healthcare분야의 기술 개발이 빠르게 진행되고 있다. U-Healthcare 기술은 네트워크를 기반으로 하기 때문에 다양한 보안의 위협요소가 발생된다. 본 논문에서는 네트워크 공격 기반의 DOS/DDOS공격에 대한 위협을 알아보고, 기존 Detecting Early DOS/DDOS attacks through Packet Counting을 수정하여 U-Healthcare서비스 상황에 맞는 대응 기법을 제안한다.

• International Journal of Computer Science & Network Security
• /
• 제21권12호
• /
• pp.123-130
• /
• 2021

Cybersecurity has been vital for decades and will remain vital with upcoming ages with new technological developments. Every new day brings advancement in technology, which leads to new horizons, and at the same time, it brings new security challenges. Numerous researchers around the globe are continuously striving hard to provide better solutions for the daily basis of new arising security issues. However, the challenges are always there. These challenges become new norms during the current Covid pandemic, where most industries, small industrial enterprises, education, finance, public sectors, etc. were under several attacks and threats globally. The hacker has more opportunities during the pandemic period by shifting most of the operations live. This research enlightened the several cybersecurity attacks and threats during this pandemic time globally. It provided the best possible recommendations to avoid them using the cyber awareness and with appropriately linked training. This research can provide a guideline to the above stated sector by identifying the related attacks.

• International Journal of Computer Science & Network Security
• /
• 제22권1호
• /
• pp.276-282
• /
• 2022

One of the most essential foundations upon which big institutions rely in delivering cloud computing and hosting services, as well as other kinds of multiple digital services, is the security of infrastructures for digital and information services throughout the world. Distributed denial-of-service (DDoS) assaults are one of the most common types of threats to networks and data centers. Denial of service attacks of all types operates on the premise of flooding the target with a massive volume of requests and data until it reaches a size bigger than the target's energy, at which point it collapses or goes out of service. where it takes advantage of a flaw in the Transport Control Protocol's transmitting and receiving (3-way Handshake) (TCP). The current study's major focus is on an architecture that stops DDoS attacks assaults by producing code for DDoS attacks using a cloud controller and calculating Round-Tripe Time (RTT).

• ETRI Journal
• /
• 제33권5호
• /
• pp.770-779
• /
• 2011

Security quad and cube (SQC) is a network attack analyzer that is capable of aggregating many different events into a single significant incident and visualizing these events in order to identify suspicious or illegitimate behavior. A network administrator recognizes network anomalies by analyzing the traffic data and alert messages generated in the security devices; however, it takes a lot of time to inspect and analyze them because the security devices generate an overwhelming amount of logs and security events. In this paper, we propose SQC, an efficient method for analyzing network security through visualization. The proposed method monitors anomalies occurring in an entire network and displays detailed information of the attacks. In addition, by providing a detailed analysis of network attacks, this method can more precisely detect and distinguish them from normal events.

• 한국컴퓨터정보학회논문지
• /
• 제5권4호
• /
• pp.69-75
• /
• 2000

본 논문에서는 삽입 공격과 배제 공격을 탐지할 수 있는 네트워크 침입 탐지 시스템의 모델을 제시하였다. 이를 위해, 먼저 네트워크 침입 탐지 시스템에 대한 공격들을 살펴보았으며, 이들 공격의 탐지에 필요한 정보들을 세 가지 관점에서 분류하였다. 분류된 정보는 탐지를 위한 초기 설정 단계와 실행 단계에서 각각 사용하였다. 제시한 모델은 네트워크 침입 탐지 시스템이 각종 운영체제들의 동작 특성에 대한 정보를 데이터베이스에 유지 및 관리하고 있으며 데이터베이스로부터 테이블을 생성하고, 탐지 시에 이를 참조함으로써 목적지 시스템의 동작을 정확히 예측할 수 있게 된다. 또한, 제시된 모델에서 필요로 하는 데이터베이스와 테이블에 관련된 오버헤더는 별로 크지 않을 것이라 추정할 수 있다.

• Journal of Information Processing Systems
• /
• 제15권1호
• /
• pp.203-216
• /
• 2019

The nature of wireless transmission has made wireless sensor networks defenseless against various attacks. This paper presents warning message counter method (WMC) to detect blackhole attack, grayhole attack and sinkhole attack in wireless sensor networks. The objective of these attackers are, to draw the nearby network traffic by false routing information and disrupt the network operation through dropping all the received packets (blackhole attack), selectively dropping the received packets (grayhole and sinkhole attack) and modifying the content of the packet (sinkhole attack). We have also attempted light weighted symmetric key cryptography to find data modification by the sinkhole node. Simulation results shows that, WMC detects sinkhole attack, blackhole attack and grayhole attack with less false positive 8% and less false negative 6%.

• International Journal of Internet, Broadcasting and Communication
• /
• 제13권4호
• /
• pp.1-10
• /
• 2021

The purpose of the study is to contribute to the positive development of blockchain technology by providing data to examine security vulnerabilities and threats to blockchain-based services and review countermeasures. The findings of this study are as follows. Threats to the security of blockchain-based services can be classified into application security threats, smart contract security threats, and network (P2P) security threats. First, application security threats include wallet theft (e-wallet stealing), double spending (double payment attack), and cryptojacking (mining malware infection). Second, smart contract security threats are divided into reentrancy attacks, replay attacks, and balance increasing attacks. Third, network (P2P) security threats are divided into the 51% control attack, Sybil attack, balance attack, eclipse attack (spread false information attack), selfish mining (selfish mining monopoly), block withholding attack, DDoS attack (distributed service denial attack) and DNS/BGP hijacks. Through this study, it is possible to discuss the future plans of the blockchain technology-based ecosystem through understanding the functional characteristics of transparency or some privacy that can be obtained within the blockchain. It also supports effective coping with various security threats.

• ETRI Journal
• /
• 제41권5호
• /
• pp.560-573
• /
• 2019

Two supervised learning algorithms, a basic neural network and a long short-term memory recurrent neural network, are applied to traffic including DDoS attacks. The joint effects of preprocessing methods and hyperparameters for machine learning on performance are investigated. Values representing attack characteristics are extracted from datasets and preprocessed by two methods. Binary classification and two optimizers are used. Some hyperparameters are obtained exhaustively for fast and accurate detection, while others are fixed with constants to account for performance and data characteristics. An experiment is performed via TensorFlow on three traffic datasets. Three scenarios are considered to investigate the effects of learning former traffic on sequential traffic analysis and the effects of learning one dataset on application to another dataset, and determine whether the algorithms can be used for recent attack traffic. Experimental results show that the used preprocessing methods, neural network architectures and hyperparameters, and the optimizers are appropriate for DDoS attack detection. The obtained results provide a criterion for the detection accuracy of attacks.

• 한국컴퓨터정보학회논문지
• /
• 제21권7호
• /
• pp.1-8
• /
• 2016

Nowadays, distributed denial of service (DDoS) attacks on web sites reward attackers financially or politically because our daily lifes tightly depends on web services such as on-line banking, e-mail, and e-commerce. One of DDoS attacks to web servers is called HTTP-GET flood attack which is becoming more serious. Most existing techniques are running on the application layer because these attack packets use legitimate network protocols and HTTP payloads; that is, network-level intrusion detection systems cannot distinguish legitimate HTTP-GET requests and malicious requests. In this paper, we propose a practical detection technique against HTTP-GET flood attacks, based on the access behavior of inline objects in a webpage using NetFlow data. In particular, our proposed scheme is working on the network layer without any application-specific deep packet inspections. We implement the proposed detection technique and evaluate the ability of attack detection on a simple test environment using NetBot attacker. Moreover, we also show that our approach must be applicable to real field by showing the test profile captured on a well-known e-commerce site. The results show that our technique can detect the HTTP-GET flood attack effectively.

• 한국정보과학회논문지:정보통신
• /
• 제30권1호
• /
• pp.82-96
• /
• 2003

인터넷은 개방 프로토콜의 영향으로 빠르게 성장하여 글로벌 네트워크 환경으로 진화하였지만, 많은 위협들로부터 자산을 보호해야하는 문제를 초래하게 되었다. 정보보호에 있어서, 조직 내 전체 보안시스템들을 완전 가동하여 사고 발생 이전에 침입을 차단하는 것은 최선책이지만, 사고 발생 이전 또는 새롭게 개발된 공격들을 차단하기는 대단히 어렵다. 보안연합은 신뢰할 수 있는 보안영역들간의 신속하고 정확한 보안 정보 교환과 긴밀한 강호 협력을 통해 잠재적인 공격들을 사전에 준비하여 대응할 수 있으며 새로운 보호 기능들을 능동적으로 갱신하여 보다 강력한 보안 기능과 신속하게 대응한 수 있는 구조이다.