• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.4
• /
• pp.687-697
• /
• 2023

Botnets, whose attack patterns are becoming more sophisticated and diverse, are recognized as one of the most serious cybersecurity threats today. This paper revisits the experimental results of botnet detection using autoencoder, a semi-supervised deep learning model, for UGR and CTU-13 data sets. To prepare the input vectors of autoencoder, we create data points by grouping the NetFlow records into sliding windows based on source IP address and aggregating them to form features. In particular, we discover a simple power-law; that is the number of data points that have some flow-degree is proportional to the number of NetFlow records aggregated in them. Moreover, we show that our power-law fits the real data very well resulting in correlation coefficients of 97% or higher. We also show that this power-law has an impact on the learning of autoencoder and, as a result, influences the performance of botnet detection. Furthermore, we evaluate the performance of autoencoder using the area under the Receiver Operating Characteristic (ROC) curve.

• Journal of Internet Computing and Services
• /
• v.20 no.6
• /
• pp.11-20
• /
• 2019

Numerous enterprises, organizations and individual users are exposed to large DDoS (Distributed Denial of Service) attacks. DDoS attacks are performed through a BotNet, which is composed of a number of computers infected with a malware, e.g., zombie PCs and a special computer that controls the zombie PCs within a hierarchical chain of a command system. In order to detect a malware, a malware detection software or a vaccine program must identify the malware signature through an in-depth analysis, and these signatures need to be updated in priori. This is time consuming and costly. In this paper, we propose a botnet detection scheme that does not require a periodic signature update using an artificial neural network model. The proposed scheme exploits Word2Vec and accelerated hierarchical density-based clustering. Botnet detection performance of the proposed method was evaluated using the CTU-13 dataset. The experimental result shows that the detection rate is 99.9%, which outperforms the conventional method.

• Review of KIISC
• /
• v.22 no.8
• /
• pp.15-20
• /
• 2012

최근 고도의 지능적인 대량 공격이 지속적으로 발생하고 있으며, 다형성 악성코드 공격 증가로 인하여 개인과 기업 및 국가 기반시설까지 사이버위협에 노출되고 있다. 현재, 국가차원의 대응센터에서는 이러한 위협 대응을 위해 공격 위험도를 CVSS(Common Vulnerability Scoring System) 취약점 등급시스템으로 점수화하여 단계적으로 경보를 발령한다. 하지만 현재의 경보발령 체계가 공격이 이루어진 후 사후 대책으로 제공되고 있어, 공격발생 전에 공격 징후를 포착하거나 공격량 예측과 같은 전역 네트워크 차원의 위협에 대한 대응 기술은 미비하다. 본 논문에서는 최근 봇넷 기반의 공격들이 많아지고 있는 상황에서 봇넷을 네트워크 위협 전조증상으로 정의하고, NCSC(National Cyber Security Center), KrCERT와 같은 국가기관의 경보등급 산정체계를 기반으로 전역차원의 예 경보 발령 및 공격량 예측 시스템에 대해 연구한다.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2019.01a
• /
• pp.111-114
• /
• 2019

최근 봇넷(Botnet)은 PC 뿐만 아니라 IoT 기기를 대상으로 확대되어 구축되고 있으며, 최신 기술들이 적용되면서 탐지와 방어가 어렵도록 구축되고 있다. 특히, 해커와 테러범 사이에서 많이 활용되는 정보 은닉 기술인 스테가노그래피(Steganography)가 적용된 Botnet(Stego-botnet)이 출현하였는데, 기존의 Botnet 형태와는 달리 SNS 환경을 Botnet 개체 사이의 통신 기반으로 활용하며 Steganography 기술로 통신 내용을 숨겨 탐지가 어렵기 때문에 그 위험성과 피해가 심각할 수 있다. 본 논문에서는 SNS 환경에서의 Steganography 기반 Botnet 구축 가능성을 조사하고, 실제로 카카오톡을 활용한 Steganography 기반 Botnet 통신 가능성을 실험한 후 결과를 제시하며, Steganography 기반 Botnet에 대한 탐지 및 역추적 방안을 간략히 제안한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2024.05a
• /
• pp.306-307
• /
• 2024

이 연구에서는 IoT 보안을 강화하기 위해 Mozi 봇넷의 분산 구조와 트래픽 특징을 기반으로 YARA와 RNN을 통합한 탐지 및 대응 시스템을 제안한다. Mozi 봇넷의 분산 구조와 트래픽 특징을 분석한 후, 이를 기반으로 YARA 규칙과 RNN을 결합하여 악성 코드를 탐지하는 시스템을 설계한다. 실험 결과를 통해 이 시스템이 높은 정확도와 효율성을 보일 것으로 예상되며, 향후 연구에서는 다양한 딥러닝 기술을 활용하여 보다 효과적인 보안 대응 시스템을 개발할 것으로 기대된다.

• Journal of Internet Computing and Services
• /
• v.18 no.1
• /
• pp.11-20
• /
• 2017

Recently, developments in the various fields of cloud computing technology has been utilized. Whereas the demand for cloud computing services is increasing, security threats are also increasing in the cloud computing environments. Especially, in case when the hosts interconnected in the cloud environments are infected and propagated through the attacks by malware. It can have an effect on the resource of other hosts and other security threats such as personal information can be spreaded and data deletion. Therefore, the study of malware analysis to respond these security threats has been proceeded actively. This paper proposes a type of attack clustering method of Zeus botnet using the k-means clustering algorithm for malware analysis that occurs in the cloud environments. By clustering the malicious activity by a type of the Zeus botnet occurred in the cloud environments. it is possible to determine whether it is a malware or not. In the future, it sets a goal of responding to an attack of the new type of Zeus botnet that may occur in the cloud environments.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.12 no.10
• /
• pp.1808-1814
• /
• 2008

In addition to RBL function, which is used to applying for spam e-mail filtering, as an effective way to deal with the recently widespread spam types, this paper proposes how to extract URL that was comprised in the original e-mail, apply it to RBL, and expand it. The BotNet, which is used to using for sending spam mails these days, has a problem that it is not able to solve with the distributed addresses of sent mails in spam e-mails. In general, as these spam e-mails are sent from the infected Zombi PC of individual user, the sent address itself is not efficient and is meaningless to use in RBL. As an effective way to filter spam e-mail sent by BotNet, this paper analyzes URLs that contained in the original spam e-mail and proposes how to effectively improve filter rate, based on the distribution data of URL site tempting users. This paper proposes the sending mechanism of spam e-mails from BotNet and the methods to realize those types of spam e-mails. In order to gather analyzable spam e-mails, this paper also carries out an experiment by configuring trap system of spam e-mail. By analyzing spam e-mails, which have been received during the certain period of experiment, this paper shows that the expanded RBL method, using URLs that contained in spam e-mails, is effective way to improve the filter distribution of spam e-mail.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.37B no.11
• /
• pp.1082-1089
• /
• 2012

Recent malicious attempts in Cyber space are intended to emerge national threats such as Suxnet as well as to get financial benefits through a large pool of comprised botnets. The evolved botnets use the Domain Name System(DNS) to communicate with the C&C server and zombies. DNS is one of the core and most important components of the Internet and DNS traffic are continually increased by the popular wireless Internet service. On the other hand, domain names are popular for malicious use. This paper studies on DNS-based cyber threats domain detection by data classification based on supervised learning. Furthermore, the developed cyber threats domain detection system using DNS traffic analysis provides collection, analysis, and normal/abnormal domain classification of huge amounts of DNS data.

• The KIPS Transactions:PartC
• /
• v.18C no.3
• /
• pp.127-134
• /
• 2011

Malicious botnet has been used for more malicious activities, such as DDoS attacks, sending spam messages, steal personal information, etc. To prevent this, many studies have been preceded. But malicious botnets have evolved and evaded detection systems. In particular, HTTP GET Request attack that exploits the vulnerability of the application layer is used. ALAB of ALADDIN proposed by ETRI is DDoS attack detection system that HTTP GET, Incomplete GET request flooding attack detection algorithm is applied. In this paper, we extend Incomplete GET detection algorithm of ALAB and derive the optimal configuration parameters to verify the validity of the algorithm ALAB by the study of the normal and attack packets.

• 정보보호뉴스
• /
• s.124
• /
• pp.22-23
• /
• 2008

지난해 등장한 정보보호 관련 사건의 특징 중 하나는 금전적 이익을 목적으로 한 사이버 범죄가 본격적으로 등장했다는 점이다. 이런 유형의 범죄는 비단 국내뿐만이 아니라, 미국, 유럽 등 전 세계적인 관심사로 떠올랐다. 이런 의미에서 지난 10월 경찰청 주최로 개최된 '국제 사이버테러 대응 공동심포지움' 참석차 한국을 방문한 독일 BKA소속 Mirko Manske로부터 독일 및 EU 지역의 사이버 범죄 현황에 대한 의견을 들어봤다. Mirko Manske는 독일 연방 범죄 경찰국(Bundeskr-iminalant, BKA) 소속으로 지난 2006년부터 국내 경찰청 사이버테러대응센터에 해당하는 BKA 내 National High Tech Crime Unit(NHTCU)의 정보분석 및 수집 전문가로 활동하고 있다