• Journal of the Korea Society of Computer and Information
• /
• v.28 no.12
• /
• pp.129-136
• /
• 2023

The government of the Republic of Korea is conducting quality management of public open data by conducting a public data quality management level evaluation. Public open data is provided in various open formats such as XML, JSON, and CSV, with CSV format accounting for the majority. When diagnosing the quality of public open data in CSV format, the quality diagnosis manager determines and diagnoses the domain for each field based on the field name and data within the field of the public open data file. However, it takes a lot of time because quality diagnosis is performed on large amounts of open data files. Additionally, in the case of fields whose meaning is difficult to understand, the accuracy of quality diagnosis is affected by the quality diagnosis person's ability to understand the data. This paper proposes a domain discrimination model for public open data in CSV format using field names and data distribution statistics to ensure consistency and accuracy so that quality diagnosis results are not influenced by the capabilities of the quality diagnosis person in charge, and to support shortening of diagnosis time. As a result of applying the model in this paper, the correct answer rate was about 77%, which is 2.8% higher than the file format open data diagnostic tool provided by the Ministry of Public Administration and Security. Through this, we expect to be able to improve accuracy when applying the proposed model to diagnosing and evaluating the quality management level of public data.

• KIPS Transactions on Computer and Communication Systems
• /
• v.5 no.4
• /
• pp.95-102
• /
• 2016

Computer security incident such as confidential information leak and data destruction are constantly growing and it becomes threat to information in digital devices. To respond against the incident, digital forensic techniques are also developing to help digital incident investigation. With the development of digital forensic technology, a variety of forensic artifact has been developed to trace the behavior of users. Also, a diversity of forensic tool has been developed to extract information from forensic artifact. However, there is a issue that information from forensic tools has its own forms. To solve this problem, it needs to process data when it is output from forensic tools. Then it needs to compare and analyze processed data to identify how data is related each other and interpret the implications. To reach this, it calls for effective method to store and output data in the course of data processing. This paper aims to propose DFIOC (Digital Forensic Indicators Of Compromise) that is capable of transcribing a variety of forensic artifact information effectively during incident analysis and response. DFIOC, which is XML based format, provides "Evidence" to represent various forensic artifacts in the incident investigation. Furthermore, It provides "Forensic Analysis" to report forensic analysis result and also gives "Indicator" to investigate the trace of incidence quickly. By logging data into one sheet in DFIOC format for forensic analysis process, it is capable of avoiding unnecessary data processing. Lastly, since collected information is recorded in a normalized format, data input and output becomes much easier as well as it will be convenient to use for identification of collected information and analysis of data relationship.

• Journal of the Korea Society of Computer and Information
• /
• v.17 no.2
• /
• pp.127-137
• /
• 2012

Recently, as modern Internet uses mashups, Web 3.0, JavaScript/AJAX widely, the rate at which new vulnerabilities are being discovered is increasing rapidly. It can subsequently introduce big security threats. In order to efficiently mitigate these web application vulnerabilities and security threats, it is needed to rank vulnerabilities based on severity and consider the severe vulnerabilities during a specific phase of software development lifecycle (SDLC) for web applications. In this paper, we have first verified whether the risk rating methodology of OWASP Top 10 vulnerabilities is a reasonable one or not by analyzing the vulnerability data of web applications in the US National Vulnerability Database (NVD). Then, by inspecting the vulnerability information of web applications based on OWASP Top-10 2010 list and CWE (Common Weakness Enumeration) directory, we have mapped the web-related entries of CWE onto the entries of OWASP Top-10 2010 and prioritized them. We have also presented which phase of SDLC is associated with each vulnerability entry. Using this approach, we can prevent or mitigate web application vulnerabilities and security threats efficiently.

• Journal of Internet Computing and Services
• /
• v.7 no.6
• /
• pp.157-174
• /
• 2006

Ajax interaction model changes the posture of web application to become a stateful over HTTP. Ajax applications are long-lived inthe browser. XMLHTTPRequest (XHR) is used to facilitate the data exchange. Using HTTPS over this interaction is not viable because of the frequency of data exchange. Moreover, switching of protocols form HTTP to HTTPS for sensitive information is prohibited because of server-of-origin policy. The longevity, constraint, and asynchronous features of Ajax application need to hove a different authentication and session fondling mechanism that invoke re-authentication. This paper presents an authentication and session management scheme using Ajax. The scheme is design lo invoke periodic and event based re-authentication in the background using digest authentication with auto-generated password similar to OTP (One Time Password). The authentication and session management are wrapped into a framework called AWASec (Ajax Web Application Security) for coupling to avoid broken authentication and session management.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.12 no.2
• /
• pp.111-122
• /
• 2002

Malicious attackers generally attempt to intrude the target systems by taking advantage of existing system vulnerabilities and executing readily available code designed to exploit blown vulnerabilities. To the network security administrators, the rat and minimal step in providing adequate network security is to identify existing system vulnerabilities and patch them as soon as possible. Network-based vulnerability analysis scanners (NVAS), although widely used by network security engineers, have shortcomings in that they depend on limited information that is available and generally do not have access to hast-specific information. Host-based vulnerability analysis scanner (HVAS) can serve as an effective complement to NVAS. However, implementations of HVAS differ from one platform to another and from one version to another. Therefore, to security engineers who often have to maintain a large number of heterogeneous network of hosts, it is impractical to develop and manage a large number of HVAS. In this paper, we propose an agent-based architecture named ISMAEL and describe its prototype implementation. Manager process provides various agent processes with descriptiom on vulnerabilities to check, and an agent process automatically generates, compiles, and executes an Java code to determine if the target system is vulnerable or not. The result is sent back to the manager process, and data exchange occurs in % format. Such architecture provides maximal portability when managing a group of heterogeneous hosts and vulnerability database needs to be kept current because the manager process need not be modified, and much of agent process remains unchanged. We have applied the prototype implementation of ISMAEL and found it to be effective.

• Journal of Digital Convergence
• /
• v.11 no.1
• /
• pp.275-281
• /
• 2013

This space is for the of your study in English. If simple menu item changes or the addition of check items are necessary on GUI menu of existing test equipments for military facilities that are programmed by using RAD tools such as Visual C++, they should go through complex steps, such as numerous conducting steps, coding, flash design modification, recompiling and distribution. It is cumbersome process and waste much time. Also, on implementing them, it was worried about leaking secrets because a number of military security considerations were included. To solve such as the above problem, we proposed commercial RIA technologies and a COTS fault diagnostic knowledge-based system that implemented by the XML data design technique in this research. The proposed approach solves the problem of existing methods, reduced inspection time, and improved performance, usability, and maintainability.

• Spatial Information Research
• /
• v.22 no.5
• /
• pp.27-41
• /
• 2014

Recently, BIM(Building Information Modeling) has been applied to the infrastructure such as road and bridge, and information about the outside environment of buildings is needed for maintaining and managing the large urban facilities. In addition, the convergence between spatial information and Big-data has a large potentiality, in respect that considerable profits and developments in other application problems such as various simulations and urban plans, national land security, may be brought about on the basis of the interoperability of information between BIM and GIS. Therefore, this study attempted to suggest the development direction of a model integrating building for spatial information analysis and city on the subject by comparing and analyzing difference between information system and shape expression of IFC, CityGML and LandXML to efficiently link information between IFC as a standard model of BIM and CityGML as a standard model in the GIS sector and to prepare a basic fusion strategy and a method of utilization between BIM and GIS. The result of the study are as follow. Firstly, contents and structure of IFC, CityGML and LandXML are compared and analyzed. Secondly, the development direction of iBUM(Integrated Building and Urban Model) suggested, which is based on convergence technology for analysis of space information. Finally, a strategy and method of the BIM and GIS are proposed in the iBUM environment.

• International Journal of Computer Science & Network Security
• /
• v.23 no.3
• /
• pp.151-160
• /
• 2023

The Hadith is the second source of Islamic jurisprudence after Qur'an. Both sources are indispensable for muslims to practice Islam. All Ahadith are collected and are written. But most books of Hadith contain Ahadith that can be weak or rejected. So, quite a long time, scholars of Hadith have defined laws, rules and principles of Hadith to know the correct Hadith (Sahih) from the fair (Hassen) and weak (Dhaif). Unfortunately, the application of these rules, laws and principles is done manually by the specialists or students until now. The work presented in this paper is part of the automatic treatment of Hadith, and more specifically, it aims to automatically process the chain of narrators (Hadith Isnad) to find its different components and affect for each component its own tag using a statistical method: the Hidden Markov Models (HMM). This method is a power abstraction for times series data and a robust tool for representing probability distributions over sequences of observations. In this paper, we describe an important tool in the Hadith isnad processing: A chunker with HMM. The role of this tool is to decompose the chain of narrators (Isnad) and determine the tag of each part of Isnad (POI). First, we have compiled a tagset containing 13 tags. Then, we have used these tags to manually conceive a corpus of 100 chains of narrators from "Sahih Alboukhari" and we have extracted a lexicon from this corpus. This lexicon is a set of XML documents based on HPSG features and it contains the information of 134 narrators. After that, we have designed and implemented an analyzer based on HMM that permit to assign for each part of Isnad its proper tag and for each narrator its features. The system was tested on 2661 not duplicated Isnad from "Sahih Alboukhari". The obtained result achieved F-scores of 93%.

• Convergence Security Journal
• /
• v.14 no.4
• /
• pp.95-100
• /
• 2014

The trend of business work that is related to supply chain changed into e-business using the electronic document However, the small and medium enterprise organizations still use huge volume of paper document, especially in private sector. Recently, the need for eco-friendly and low cost logistics becomes increasing. For this, it has expanded to exchange or to use e-document rather than the paper or manual processing in supply chain business. Therefore, this paper proposed the electronic access system for supply chain by business process modeling. If it is using the proposed system, it can be saving the exchanged or the scanned document to system, and user can utilize that document on just accessing system whenever they need the document. We believe it might reduce the burden of each organization because they don't need to save large volume data to their system or place. Furthermore, the benefits will effect across the national as well as global.

• International Commerce and Information Review
• /
• v.6 no.2
• /
• pp.107-127
• /
• 2004

The rapid development of internet information technology has increased interest in e-Trade these days, but it is not activated greatly up to now. In order to promote e-Trade, it is essential to construct cooperative process such as connecting systems among trade related parties. Building e-Trade platform which is based on the infrastructure of the past trade automatic system is key point of promoting e-Trade. To do this, a study on the basic concept and specific components of e-Trade platform is needed absolutely. At this point of view, after this paper has examined domestic and foreign studies on the fundamental technologies about electronic commerce, it drew several key technologies that could be applied to e-Trade considering the current IT trend. Then it evaluates these technologies according to Technology Reference Model(TRM) of the National Computerization Agency. This will help us to show the operation strategy as well as the concept of future e-Trade platform and its composition. On the basis of the theoretical background, this paper classified NCA's technology model into 6 fields, which are application. data, platform, communication, security and management. Considering the key technologies, e-Trade platform has to be mutually connected and accept international standards such as XML. In the aspect of business side, trade relative agencies' business process as well as trading company's process has to be considered. Therefore, e-Trade platform can be classified into 3 parts which are service, infrastructure and connection. Infrastructure part is compared of circulating and managing system of electronic document, interface and service framework. Connecting service (application service) and additional service (application service) consist of service part. Connecting part is a linking mutual parts and can be divided into B2B service and B20 service. The organization operating this e-trade platform must have few responsibilities and requirements. It needs to positively accept existing infrastructure of trade automatic system and improving the system to complete e-trade platform. It also have to continuously develop new services and possess ability to operate the system for providing proper services to demanders. As a result, private sector that can play a role as TTP(Third Trust Party) is adequate for operating the system. In this case, revising law is necessary to support the responsibility and requirement of private sector.