• Journal of the Korea Society of Computer and Information
• /
• v.12 no.1 s.45
• /
• pp.161-168
• /
• 2007

Web attack uses structural, logical and coding error or web application rather than vulnerability to Web server itself. According to the Open Web Application Security Project (OWASP) published about ten types of the web application vulnerability to show the causes of hacking, the risk of hacking and the severity of damage are well known. The detection ability and response is important to deal with web hacking. Filtering methods like pattern matching and code modification are used for defense but these methods can not detect new types of attacks. Also though the security unit product like IDS or web application firewall can be used, these require a lot of money and efforts to operate and maintain, and security unit product is likely to generate false positive detection. In this research profiling method that attracts the structure of web application and the attributes of input parameters such as types and length is used, and by installing structural database of web application in advance it is possible that the lack of the validation of user input value check and the verification and attack detection is solved through using profiling identifier of database against illegal request. Integral security management system has been used in most institutes. Therefore even if additional unit security product is not applied, attacks against the web application will be able to be detected by showing the model, which the security monitoring log gathering agent of the integral security management system and the function of the detection of web application attack are combined.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.4
• /
• pp.817-827
• /
• 2015

In this modern society, people are having a close relationship with smartphone. This makes easier for hackers to gain the user's information by installing the malware in the user's smartphone without the user's authority. This kind of action are threats to the user's privacy. The malware characteristics are different to the general applications. It requires the user's authority. In this paper, we proposed a new classification method of user requirements method by each application using the Principle Component Analysis(PCA) and Probabilistic K-Nearest Neighbor(PKNN) methods. The combination of those method outputs the improved result to classify between malware and general applications. By using the K-fold Cross Validation, the measurement precision of PKNN is improved compare to the previous K-Nearest Neighbor(KNN). The classification which difficult to solve by KNN also can be solve by PKNN with optimizing the discovering the parameter k and ${\beta}$. Also the sample that has being use in this experiment is based on the Contagio.

• Journal of the Korea Computer Industry Society
• /
• v.2 no.10
• /
• pp.1269-1284
• /
• 2001

The Secure Sockets Layer is a protocol for encryption TCP/IP traffic that provides confidentiality, authentication and data integrity. Also the SSL is intended to provide the widely applicable connection-oriented mechanism which is applicable for various application-layer, for Internet client/server communication security. SSL, designed by Netscape is supported by all clients' browsers and server supporting security services. Now the version of SSL is 3.0. The first official TLS vl.0 specification was released by IETF Transport Layer Security working group in January 1999. As the version of SSL has had upgraded, a lot of vulnerabilities were revealed. SSL and TLS generate the private key with parameters exchange method in handshake protocol, a lot of attacks may be caused on this exchange mechanism, also the same thing may be come about in record protocol. In this paper, we analyze SSL protocol, compare the difference between TLS and SSL protocol, and suggest what developers should pay attention to implementation.

• Convergence Security Journal
• /
• v.14 no.7
• /
• pp.85-90
• /
• 2014

Cloud computing originated simply to request and execute the desired operation from the network of clouds. It means that an IT resource that provides a service using the Internet technology. It is getting the most attention in today's IT trends. In cloud computing networks, devices and data centers which are composed of the server, storage and application are connected over network. That is, data of computers in different physical locations are integrated using the virtualization technology to provide a service. Therefore cloud computing system is a key information resource, standardized methods and assessment system are required. In this paper, we aims to derive the parameters and information for research of technical standards stability evaluation method associated with various cloud computing equipment.

• Convergence Security Journal
• /
• v.8 no.2
• /
• pp.41-50
• /
• 2008

Recently amount of traffic into the network rapidly increase since multimedia streaming services is generally adopted for application. In addition, various network management systems have been suggested for providing a stable service and QoS guarantee. It is necessary for such systems to have QoS monitoring module in order to evaluate acceptance or violation of QoS requirements by analogizing a state information of each node within network. In this paper, we suggest a network management system to evaluate QoS level between end-to-end agents and analysis traffics transmitted between them. The proposed system is implemented for the purpose of collecting network traffic information and monitoring of the view. The proposed system makes user easily understand information of QoS parameters such as throughput, delay and jitter by adopting a method of visual and numerical representation. To achieve this, we purportedly generate test packet into network for confirming acceptance or violation of QoS requirements from point of view of multimedia application service.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.3
• /
• pp.439-448
• /
• 2017

It is news from nowhere that post-quantum cryptography has side-channel analysis vulnerability. Side-channel analysis attack method and countermeasures for code-based McEliece cryptosystem and lattice-based NTRU cryptosystem have been investigated. Unfortunately, the investigation of the ring-LWE cryptosystem in terms of side-channel analysis is as yet insufficient. In this paper, we propose a chosen ciphertext simple power analysis attack that can be applied when ring-LWE cryptography operates on 8-bit devices. Our proposed attack can recover the key only with [$log_2q$] traces. q is a parameter related to the security level. It is used 7681 and 12289 to match the common 128 and 256-bit security levels, respectively. We identify the vulnerability through experiment that can reveal the secret key in modular add while the ring-LWE decryption performed on real 8-bit devices. We also discuss the attack that uses a similarity measurement method for two vectors to reduce attack time.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.3
• /
• pp.533-544
• /
• 2021

Using Shor algorithm, factoring and discrete logarithm problem can be solved effectively. The public key cryptography, such as RSA and ECC, based on factoring and discrete logarithm problem can be broken in polynomial time using Shor algorithm. NIST has been conducting a PQC(Post Quantum Cryptography) standardization process to select quantum-resistant public key cryptography. The multivariate quadratic based signature scheme, which is one of the PQC candidates, is suitable for IoT devices with limited resources due to its short signature and fast sign and verify process. We analyzes classic attacks and quantum attacks for Rainbow which is the only multivatiate quadratic based signature scheme to be finalized up to the round 3. Also we compute the attack complexity for the round 3 Rainbow parameters, and analyzes the security level of Rainbow, one of the PQC standardization candidates.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.1
• /
• pp.13-31
• /
• 2023

Korean Government-PKI (GPKI) is a public-key infrastructure which provides authentication and security functions for information system used by central government, local governments, and public institutions of the Republic of Korea to provide their own administrative and public services. The current cryptosystem of GPKI was established in the early 2000s, and more than ten years have passed since the last improvement in 2010. Over the past decade or so, the information security, including cryptography, has undergone many changes and will continue to face many changes. Therefore, for the sustainable security of GPKI, it is necessary to review the security of the cryptosystem at this point. In this paper, we analyze the current status and the security of technologies and standards used in the system. We identify cryptographic algorithms with degraded security, international standards which are obsoleted or updated, and cryptographic parameters that should be revised for the high security level. And based on this, we make several suggestions on the reorganization of cryptographic algorithms and related technologies for the security enhancement of GPKI.

• Journal of Digital Convergence
• /
• v.14 no.5
• /
• pp.333-339
• /
• 2016

Technology to optimize and utilize the use and supply of the electric power between consumer and supplier has been on the rise among the smart grid power market network in electric power demand management based on the Internet. Open Automated Demand Response system protocol, which can deliver Demand Response needed in electric power demand management to electricity supplier, system supplier and even the user is openADR 2.0b. This paper used the most credible, cosmopolitanly proliferated EPRI open source and analysed the variety of security vulnerability that developed VEN and VTN system may have. Using the simulator for attacking openADR protocol, the VEN/VTN system that has been implemented as EPRI open source was conducted to attack in a variety of ways. As a result of the analysis, we were able to get the results that the VEN/VTN system has security vulnerabilities to the parameter tampering attacks and service flow falsification attack. In conclusion, if you want to implement the openADR2.0b protocol system in the open or two-way communication environment smart grid network, considering a variety of security vulnerability should be sure to seek security technology and services.

• Convergence Security Journal
• /
• v.23 no.2
• /
• pp.103-113
• /
• 2023

In recent years, Unmanned Aerial Vehicles (UAV) have been widely used in various industries. However, as the depend ence on UAV increases rapidly, concerns about the security and safety of UAV are growing. Currently, various vulnerabili ties such as stealing the control right of the UAV or the right to communicate with the UAV in the web application are being disclosed. However, there is a lack of research related to the security of UAV. Therefore, in this paper, a study was conducted to determine whether the packet data was normal or abnormal by collecting packet data of an unmanned aerial vehicle in a HITL(Hardware In The Loop) simulation environment similar to the real environment. In addition, this paper proposes a method for reducing computational cost in the modeling process and increasing the ease of data interpretation, a machine learning-based anomaly detection model that detects abnormal data by learning only normal data, and optimized hyperparameter values.