• Journal of Internet Computing and Services
• /
• v.3 no.3
• /
• pp.1-9
• /
• 2002

The various researches are investigated for transforming byte code into objective machine code which can be implemented in the specific processor using classical compiling methods to improve the execution speed of the JAVA language. The code generation techniques using pattern matching can generate more high-quality code than code expansion techniques. We provide, in this research, the standardized pattern describing methods and pattern matching techniques that can be used to generate the register-based inter-language which is for the effective native code generation from byte code. And we designed and realized the inter-code transformer with which we can generate the high-quality register-based inter-code using standardized pattern described formerly.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.20 no.6
• /
• pp.147-155
• /
• 2010

It has been widely addressed that static analysis techniques can play important role in identifying potential security vulnerability reside in source code. This paper proposes the design and application of security metrics that use both vulnerability information extracted from the static analysis, and significant factors of information that software handles. The security metrics are useful for both developers and evaluators in that the metrics help them identity source code vulnerability in early stage of development. By effectively utilizing the security metrics, evaluators can check the level of source code security, and confirm the final code depending on the characteristics of the source code and the security level of information required.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2018.01a
• /
• pp.153-154
• /
• 2018

전 세계 모바일 게임 소비 시장의 증가와 사용자들이 지속적으로 증가하는 반면 랜섬웨어와 같은 악성 프로그램들이 악의적인 목적을 위하여 모바일게임 시장에 피해를 주는 사례들도 지속적으로 증가하는 것도 사실이다. 본 논문에서는 모바일 게임을 이용한 악성코드 위협으로부터 보호하기 위하여 4차 산업의 가장 핵심 기술인 인공지능의 학습기술에 악성코드 분석기술을 연계시켜 새로운 모바일 악성코드 탐지와 속도를 향상시키는 기술의 필요성을 제시한다.

• The Journal of Korea Institute of Information, Electronics, and Communication Technology
• /
• v.11 no.4
• /
• pp.319-324
• /
• 2018

In this paper, we designed and implemented a code conversion method between ISO/IEC 10646 and the multi-byte code set. The Universal Multiple-Octet Coded Character Set(UCS) provides codes for more than 65,000 characters, huge increase over ASCII's code capacity of 128 characters. It is applicable to the representation, transmission, interchange, processing, storage, input and presentation of the written form of the language throughout the world. Therefore, it is so important to guide on code conversion methods to their customers during customer systems are migrated to the environment which the UCS code system is used and/or the current code systems, i.e., ASCII PC code and EBCDIC host code, are used with the UCS together. Code conversion utility including the mapping table between the UCS and IBM new host code is shown for the purpose of the explanation of code conversion algorithm and its implementation in the system. The programs are successfully executed in the real system environments and so can be delivered to the customer during its migration stage from the UCS to the current IBM code system and vice versa.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.1
• /
• pp.117-124
• /
• 2016

Virtual environment is widely used for analyzing malware which is increasing very rapidly. However, knowing this trend, hackers are adopting virtual environment detection techniques for malware to kill itself or stop malicious behaviors when detecting virtual environments. Various research is going on in order to thwart any efforts to utilize anti-virtualization techniques, but until now several techniques can evade most of well known virtual environments, making malware analysis very difficult. Emulab developed by Utah University assigns real systems and networks as researchers want in realtime. This research seeks how to use Emulab for malware analysis.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2017.04a
• /
• pp.283-286
• /
• 2017

소프트웨어 내제되어 있는 보안약점과 보안취약점으로 인해 사회적으로 많이 비용이 발생함에 따라 안전한 소프트웨어를 개발하고자하는 요구가 증가하고 있다. 최근 바이너리 코드에 내제된 보안약점을 분석하기 위해서 중간코드를 이용하여 정적분석을 수행하는 다양한 연구가 진행되고 있다. 중간 언어를 사용함으로 실행환경에 따라 달라지는 바이너리 코드가 중간언어로만 변환이 된다면 동일한 형태의 보안약점 분석기술을 통해 효과적인 수행이 가능하다. 이 기술의 핵심은 바이너리 코드로부터 얼마나 코드내의 자료형 및 변수를 재구성하여 중간언어로 변환하는 것이다. 본 논문에서는 이와 같은 바이너리 코드로부터 보안약점 분석을 위한 중간언어 변환시 효과적으로 자료형 및 변수 등에 관한 정보를 재구성하는 기법들에 대해서 조사 분석하였다.

• Convergence Security Journal
• /
• v.8 no.4
• /
• pp.1-8
• /
• 2008

Not only the recent hacking techniques are becoming more malicious with the sophisticated technology but also its consequences are bringing more damages as the broadband Internet is growing rapidly. These may include invasion of information leakage, or identity theft over the internet. Its intent is very destructive which can result in invasion of information leakage, hacking, one of the most disturbing problems on the net. This thesis describes the technology of how you can effectively analyze and detect these kind of E-Mail malicious codes. This research explains how we can cope with malicious code more efficiently by detection method.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.4
• /
• pp.605-616
• /
• 2020

Obfuscation technology delays the analysis of a program by modifying internal logic such as data structure and control flow while maintaining the program's functionality. However, the application of such obfuscation technology to malicious code frequently occurs to reduce the detection rate of malware in antivirus software. The obfuscation technology applied to protect software intellectual property is applied to the malicious code in reverse, which not only lowers the detection rate of the malicious code but also makes it difficult to analyze and thus makes it difficult to identify the functionality of the malicious code. The study of reverse obfuscation techniques that can be closely restored should also continue. This paper analyzes the characteristics of obfuscated code with the option of Pack the Output File and Import Protection among detailed obfuscation technologies provided by VMProtect 3.4.0, a popular tool among commercial obfuscation tools. We present a de-obfuscation algorithm.

• Proceedings of the Korean Information Science Society Conference
• /
• 2012.06c
• /
• pp.289-291
• /
• 2012

최근 신종/변종 악성코드 유포가 급증하고 있어 대량의 악성코드 수집/분석 및 경유/유포지 탐지를 위한 자동화 기술 연구가 활발하다. 대표적인 연구로서 웹과 SNS를 통해 유포되는 악성코드에 대한 자동수집 시스템, 대량의 악성코드에 대한 자동 동적/정적 분석 시스템, 시그니처 기반 악성코드 경유/유포지 탐지 시스템이 있다. 이들 연구에서 개발된 시스템들은 상호 독립적으로 관리가 가능하지만 악성코드에 대한 체계적이고 종합적인 분석 및 현황 파악을 위해서는 악성코드 정보를 통합 관리할 수 있는 시스템이 요구된다. 본 논문에서는 기존 연구에서 개발된 악성코드 자동 수집 시스템, 악성코드 자동 분석 시스템, 악성코드 경유/유포지 탐지 시스템에서 생성된 악성코드 정보를 통합 관리할 수 있는 악성코드 통합 관리 시스템을 제안한다.

• The Journal of Korea Institute of Information, Electronics, and Communication Technology
• /
• v.11 no.6
• /
• pp.724-731
• /
• 2018

Code obfuscation is a technology that makes programs difficult to understand for the purpose of interpreting programs or preventing forgery or tampering. Inverse reading is a technology that analyzes the meaning of origin through reverse engineering technology by receiving obfuscated programs as input. This paper is an analysis of obfuscation and reverse-toxicization technologies for binary code in a virtualized-based environment. Based on VMAttack, a detailed analysis of static code analysis, dynamic code analysis, and optimization techniques were analyzed specifically for obfuscation and reverse-dipidization techniques before obfuscating and reverse-dipulation techniques. Through this thesis, we expect to be able to carry out various research on virtualization and obfuscation. In particular, it is expected that research from stack-based virtual machines can be attempted by adding capabilities to enable them to run on register-based virtual machines.