• The KIPS Transactions:PartD
• /
• v.13D no.1 s.104
• /
• pp.67-74
• /
• 2006

The security requirements identification in the software development has received some attention recently. However, previous methods do not provide clear method and process of security requirements identification. We propose a process that software developers can build application specific security requirements from state transition diagrams at the security threat location. The proposed process consists of building model and identifying application specific security requirements. The state transition diagram is constructed through subprocesses i) the identification of security threat locations using security failure data based on the point that attackers exploit software vulnerabilities and attack system assets, ii) the construction of a state transition diagram which is usable to protect, mitigate, and remove vulnerabilities of security threat locations. The identification Process of application specific security requirements consist of i) the analysis of the functional requirements of the software, which are decomposed into a DFD(Data Flow Diagram; the identification of the security threat location; and the appliance of the corresponding state transition diagram into the security threat locations, ii) the construction of the application specific state transition diagram, iii) the construction of security requirements based on the rule of the identification of security requirements. The proposed method is helpful to identify the security requirements easily at an early phase of software development.

• Journal of the Korea Society of Computer and Information
• /
• v.26 no.4
• /
• pp.93-103
• /
• 2021

Despite the efforts of financial authorities in conducting the direct management and supervision of collection agents and bond-collecting guideline, the illegal and unfair collection of debts still exist. To effectively prevent such illegal and unfair debt collection activities, we need a method for strengthening the monitoring of illegal collection activities even with little manpower using technologies such as unstructured data machine learning. In this study, we propose a classification model for illegal debt collection that combine machine learning such as Support Vector Machine (SVM) with a rule-based technique that obtains the collection transcript of loan companies and converts them into text data to identify illegal activities. Moreover, the study also compares how accurate identification was made in accordance with the machine learning algorithm. The study shows that a case of using the combination of the rule-based illegal rules and machine learning for classification has higher accuracy than the classification model of the previous study that applied only machine learning. This study is the first attempt to classify illegalities by combining rule-based illegal detection rules with machine learning. If further research will be conducted to improve the model's completeness, it will greatly contribute in preventing consumer damage from illegal debt collection activities.

• Proceedings of the Korea Multimedia Society Conference
• /
• 2012.05a
• /
• pp.332-335
• /
• 2012

본 논문에서는 CAT(Cellular Automata Transform) 성질을 이용하여 의료 영상의 단계적 변환을 제안한다. 적용 방법은 먼저, CAT 초기 값과 다양한 규칙에 따라 단계적으로 Gateway Values와 rule matrix에 대한 전이행렬 T를 이용하여 CAT 기저함수를 생성한다. 그런 다음, 생성된 CAT 기저함수를 의료 영상에 곱하여 영상을 다양한 방법으로 변환한다. 마지막으로, 키 공간 분석을 통하여 제안한 방법이 높은 영상 변환 및 보안의 성질을 가졌음을 검증한다.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2006.05a
• /
• pp.761-764
• /
• 2006

We have developed a new remote-configurable firewall system that provides secure and easy-to-use access to home-network appliances such as network cameras, PVRs, and home file servers, through the internet. With a simple web browser operation, remote users can dynamically open and close the firewall of the home gateway. The firewall rule creation is based on an authentication of the remote client, and thus only packets from the authorized client can pass through the firewall, we analyses the sorority design for home gateway in ubiquitous surroundings.

• Proceedings of the KIEE Conference
• /
• summer
• /
• pp.406-408
• /
• 2004

It is very necessary to adopt bad data processing in order to maintain the security and the reliability of data acquisition and management in the substation. This paper presents a bad data processing method of per module unit by using rule based system. The propriety of this method has been verified by the case study

• Korean Security Journal
• /
• no.29
• /
• pp.163-191
• /
• 2011

Recently, the problems in school violence did not stop on the crime between the members at the school and which developed into the invasion crime of the school caused by outsiders. The school is no more the safety zone from the crime. Particularly, in the case of the elementary school, because there are nearly no people who oppose to the outside attacker and can control this, it is the place where it is vulnerable to the invasion crime. The Metropolis of Seoul implements the School Sheriff system within the jurisdiction bureau, in the public elementary school. However, actually the School Sheriff business is being managed, never applying a rule in the Security Industry Law with the main content, that is the Security Industry Law application is excluded. Because the jurisdiction on the contract of Seoul City and operating company are run, the various issues is caused. First, since it is not being considered as a security business, the commercial liability insurance for security company has no chance to applicate when the operation company and the School Sheriff have related damage generation. So the security for the indemnification of loss of the victim is weak. Second, The task of the School Sheriff is ruled just by in the individual contracts. But it is insufficient with this thing. The related duties are required some supplement like a general rule application including the obligation of the guard in the security industry law. Third, the education of the School Sheriff needs to connect with the educational programme in the security industry law. The related professional education specially needed for the prevention of school violence ought to be reserved compensation. Forth, the citizens still demand the strengthening of police patrol for the surroundings of a school in spite of the result of Seoul City's public survey. Therefore, the active relation of cooperation with the police needs to be supported legally and institutionally with the Security Industry Law application. Fifthly, the success of the School Sheriff business can be more guaranteed with the supervision of the legal and institutional device like a the Security Industry Law application or police and all sorts of administrative execution's and etc.

• Convergence Security Journal
• /
• v.8 no.3
• /
• pp.1-8
• /
• 2008

The pattern matching part of Intrusion Detection System based on misuse-detection mechanism needs much processing time and resources, and it has become a bottleneck in system performance. Moreover, it derives denial-of-service attack. In this paper, we propose (1) framework architecture that is strong against denial-of-service attack and (2) efficient pattern matching method especially for web server system. By using both of these 2 methods, we can maintain web server system efficiently secure against attacks including denial-of-service.

• Proceedings of the Korean Information Science Society Conference
• /
• 2005.11a
• /
• pp.85-87
• /
• 2005

프로그래밍 기술과 인터넷 통신의 발달로 인하여 보안성이 검증되지 않은 다양한 프로그램들이 생성되고 쉽게 유포되어 보안 취약성으로 인해 야기되는 다양한 문제의 심각성이 더해가고 있다. 따라서 사용자가 보안상 안전하게 사용할 수 있는 소프트웨어 인증절차가 필수적으로 요구되고 있는데, 이를 해결하기 위해 소프트웨어 안전성 평가에 대한 연구가 진행 중이지만, 기존의 방법들은 특정 영역에 한정적이어서 일반적인 소프트웨어의 보안성 평가(security evaluation) 방법으로써 부적합하다. 뿐만 아니라 기존의 시스템들은 단순 패턴매칭에 기반을 두고 있어 오용탐지가 크고 정확성이 떨어진다는 문제점을 가지고 있다. 따라서 본 논문에서는 이러한 문제점들을 해결하기 위해 악성프로그램 코드의 구조와 흐름을 분석하여 규칙으로 정의하고 그 규칙에 따라 검사 대상 프로그램 코드에서 악성코드와 취약점 흐름을 탐지하는 규칙 기반의 소프트웨어 보안성 검증 시스템 프로토타입을 제안한다. 제안한 검증 시스템의 프로토타입은 악성코드와 소프트웨어 취약성을 동시에 탐지하여 보안성을 평가함으로써 범용적인 소프트웨어 평가에 활용 가능할 것이다.

• Journal of the Korea Society of Computer and Information
• /
• v.6 no.1
• /
• pp.60-66
• /
• 2001

We designed a role-based access control model that can resolve the complicated tasks of control requirements. The designed access control model can control permissions efficiently use of a role-based access control. It guarantees the confidentiality integrity and availa information making use of identity-based and rule-based access controls. It can also centre information flow. Our access control model protects resources from unauthorized accesses b multi-level security policies such as role, security level, integrity level and ownership.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2001.11a
• /
• pp.43-47
• /
• 2001

본 논문은 신경망 이론중 하나인 Adaptive Resonance Theory(ART)을 사용하여 네트워크 상의 불법적인 침입을 탐지하는 기법에 대한 연구이다. ART는 비교사 학습을 하는 신경망으로써, 적응적인 학습능력이 있으며, 또 새로운 패턴에 대해서 새로운 클러스터를 생산하는 능력이 있다. ART의 이러한 특성을 이용하여, 여러 가지 침입패턴을 네트워크상에서 생산하여 학습을 시키고, 또 test 했으며, test 이후에도 on-line 상에서 새로운 공격 pattern도 찾아냄을 보였다. 따라서, 이미 알려진 침입뿐만 아니라 새롭게 발생하는 침입 기법에 대해서도 새로운 rule의 첨가 없이 적극적으로 대처할 수 있을 것으로 예측된다.