• Proceedings of the Korea Information Processing Society Conference
• /
• 2018.10a
• /
• pp.279-281
• /
• 2018

랜섬웨어는 사용자의 중요 파일을 암호화한 후 금전을 요구하는 형태의 악성코드로, 전 세계적으로 큰 피해를 발생시켰다. 안드로이드 환경에서의 랜섬웨어는 앱을 통해 동작하기 때문에, 앱의 악의적인 암호화 기능 수행을 실시간으로 탐지할 수 있는 방안에 대한 연구들이 진행되고 있다. 자원 제한적인 안드로이드 환경에서 중요한 파일들에 대한 암호화 수행 여부를 실시간으로 탐지하기 위한 방안으로 Shannon 엔트로피 값 비교가 있다. 하지만 파일의 종류에 따라 Shannon 엔트로피 값이 크게 달라질 수 있으며, 암호화 기능 수행에 대한 오탐이 발생할 수 있다. 따라서 본 논문에서는 파일에 대한 분할된 Shannon 엔트로피 값을 측정하여 암호화 기능 수행 탐지의 정확성을 높이고자 한다.

• Electronics and Telecommunications Trends
• /
• v.36 no.5
• /
• pp.21-31
• /
• 2021

Ransomware attacks, such as Conti, Ryuk, Petya, and Sodinokibi, that target medical institutions are increasing rapidly. In 2020, in the United States., ransomware attacks affected over 600 separate clinics, hospitals, and organizations, and more than 18 million patient records. The cost of these attacks is estimated to be almost $21 billion USD. The first death associated with a ransomware attack was reported in 2020 by the University Hospital of Düesseldorf in Germany. In the case of medical institutions, as introduced in the Medjack report issued by TrapX Labs, in many cases, attackers target medical devices that are relatively insecure and then penetrate deep into more critical network infrastructure, such as EMR servers. This paper introduces security vulnerabilities of hospital medical devices, considerations for ransomware response by medical institutions, and related technology trends.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2020.05a
• /
• pp.177-179
• /
• 2020

최근의 사이버 침해 사고는 공격 대상을 지정하여 지속적으로 공격을 시도하는 APT(Advanced Persistent Threat)와 랜섬웨어(Ransomware) 공격이 주를 이룬다. APT 공격은 dirve by download 를 통하여 의도하지 않은 파일의 다운로드를 유도하고, 다운로드 된 파일은 역통신채널을 만들어 내부 데이터를 외부로 유출하는 방식으로 공격에 사용되는 악성 파일이 사용자 모르게 다운로드 되어 실행된다. 랜섬웨어는 스피어 피싱 (Spear-phishing) 과 같은 사회공학기법을 이용하여 신뢰 된 출처로 유장 된 파일을 실행하도록 하여 주요 파일들을 암호화 한다. 때문에 사용자와 공격자 사이 네트워크 중간에 위치한 패킷 기반의 보안 장비들은 사용자에 의해 다운로드 되는 파일들을 선제적으로 식별하고, 차단하여 침해 확산을 방지 할 수 있는 방안이 필요하다. 본 논문에서는 네트워크 패킷 레벨에서 알려진 악성파일을 식별하고 실시간 차단하는 방안에 대하여 연구하고자 한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.3
• /
• pp.521-530
• /
• 2017

In this paper, we propose a protection solution against intelligent Ransomware attacks by encrypting not only source files but also backup files of external storage. The system is designed to automatically back up to the cloud server at the time of file creation to perform monitoring and blocking in case a specific process affects the original file. When client creates or saves a file, both process identifiers, parent process identifiers, and executable file hash values are compared and protected by the whitelist. The file format that is changed by another process is monitored and blocked to prevent from suspicious behavior. By applying the system proposed in this paper, it is possible to protect against damage caused by the modification or deletion of files by Ransomware.

• Convergence Security Journal
• /
• v.23 no.1
• /
• pp.117-123
• /
• 2023

To detect advanced ransomware attacks with machine learning-based models, the classification model must train learning data with high-dimensional feature space. And in this case, a 'curse of dimension' phenomenon is likely to occur. Therefore, dimensionality reduction of features must be preceded in order to increase the accuracy of the learning model and improve the execution speed while avoiding the 'curse of dimension' phenomenon. In this paper, we conducted classification of ransomware by applying three machine learning models and two feature extraction techniques to two datasets with extremely different dimensions of feature space. As a result of the experiment, the feature dimensionality reduction techniques did not significantly affect the performance improvement in binary classification, and it was the same even when the dimension of featurespace was small in multi-class clasification. However, when the dataset had high-dimensional feature space, LDA(Linear Discriminant Analysis) showed quite excellent performance.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2019.01a
• /
• pp.359-360
• /
• 2019

본 논문에서는 2018년에 성횡한 악성코드에 대한 피해 사례를 살펴본 후 이를 적극적으로 대응하기 위한 방안을 살펴본다. 특히 가상통화 거래소에 대한 해킹 사고 및 가상화폐에 대한 지속적인 해킹 시도가 탐지되면서 관련 소식들이 언론에 지속적으로 보도되었다. 또한 이와 관련하여 PC 및 서버 자원을 몰래 훔쳐 가상통화 채굴에 사용하는 크립토재킹 공격기법도 함께 주목받았다. 랜섬웨어 부문은 갠드크랩 관련 보도가 대부분을 차지할 정도로 국내에서 지속적으로 이슈가 되었다. 또한 미국 법무부에서 최초로 북한 해커조직의 일원을 재판에 넘기면서 해커 그룹에 대한 관심이 집중되기도 했다. 2018년 전반적으로 이러한 가상통화 거래소 해킹, 크립토재킹, 랜섬웨어, 해커 그룹의 4가지 키워드를 도출하였으며, 이 중 해커 그룹은 북한과 중국의 경우를 나누어 총 5가지 주제를 통해 악성코드에 대한 주요 이슈들을 살펴본다. 본 논문에서는 이러한 악성코드의 공격을 근본적으로 해결할 수 있는 방안으로 클라이언트 측에 USB형태의 BBS(Big Bad Stick) 하드웨어를 통하여 제안하는 환경을 제안하고 안전한 서비스가 제공됨을 증명하여 본 연구가 새로운 보안성을 갖춘 시스템임을 보인다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.5
• /
• pp.1001-1010
• /
• 2021

Smart factories are complex systems which combine latest information technology (IT) with operation technology (OT). A smart factory aims to provide manufacturing capacity improvement, customized production, and resource reduction with these complex technologies. Although the smart factory is able to increase the efficiency through the technologies, the security level of the whole factory is low due to the vulnerability transfer from IT. In addition, the response and restoration of the business continuity plan are insufficient in case of damage due to the absence of factory security experts. The cope with the such problems, we propose an information security practice content for analyzing the damage by generating ransomware attacks in a digital twin-based smart factory similar to the real world. In our information security content, we introduce our conversion technique of physical devices into virtual machines or simulation models to build a practical environment for the digital twin. This content generates two types of the ransomware attacks according to a defined scenario in the digital twin. When the two generated attacks are successfully completed, at least 8 and 5 of the 23 virtual elements are take damage, respectively. Thus, our proposed content directly identifies the damage caused by the generation of two types of ransomware in the virtual world' smart factory.

• Journal of the Society of Disaster Information
• /
• v.17 no.4
• /
• pp.897-903
• /
• 2021

Purpose: Recently, ransomware damage that encrypts victim's data through hacking and demands money in exchange for releasing it is increasing domestically and internationally. Accordingly, research and development on various response technologies and solutions are in progress. Method: A secure storage area and a general storage area were created in the same virtual environment, and the sample data was saved by registering the access process. In order to check whether the stored sample data is infringed, the ransomware sample was executed and the hash function of the sample data was checked to see if it was infringed. The access control performance checked whether the sample data was accessed through the same name and storage location as the registered access process. Result: As a result of the experiment, the sample data in the secure storage area maintained data integrity from ransomware and unauthorized processes. Conclusion: Through this study, the creation of a secure storage area and the whitelist-based access control method are evaluated as suitable as a method to protect important data, and it is possible to provide a more secure computing environment through future technology scalability and convergence with existing solutions.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.3
• /
• pp.499-510
• /
• 2023

Recently, an intelligent and advanced cyber attack attacks a computer network of a public institution using a file containing malicious code or leaks information, and the damage is increasing. Even in public institutions with various information protection systems, known attacks can be detected, but unknown dynamic and encryption attacks can be detected when existing signature-based or static analysis-based malware and ransomware file detection methods are used. vulnerable to The detection method proposed in this study extracts the detection result data of the system that can detect malicious code and ransomware among the information protection systems actually used by public institutions, derives various attributes by combining them, and uses a machine learning classification algorithm. Results are derived through experiments on how the derived properties are classified and which properties have a significant effect on the classification result and accuracy improvement. In the experimental results of this paper, although it is different for each algorithm when a specific attribute is included or not, the learning with a specific attribute shows an increase in accuracy, and later detects malicious code and ransomware files and abnormal behavior in the information protection system. It is expected that it can be used for property selection when creating algorithms.

• Convergence Security Journal
• /
• v.23 no.2
• /
• pp.27-36
• /
• 2023

In recent years, ransomware attacks have become more organized and specialized, with the sophistication of attacks targeting specific individuals or organizations using tactics such as social engineering, spear phishing, and even machine learning, some operating as business models. In order to effectively respond to this, various researches and solutions are being developed and operated to detect and prevent attacks before they cause serious damage. In particular, honeypots can be used to minimize the risk of attack on IT systems and networks, as well as act as an early warning and advanced security monitoring tool, but in cases where ransomware does not have priority access to the decoy file, or bypasses it completely. has a disadvantage that effective ransomware response is limited. In this paper, this honeypot is optimized for the user environment to create a reliable real-time dynamic honeypot file, minimizing the possibility of an attacker bypassing the honeypot, and increasing the detection rate by preventing the attacker from recognizing that it is a honeypot file. To this end, four models, including a basic data collection model for dynamic honeypot generation, were designed (basic data collection model / user-defined model / sample statistical model / experience accumulation model), and their validity was verified.