• Journal of KIISE:Information Networking
• /
• v.32 no.3
• /
• pp.279-290
• /
• 2005

Recently, as the serious damage caused by DDoS attacks increases, the rapid detection and the proper response mechanisms are urgent. However, existing security mechanisms do not effectively defend against these attacks, or the defense capability of some mechanisms is only limited to specific DDoS attacks. In this paper, we propose a detection architecture against DDoS attack using data mining technology that can classify the latest types of DDoS attack, and can detect the modification of existing attacks as well as the novel attacks. This architecture consists of a Misuse Detection Module modeling to classify the existing attacks, and an Anomaly Detection Module modeling to detect the novel attacks. And it utilizes the off-line generated models in order to detect the DDoS attack using the real-time traffic. We gathered the NetFlow data generated at an access router of our network in order to model the real network traffic and test it. The NetFlow provides the useful flow-based statistical information without tremendous preprocessing. Also, we mounted the well-known DDoS attack tools to gather the attack traffic. And then, our experimental results show that our approach can provide the outstanding performance against existing attacks, and provide the possibility of detection against the novel attack.

• Journal of KIISE
• /
• v.43 no.5
• /
• pp.596-605
• /
• 2016

Since the Denial of Service Attack against multiple targets in the Korean network in private and public sectors in 2009, Korea has spent a great amount of its budget to build strong Internet infrastructure against DDoS attacks. As a result of the investments, many major governments and corporations installed dedicated DDoS defense systems. However, even organizations equipped with the product based defense system often showed incompetency in dealing with DDoS attacks with little variations from known attack types. In contrast, by following a capacity centric DDoS detection method, defense personnel can identify various types of DDoS attacks and abnormality of the system through checking availability of service resources, regardless of the types of specific attack techniques. Thus, the defense personnel can easily derive proper response methods according to the attacks. Deviating from the existing DDoS defense framework, this research study introduces a capacity centric DDoS detection methodology and provides methods to mitigate DDoS attacks by applying the methodology.

• Proceedings of the Korean Institute of Communication Sciences Conference
• /
• 2004.11a
• /
• pp.482-482
• /
• 2004

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.30 no.7B
• /
• pp.489-498
• /
• 2005

A Denial of Sewice (DoS) attack attempts to prevent legitimate users of a sewice from being adequately served by monopolizing networks resources and, eventually, resulting in network or system congestion. This paper proposes a Minority First (MF) gateway, which is capable of guaranteeing the Quality of Service (QoS) of legitimate service traffic under DoS situations. A MF gateway can rapidly determine whether an aggregated flow is a congestion-inducer and can protect the QoS of legitimate traffic by providing high priority service to the legitimate as aggregate flows, and localize network congestion only upon attack traffic by providing low priority to aggregate flows regarded as congestion-inducer. We verify through simulation that the suggested mechanism possesses excellence in that it guarantees the QoS of legitimate traffic not only under a regular DoS occurrence, but also under a Distributed DoS (DDoS) attack which brings about multiple concurrent occurrences of network congestion.

• Journal of KIISE:Information Networking
• /
• v.36 no.3
• /
• pp.173-183
• /
• 2009

We present a real-time monitoring system for detecting anomalous network events using the entropy. The entropy accounts for the effects of disorder in the system. When an abnormal factor arises to agitate the current system the entropy must show an abrupt change. In this paper we deliberately model the Internet to measure the entropy. Packets flowing between these two networks may incur to sustain the current value. In the proposed system we keep track of the value of entropy in time to pinpoint the sudden changes in the value. The time-series data of entropy are transformed into the two-dimensional domains to help visually inspect the activities on the network. We examine the system using network traffic traces containing notorious worms and DoS attacks on the testbed. Furthermore, we compare our proposed system of time series forecasting method, such as EWMA, holt-winters, and PCA in terms of sensitive. The result suggests that our approach be able to detect anomalies with the fairly high accuracy. Our contributions are two folds: (1) highly sensitive detection of anomalies and (2) visualization of network activities to alert anomalies.

• Proceedings of the Korea Multimedia Society Conference
• /
• 2003.11a
• /
• pp.128-131
• /
• 2003

최근 인터넷을 대상으로 한 네트워크 공격의 공격 경향은 분산 환경에서 다수 공격자의 대규모 분산 서비스 거부 공격(DoS)의 출현 및 해외 해커들의 국내 전산망을 우회 루트로 활용한 사례의 증가 등 고도화된 불법 행위가 점차 벙죄의 강력한 수단으로 이용되는 추세에 있다. 본 논문은 기존 네트워크 노드기반의 침입탐지시스템에서 효율성과 사용자 편의성을 보완하기 위하여 자기 복제가 가능한 이동 에이전트를 적용하여 호스트 간 자율적인 이동을 통해 관리자에게 네트워크 모니터링을 제공하고 침입을 탐지하는 침입탐지시스템을 제안하였다.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.32 no.2B
• /
• pp.90-99
• /
• 2007

It might be more efficient that detections of distributed denial of service (DDoS) attacks are done in backbone domain than in individual local networks or links. However, because existing schemes for detecting DDoS attack symptoms have been focused on individual packets or flows, they require much higher computational complexities. In this paper, we propose an efficient method to detect DDoS attack symptoms in backbone networks. Unlike conventional schemes focused on individual packets or flows, the proposed method is carried at aggregate traffic level. So, our proposed schemes can be operated with very lower computational complexity, and can be run in very high-speed backbone networks.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2003.05c
• /
• pp.2197-2200
• /
• 2003

인터넷의 사용이 증가함에 따라 여러 가지 유형의 인터넷 공격이 자주 발생하고 있다. 특히 다양한 서비스 거부 공격이나 분산 서비스 거부 공격들은 최근의 여러 공격 사례에서 발견되고 있어 그 위험성이 크게 나타나고 있다. 이러한 공격들에 대해 대처하기 어려운 이유들 중 하나는, 공격자가 IP 패킷을 조작하여 자신의 IP 주소를 속임으로써 공격의 근원지 파악을 어렵게 한다는 것이다. 이에, 조작된 IP 패킷을 사용한 공격에 대해 그 근원지를 파악할 수 있도록 하는, IP 역추적 연구의 필요성이 대두되었다. 본 논문에서는 이러한 IP 역추적 연구의 시도들 중 그 유용성이 인정되어 많은 연구자들에 의해 지속적인 개선이 이루어지고 있는, 확률적 패킷 마킹 기법을 기반으로 한 확장된 기법을 제안한다.

• Review of KIISC
• /
• v.19 no.3
• /
• pp.58-69
• /
• 2009

분산 서비스 거부(DDoS: Distributed Denial of service)공격은 다수의 소스에서 특정 목적지에 대하여 동시에 비정상적으로 대량의 패킷을 전송함으로써 목적지의 대역폭이나 처리력을 점유하게 된다. 최근의 DDoS 공격 통계에 의하면 초당 최대 오백만 패킷에 이르는 공격과 함께, 초당 백만 패킷 이상의 여러 공격들이 발생하고 있음을 보여준다. 이와 같이 DDoS 공격은 그 규모가 커지고 있고, 회수도 빈번하여 지고 있다. 본 논문에서는 DDoS 공격 대비를 위한 비용과 공격 발생시 서비스 중단으로 인한 경제 손실 모델 사례연구에 대하여 기술하고자 한다. 이를 통하여 비용 효율적인 DDoS 공격 대응 및 완화 기법의 설계를 위한 기초 자료로 활용하고자 한다.

• Journal of the Korea Convergence Society
• /
• v.12 no.5
• /
• pp.9-16
• /
• 2021

Due to the prolonged infectious disease of COVID-19 worldwide, there are various security threats due to network attacks on Internet of Things devices that are vulnerable to telecommuting. Initially, users of Internet of Things devices were exploited for vulnerabilities in Remote Desktop Protocol, spear phishing and APT attacks. Since then, the technology of network attacks has gradually evolved, exploiting the simple service discovery protocol of Internet of Things devices, and DRDoS attacks have continued to increase. Existing SSDPs are accessible to unauthorized devices on the network, resulting in problems with information disclosure and amplification attacks on SSDP servers. To compensate for the problem with the authentication procedure of existing SSDPs, we propose a hash-based SSDP that encrypts server-specific information with hash and adds authentication fields to both Notify and M-Search message packets to determine whether an authorized IoT device is present.