• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.20 no.3
• /
• pp.189-194
• /
• 2020

Most cyber breaches are caused by APT attacks using malware. Hackers use the email system as a medium to penetrate the target. It uses e-mail as a method to access internally, destroys databases using long-term collected vulnerabilities, and illegally acquires personal information through system operation and ransomware. As such, the e-mail system is the most friendly and convenient, but at the same time operates in a blind spot of security. As a result, personal information leakage accidents can cause great damage to the company and society as a whole. This study intends to suggest an effective methodology to securely manage the APT attack by strengthening the security configuration of the e-mail system operating in the enterprise.

• Journal of the Institute of Electronics and Information Engineers
• /
• v.54 no.2
• /
• pp.76-82
• /
• 2017

Malware, including ransomware to quickly detect, in this study, to provide an analysis method of malicious code through the image analysis that has been learned in the deep learning of artificial intelligence. First, to analyze the 2,400 malware data, and learning in artificial neural network Convolutional neural network and to image data. Extracts subgraphs to convert the graph of abstracted image, summarizes the set represent malware. The experimentally analyzed the malware is not how similar. Using deep learning of artificial intelligence by classifying malware and It shows the possibility of accurate malware detection.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.1
• /
• pp.93-103
• /
• 2019

Recently, malicious code distribution of ransomware through a web site based on a drive-by-download attack has resulted in service disruptions to the web site and damage to PC files for end users. Therefore, analyzing the characteristics of the target web site industry, distribution time, application type, and type of malicious code that is being exploited can predict and respond to the attacker's attack activities by analyzing the status and trend of malicious code sites. In this paper, we will examine the distribution of malicious codes to 3.43 million websites in Korea to draw out the characteristics of each detected landing site, exploit site, and distribution site, and discuss countermeasures.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.24 no.4
• /
• pp.522-528
• /
• 2020

Rapidly spreading malware, such as ransomware, trojans and Internet worms, have become one of the new major threats of the Internet recently. In order to resist against their malicious behaviors, it is essential to comprehend how malware propagate and how main factors affect spreads of them. In this paper, we aim to develop a spread prediction tool based on the modeling of malware epidemics. So we surveyed the related studies, and described the system design and implementation. In addition, we experimented on the spread of malware with major factors of malware using the developed spread prediction tool. If you make good use of the proposed prediction tool, it is possible to predict the malware spread at major factors and explore under various responses from a macro perspective with only basic knowledge of the recently wormable malware.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2022.05a
• /
• pp.432-435
• /
• 2022

최근 IT 산업의 지속적인 발전으로 사용자들을 위협하는 악성코드, 피싱, 랜섬웨어와 같은 사이버 공격 또한 계속해서 발전하고 더 지능화되고 있으며 변종 악성코드도 기하급수적으로 늘어나고 있다. 지금까지의 시그니처 패턴 기반의 탐지법으로는 이러한 방대한 양의 알려지지 않은 악성코드를 탐지할 수 없다. 따라서 CNN(Convolutional Neural Network)을 활용하여 악성코드를 탐지하는 기법들이 제안되고 있다. 이에 본 논문에서는 CNN 모델 중 낮은 인식 오류율을 지닌 모델을 선정하여 정확도(Accuracy)와 F1-score 평가 지표를 통해 비교하고자 한다. 두 가지의 악성코드 이미지화 방법을 사용하였으며, 2015 년 이후 ILSVRC 에서 우승을 차지한 모델들과, 추가로 2019 년에 발표된 EfficientNet 을 사용하여 악성코드 이미지를 분류하였다. 그 결과 2 바이트를 한 쌍의 좌표로 변환하여 생성한 256 * 256 크기의 악성코드 이미지를 ResNet-152 모델을 이용해 분류하는 것이 우수한 성능을 보임을 실험적으로 확인하였다.

• Proceedings of the Korean Society of Disaster Information Conference
• /
• 2023.11a
• /
• pp.278-281
• /
• 2023

연구목적: 본 연구는 요양병원 등 재난취약시설에 재난이 발생할 경우 잔류한 요구조자를 정확하게 파악하여 소방 등 대응기관에 제공하는 APC(Auto People Counting)의 인식률 개선에 목적이 있다. 현재 재난 발생 시 건물 내 요구조자의 현황 파악을 위해 대응기관이 재난 현장에 도착하여 건물관계자에게 직접 물어보고 있다. 이는 요구조자에 대한 부정확한 정보일 가능성이 있어 대응기관의 업무범위가 확대되고 이로인해 구조자의 안전에도 위험이 될 수 있다. APC는 건물내 출입하는 인원을 자동으로 집계하여 실시간 잔류인원 정보를 제공함으로써 재난 시 요구조자 현황을 정확히 파악할 수 있다. 본 연구에서는 APC가 보다 정확하게 출입 인원을 집계할 수 있도록 최적의 인공지능 알고리즘을 선정하는데 목적이 있다. 연구방법: 본 연구에서는 실제 재난취약시설에 설치되어 운영 중인 APC를 대상으로 카메라를 통해 출입 인원의 이미지를 인식하는 알고리즘을 개선하기 위해 CNN모델을 활용하여 베이스라인 모델링을 하였다. 다양한 알고리즘의 성능을 분석하여 상위 7개의 후보군을 선정하고 전이학습 모델을 활용하여 성능이 가장 우수한 최적의 알고리즘을 선정하는 방법으로 연구를 수행하였다. 연구결과: 실험결과 시간과 성능이 가장 좋은 Densenet201, Resnet152v2 모델의 정밀도와 재현율을 확인한 결과 모든 라벨에 대해서 정확도 100%를 나타내는 것을 확인할 수 있었다. 이 중 Densenet201 모델이 더 높은 성능을 보여주었다. 결론: 다양한 인공지능 알고리즘 중 APC에 적용할 수 있는 최적의 알고리즘을 선정하였고 이는 APC의 인식률을 개선하여 재난시 요구조자의 정보를 정확하게 파악하여 신속하고 안전한 구조작업이 가능할 것이다. 이는 요구조자의 안전한 구조뿐만 아니라 구조작업을 수행하는 구조자의 안전을 확보하는 데 기여할 것으로 기대된다. 향후 연무 등 다양한 재난상황에서 재난취약시설 내 출입인원을 정확하게 파악할 수 있도록 알고리즘 분석 및 학습에 대한 추가 연구가 요구된다.

• Journal of Digital Convergence
• /
• v.16 no.7
• /
• pp.9-17
• /
• 2018

Recently, much attention in electronic financial fraud has been dramatically increased. In particular, the electronic financial fraud has been transforming to social engineering. Despite the growing interest in electronic financial fraud, few guidelines exist how to effectively avoid the serious damage from electronic financial fraud. Moreover, it is rarely investigated cases of victims from financial fraud. Therefore, the purpose of this study is to investigate why financial fraud crime victims occurs. To enhance mundane realism, we conducted Focus Group Interview(FGI) with actual victims from financial fraud crime. Drawing analysis of FGI with actual victims, we found that there are certain damage patterns. Further, we found that the reason why financial fraud crime victims occurs is optimistic biases of humans rooted in behavioral economics. Therefore, this study provides the valuable guidelines and directions to prevent electronic financial fraud based on risk and crisis management perspective. Ultimately, this study is able to help the establishment and implementation of a comprehensive electronic financial fraud prevention policy.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.4
• /
• pp.847-857
• /
• 2019

Recently, various cyber threats such as Ransomware and APT attack are increasing by e-mail. The characteristic of such an attack is that it is important to take administrative measures by improving personal perception of security because it bypasses technological measures such as past pattern-based detection The purpose of this study is to investigate the human factors of employees who are vulnerable to spam mail attacks through field experiments and to establish future improvement plans. As a result of sending 7times spam mails to employees of a company and analyzing training report, It was confirmed that factors such as the number of training and the recipient 's gender, age, and workplace were related to the reading rate. Based on the results of this analysis, we suggest ways to improve the training and to improve the ability of each organization to carry out effective simulation training and improve the ability to respond to spam mail by awareness improvement.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.20 no.7
• /
• pp.613-621
• /
• 2019

Recently, with the development of the Internet of Things (IoT) and cloud computing technologies, security threats have increased as malicious codes infect IoT devices, and new malware spreads ransomware to cloud servers. In this study, we propose a threat-detection technique that checks obfuscated script patterns to compensate for the shortcomings of conventional signature-based and behavior-based detection methods. Proposed is a malicious code-detection technique that is based on malicious script-pattern analysis that can detect zero-day attacks while maintaining the existing detection rate by registering and checking derived distribution patterns after analyzing the types of malicious scripts distributed through websites. To verify the performance of the proposed technique, a prototype system was developed to collect a total of 390 malicious websites and experiment with 10 major malicious script-distribution patterns derived from analysis. The technique showed an average detection rate of about 86% of all items, while maintaining the existing detection speed based on the detection rule and also detecting zero-day attacks.

• Journal of Platform Technology
• /
• v.9 no.2
• /
• pp.26-37
• /
• 2021

E-mail is one of the important tools for communicating with people in everyday life. With COVID-19 (Coronavirus) increasing non-face-to-face activity, security incidents through e-mail such as spam, phishing, and ransomware are increasing. E-mail security incidents are increasing as social engineering attack using human psychology rather than arising from technological weaknesses that e-mails have. Security incidents using human psychology can be prevented and defended by improving security awareness. This study empirically studies the analysis of changes in response to malicious e-mail due to improved security awareness through malicious e-mail simulations on executives and employees of domestic and foreign company. In this study, the factors of security training, top-down security management, and security issue sharing are found to be effective in safely responding to malicious e-mail. This study presents a new study by conducting empirical analysis of theoretical research on security awareness in relation to malicious e-mail responses, and results obtained from simulations in a practical setting may help security work.