• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.3
• /
• pp.667-678
• /
• 2016

Due to a development of the cable/wireless network infra, the traffic as big as unable to compare with the past is being served through the internet, the traffic is increasing every year following the change of the network paradigm such as the object internet, especially the traffic of about 1.6 zettabyte is expected to be distributed through the network in 2018. As the network traffic increases, the performance of the security infra is developing together to deal with the bulk terabyte traffic in the security equipment, and is generating hundreds of thousands of security events every day such as hacking attempt and the malignant code. Efficiently analyzing and responding to an event on the attack attempt detected by various kinds of security equipment of company is one of very important assignments for providing a stable internet service. This study attempts to overcome the limit of study such as the detection of Tor network traffic using the existing low-latency by classifying the anonymous network by means of the suggested algorithm about the event detected in the security infra.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2017.05a
• /
• pp.285-287
• /
• 2017

Currently, the world of data communication is not simply communication between server and user in a wired way, but using wireless environment, various devices communicate with each other in a wider and diverse environment to generate a large amount of data. In this environment, IoT is now located deep in our lives, and IoT technologies are used in many tasks, but the data used in IoT is exposed without sufficient protection from malicious behavior. Most of these devices do not have enough computing power to cope with malicious attacks. In this paper, we aim to make all devices that have sufficient computing power and safety from simple sensors to be able to have security according to the situation. The proposed technology is based on the importance of the device and computing power, and it is possible to select the encryption technology selectively and to improve security.

• Convergence Security Journal
• /
• v.16 no.6_1
• /
• pp.25-32
• /
• 2016

We can not respond asymmetric warfare effectively. The asymmetric operation is performed in asymmetric methods and means with different characteristics and functions to their enemy. And the character of the asymmetric operation have 'heterogeneity' and 'superiority' in principle. The type of asymmetric strategy is complex and diverse. Since we can classify the type of the asymmetric strategy in many different way and we must study in many ways and aspects. When we study asymmetric war previous cases from modern to ancient era, we can find that the key factors of the victory have superiority of the asymmetric strategy and discriminatory measures. The asymmetry is created when one party has to adapt to the strategic environment. If we want to secure a strategic advantage, we must take a number of case studies and countermeasures for asymmetric warfare.

• Journal of Intelligence and Information Systems
• /
• v.9 no.3
• /
• pp.81-97
• /
• 2003

In this paper, we suggest a method of robust watermarking for protection of multimedia data using the wavelet transform and artificial neural network. for the purpose of implementation, we decompose a original image using wavelet transform at level 3. After we classify transformed coefficients of other subbands using neural network except fur the lowest subband LL$_3$, we apply a calculated threshold about chosen cluster as the biggest. We used binary logo watermarks to make sure that it is true or not on behalf of the Gaussian Random Vector. Besides, we tested a method of dual watermark insertion and extraction. For the purpose of implementation, we decompose a original image using wavelet transform at level 3. After we classify transformed coefficients of other subbands using neural network except for the lowest subband LL$_3$, we apply a above mentioned watermark insert method. In the experimental results, we found that it has a good quality and robust about many attacks.

• Journal of Information Technology and Architecture
• /
• v.9 no.1
• /
• pp.33-42
• /
• 2012

Present many organizations are introduced to smartwork for reducing the operational cost and getting the labor's flexibility. The smartwork is the future-oriented worker's environment in which they can engage in their task, anytime and anywhere conveniently and efficiently. In spite of many smartwork advantages, the security problems are major issues and prevent to introducing and spreading of smartwork for organizations. Therefore, the success of the organization for smartwork environment is put in place appropriate security control model. This study is about security threats for smartwork security control model. We apply the exploratory method for this research, which are reviewing, analyzing of literature for extracting the security threats and clustering of the extracted security threats. Finally we define the 16's security threats according to the aspect of smartwork service layers.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.1
• /
• pp.167-177
• /
• 2018

As the number of attacks on vehicles has increased, studies on CAN-based security technologies are actively being carried out. However, since the upper layer protocol of CAN differs for each vehicle manufacturer and model, there is a great difficulty in researches such as developing anomaly detection for CAN or finding vulnerabilities of ECUs. In this paper, we propose a method to infer the detailed structure of the data field of CAN frame by analyzing CAN trace to mitigate this problem. In the existing Internet environment, many researches for reverse engineering proprietary protocols have already been carried out. However, CAN bus has a structure difficult to apply the existing protocol reverse engineering technology as it is. In this paper, we propose new field classification methods with low computation-cost based on the characteristics of data in CAN frame and existing field classification method. The proposed methods are verified through implementation that analyze CAN traces generated by simulations of CAN communication and actual vehicles. They show higher accuracy of field classification with lower computational cost compared to the existing method.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2014.04a
• /
• pp.475-478
• /
• 2014

최근 인터넷이 발전함에 따라 월드와이드웹(World Wide Web) 기반의 웹 서비스가 급격한 발전을 이루었다. 또한 이 웹 서비스를 바탕으로 다양한 컨텐츠들과 이를 이용하는 사용자의 수도 함께 증가하였다. 그러나 이와 같은 웹 서비스의 보편화가 증대될수록 이를 악용하려는 사이버 범죄 또한 비례하여 증가하고 있다. 최근에는 공격자들이 스마트폰을 대상으로 악성코드를 전파하기 위한 방법으로 웹 서비스를 활용하기 시작하면서 웹 서비스의 보안에 대한 중요성이 더욱 강조되고 있다. 이러한 웹 서비스 보안의 필요성을 인지하고, 많은 사람들이 무료로 쉽게 웹 서비스 보안취약점을 진단 할 수 있도록 여러 오픈소스 기반의 보안 취약점 진단도구가 연구, 개발되고 있다. 하지만 웹 서비스의 보안약점을 진단하는 도구의 적합성 평가 및 기능 분류가 명확하지 않아서 진단도구를 선택하고 활용함에 있어 어려움이 따른다. 본 논문에서는 OWASP에서 위험도에 따라 선정한 웹 서비스의 보안 취약점 Top 10 항목과 소프트웨어 보안약점 진단가이드 등을 통해 웹 서비스 보안 취약점을 진단하는 도구에 대한 분석 기준을 제시한다. 이후 오픈소스로 공개된 테스트 기반 취약점 탐지도구와 소스 기반 취약점 진단도구들에 대해 제시한 기준을 이용하여 분석한다. 본 논문의 분석결과로 웹 서비스의 안전성을 평가하기 위해 활용할 수 있는 진단 도구에 대한 분석정보를 제공함으로써 보다 안전한 웹 서비스의 개발과 운영에 기여할 것으로 기대한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.4
• /
• pp.795-805
• /
• 2019

Recently, there is a growing interest in network anomaly detection technology to tackle unknown attacks. For this purpose, diverse studies using data mining, machine learning, and deep learning have been applied to detect network anomalies. In this paper, we evaluate the decision tree to see its feasibility for network anomaly detection on NSL-KDD data set, which is one of the most popular data mining techniques for classification. In order to handle the over-fitting problem of decision tree, we select 13 features from the original 41 features of the data set using chi-square test, and then model the decision tree using TensorFlow and Scik-Learn, yielding 84% and 70% of binary classification accuracies on the KDDTest+ and KDDTest-21 of NSL-KDD test data set. This result shows 3% and 6% improvements compared to the previous 81% and 64% of binary classification accuracies by decision tree technologies, respectively.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.4
• /
• pp.775-784
• /
• 2019

Malware infringement attacks are continuously increasing in various environments such as mobile, IOT, windows and mac due to the emergence of new and variant malware, and signature-based countermeasures have limitations in detection of malware. In addition, analytical performance is deteriorating due to obfuscation, packing, and anti-VM technique. In this paper, we propose a system that can detect malware based on machine learning by using similarity hashing-based pattern detection technique and static analysis after file classification according to packing. This enables more efficient detection because it utilizes both pattern-based detection, which is well-known malware detection, and machine learning-based detection technology, which is advantageous for detecting new and variant malware. The results of this study were obtained by detecting accuracy of 95.79% or more for benign sample files and malware sample files provided by the AI-based malware detection track of the Information Security R&D Data Challenge 2018 competition. In the future, it is expected that it will be possible to build a system that improves detection performance by applying a feature vector and a detection method to the characteristics of a packed file.

• KIPS Transactions on Software and Data Engineering
• /
• v.10 no.2
• /
• pp.65-72
• /
• 2021

Recently, attacks on the network environment have been rapidly escalating and intelligent. Thus, the signature-based network intrusion detection system is becoming clear about its limitations. To solve these problems, research on machine learning-based intrusion detection systems is being conducted in many ways, but two problems are encountered to use machine learning for intrusion detection. The first is to find important features associated with learning for real-time detection, and the second is the imbalance of data used in learning. This problem is fatal because the performance of machine learning algorithms is data-dependent. In this paper, we propose the HSF-DNN, a network intrusion detection model based on a deep neural network to solve the problems presented above. The proposed HFS-DNN was learned through the NSL-KDD data set and performs performance comparisons with existing classification models. Experiments have confirmed that the proposed Hybrid Feature Selection algorithm does not degrade performance, and in an experiment between learning models that solved the imbalance problem, the model proposed in this paper showed the best performance.