• Convergence Security Journal
• /
• v.7 no.1
• /
• pp.63-75
• /
• 2007

Most of computer systems to be connected to network have been exposed to some network attacks and became to targets of system attack. System managers have established the IDS to prevent the system attacks over network. The previous IDS have decided intrusions detecting the requested connection packets more than critical values in order to detect attacks. This techniques have False Positive possibilities and have difficulties to detect the slow scan increasing the time between sending scan probes and the coordinated scan originating from multiple hosts. We propose the port scan detection rules detecting the RST/ACK flag packets to request some abnormal connections and design the data structures capturing some of packets. This proposed system is decreased a False Positive possibility and can detect the slow scan, because a few data can be maintained for long times. This system can also detect the coordinated scan effectively detecting the RST/ACK flag packets to be occurred the target system.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.11 no.1
• /
• pp.130-140
• /
• 2010

SIP (Session Initiation Protocol) is a signaling protocol to provide IP-based VoIP (Voice over IP) service. However, many security vulnerabilities exist as the SIP protocol utilizes the existing IP based network. The SIP Malformed message attacks may cause malfunction on VoIP services by changing the transmitted SIP header information. Additionally, there are several threats such that an attacker can extract personal information on SIP client system by inserting malicious code into SIP header. Therefore, the alternative measures should be required. In this study, we analyzed the existing research on the SIP anomaly message detection mechanism against SIP attack. And then, we proposed a Co-occurrence based SIP packet analysis mechanism, which has been used on language processing techniques. We proposed a association rule generation and an attack detection technique by using the actual SIP session state. Experimental results showed that the average detection rate was 87% on SIP attacks in case of using the proposed technique.

• Journal of the Korea Society for Simulation
• /
• v.19 no.2
• /
• pp.73-80
• /
• 2010

A wireless sensor network which is deployed in hostile environment can be easily compromised by attackers. The selective forwarding attack can jam the packet or drop a sensitive packet such as the movement of the enemy on data flow path through the compromised node. Xiao, Yu and Gao proposed the checkpoint-based multi-hop acknowledgement scheme(CHEMAS). In CHEMAS, each path node enable to be the checkpoint node according to the pre-defined probability and then can detect the area where the selective forwarding attacks is generated through the checkpoint nodes. In this scheme, the number of hops is very important because this parameter may trade off between energy conservation and detection capacity. In this paper, we used the fuzzy rule system to determine adaptive threshold value which is the number of hops for the ACK packets. In every period, the base station determines threshold value while using fuzzy logic. The energy level, the number of compromised node, and the distance to each node from base station are used to determine threshold value in fuzzy logic.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.18 no.3
• /
• pp.121-129
• /
• 2008

This paper presents vulnerability identification method based on meaning which is making use of the concept of atomic vulnerability. Also, we are making use of decomposition and specialization processes which were used in DEVS/SES to get identifiers. This vulnerability representation method is useful for managing and removing vulnerability in organized way. It is helpful to make a relation between vulnerability assessing and intrusion detection rules in lower level. The relation enables security manager to response more quickly and conveniently. Especially, this paper shows a mapping between Nessus plugins and Snort rules using meaning based vulnerability identification method and lists usages based on three goals that security officer keeps in mind about vulnerability. The contribution of this work is in suggestion of meaning based vulnerability identification method and showing the cases of its usage for the rule integration of vulnerability assessment and intrusion detection.

• Journal of the Institute of Electronics Engineers of Korea TC
• /
• v.43 no.7 s.349
• /
• pp.84-92
• /
• 2006

To defeat abnormal traffic driven by DoS (Denial-of-Service) or DDoS (Distributed DoS), there has been a variety of researches or studies in a few decades. In this paper, we present the results of theoretical performance analysis between attack prevention schemes and attack mitigation schemes. The former is a scheme that prevents abnormal incoming traffic from forwarding into a specific network based on filtering rules, and the latter is a scheme that makes some perimeter or intermediate routers, which exist on the traffic forwarding path, prevent abnormal traffic based on their own abnormal traffic information, or that mitigates abnormal traffic by using quality-of-service mechanisms at the gateway of the target network. The aspects of theoretical performance analysis are defined as the transit rates of either normal traffic or false-positive traffic after an attack detection routine processes its job, and we also present the concrete network bandwidth rates to control incoming traffic.

• Journal of Digital Contents Society
• /
• v.10 no.3
• /
• pp.479-484
• /
• 2009

Security system of wireless network take on importance as use of wireless network increases. Detection and opposition about that is difficult even if attack happens because MANET is composed of only moving node. And it is difficult that existing security system is applied as it is because of migratory nodes. Therefore, system is protected from malicious attack of intruder in this environment and it has to correspond to attack immediately. In this paper, we propose intrusion detection system using cluster head in order to detect malicious attack and use resources efficiently. we used method that gathering of rules is defined and it judges whether it corresponds or not to detect intrusion more exactly. In order to evaluate performance of proposed method, we used blackhole, message negligence, jamming attack.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2003.05c
• /
• pp.2161-2164
• /
• 2003

현재 사용되고 있는 침입 탐지 시스템들은 새로운 공격 패턴을 가진 침입을 탐지하기 위하여 규칙 데이터베이스를 지속적으로 갱신하고 있다. 그러나 이러한 침입 탐지 능력은 현재 알려진 기술이나 기법들에 한정된다. 따라서, 기존침입 탐지 시스템들은 공격을 받은 후, 현재까지 존재하지 않았던 새로운 기법이 적용된 공격이나 다소 변형된 공격을 받게 되면 침입을 탐지하지 못하거나 능동적 대처를 하지 못하였으며, tcpdump 또는 libpcap과 같은 응용 레벨의 프로그램을 사용하였기 때문에 실시간으로 패킷들을 감시할 수 없었다. 이러한 추가적인 공격들을 탐지하기 위해서 보다 강력하고 능동적인 네트워크 기반의 대응 기술이 요구되는데, 이에 본 논문에서는 이러한 요구 사항을 해결하기 위하여 패킷 감시의 정확성과 침입에 대한 실시간 대응성을 높이는 커널 레벨에서 동작하는 침입 탐지 모듈과, 악의적인 목적을 가진 패킷들을 차단하는 필터링 모듈 개발 기법을 제시하고자 한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2016.10a
• /
• pp.228-231
• /
• 2016

현재 한 번의 공격으로 많은 피해를 줄 수 있는 국가기반시설 위주의 제어시스템은 사이버 공격의 대상으로 가장 적합하다고 할 수 있다. 이에 대비해 제어시스템에서 주로 사용되는 DNP3는 한정적이고 반복된 트래픽을 주고받아 화이트리스트 기반 보안 기법이 사이버 공격으로부터 효과적으로 시스템을 보호할 수 있다. 본 논문에서는 제어시스템에 알려져 있는 취약점에 대해서 소개하고, 화이트리스트 보안 기법을 적용하고 규칙을 정의하여 이상 징후를 탐지하였다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.1
• /
• pp.93-98
• /
• 2012

MANET composed of only moving nodes is concerned to core technology to construct ubiquitous computing environment. Also, it is a lack of security because of no middle infrastructure. So, it is necessary to intrusion detection system which can track malicious attack. In this study, cluster was used to stable intrusion detection, and rule about various attacks was defined to detect accurately attack that seems like network problem. Proposed method through experience was confirmed that stable detection rate was showed although number of nodes increase.

• Proceedings of the Korea Multimedia Society Conference
• /
• 2001.11a
• /
• pp.662-665
• /
• 2001

기존의 규칙기반 침입탐지 시스템은 사후처리시 규칙 추가로 인하여 새로운 변종의 공격을 탐지하지 못한다. 본 논문에서는 규칙기반 시스템의 한계점을 극복하기 위하여, 시간지연 신경망(Time Delay Neural Network; 이하 TDNN) 침입탐지 시스템을 제안한다. 네트워크강의 패킷은 바이트 단위를 하나의 픽셀로 하는 0에서 255사이 값으로 이루어진 그레이 이미지로 볼 수 있다. 이러한 연속된 패킷이미지를 시간지연 신경망의 학습패턴으로 사용한다. 정상적인 흐름과 비정상적인 흐름에 대한 패킷 이미지를 학습하여 두 가지 클래스에 대한 신경망 분류기를 구현한다. 개발하는 침입탐지 시스템은 알려진 다양한 침입유형뿐만 아니라, 새로운 변종에 대해서도 분류기의 유연한 반응을 통하여 효과적으로 탐지할 수 있다.