• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.1
• /
• pp.165-170
• /
• 2014

In this paper, a hierarchical authentication protocol is proposed to minimize authentication delay in proxy mobile IPv6 networks. The authentication function of the AAA server is distributed to the LMAs and the MAGs. If the LMAs or the MAGs have authentication information of the MNs, they authenticate the MN on behalf of the AAA servers. Therefore, the authentication delay is reduced. The AAA server is vulnerable to denial-of-service attack. If the AAA server is down, MNs cannot access the proxy mobile IPv6 network until they are authenticated. The proposed scheme reduces the load on the AAA server by distributing the authentication function to the LMAs and the MAGs.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.1
• /
• pp.155-163
• /
• 2014

To enhance network efficiency, content-centric networking (CCN) proposes that intermediated network nodes on a content-delivery path temporally cache transmitted contents. Then if an intermediated node receives a content request message (Interest) for previously cached content, the node directly transmits the cached content as a response message (Data) to requestors and finishes the transmission of the received Interest. Since Interest is performed by intermediated network nodes, it is possible to efficiently transmit contents and to effectively solve a network congestion problem caused around contents sources. For that, CCN utilizes both content store to temporarily cache content and pending Interest table (PIT) to record Interest incoming Face. However, it has mentioned the possibility of denial service attack using both the limitation of PIT resource and fake Interests. In this paper, we briefly describe the presented PIT flooding attack utilizing fake Interest. Then we introduce new attack possibility using fake Data and propose a countermeasure for the proposed attack. Also we evaluate the performance of our proposal.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2009.10a
• /
• pp.363-367
• /
• 2009

From the recent, an big issue of the internet attack is DDoS(Distributed Denial of Service). Some government agencies and companies will buy Anti-DDoS SW for protect their their network system form DDoS attack. But We don't have any objective valuation standard of Anti-DDoS SW. So When you try to buy an Anti-DDoS SW, you can get only subjective Anti-DDoS SW information which from Anti-DDoS SW vender. Anti-DDoS SW market is getting bigger, so market needs objective valuation standard of Anti-DDoS SW for a fair evaluation. In this paper, we describe a part of Anti-DDoS SW performance tests in valuation standard of Anti-DDoS SW.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.6
• /
• pp.1605-1618
• /
• 2016

In recent years, security incidents - such as personal information leakage, homepage hacking, DDoS and etc. - targeting finance companies(banks, securities companies, credit card companies, insurance companies and etc.) have increased steadily. In this paper, we analyze problems of information security management level in the existing electronic financial infrastructure from perspective of compliance and information security certification system and propose improvements to enable sustainable high level of information security activities under a comprehensive management system for the financial sector characteristics using ISMS, SECU-STAR and CNIVAM system.

• Review of KIISC
• /
• v.15 no.2
• /
• pp.74-82
• /
• 2005

오늘날 네트워크 보안 기술은 해커의 침입 탐지 및 제어, 분산 서비스 거부 공격의 방지 등 많은 분야에서 발전하여 왔다. 그러나, 최근 많은 문제를 발생시키면서 등장한 인터넷 웜은 기존의 네트워크 보안 장비들을 무력화시키며 인터넷 상에 연결된 많은 호스트들을 감염시키고 동시에 네트워크 자원을 소모시켜 버렸다. 실상 초기의 웜은 작은 규모의 네트워크에서 퍼지는 정도 일뿐 심각한 피해를 주는 경우는 거의 없었고 따라서 이에 대해서 심각한 대비책 등을 생각하지는 않았다. 그러나 2001년 발생한 CodeRed 웜은 인터넷에 연결된 많은 컴퓨터들을 순식간에 감염시켜 많은 경제적, 물질적 피해를 발생시켰고, 그 이후 2003년 1월에 발생한 Stammer 웜은 10분이라는 짧은 순간 안에 75000 여대 이상의 호스트를 감염시키고 네트워크 자체를 마비시켰다. 특히 Stammer 월은 국내에서 많은 피해를 유발시켰기에 더더욱 유명하다. 명절 구정과 맞물려 호황을 누리던 인터넷 쇼핑 몰과, 인터넷 금융 거래를 수행하던 은행 전산소 등을 일시에 마비시켜 버리면서 경제적으로도 실질적인 막대한 피해를 우리에게 주었다. 이런 웜을 막기 위해서 많은 보안 업체 및 연구소들이 나서고 있으나, 아직은 사전에 웜의 피해를 막을만한 확실한 대답을 얻지 못하고 있다. 본 논문에서는, 현재 수행하고 있는 여러 웜의 탐지기법에 대해서 조사한 결과를 설명하고, 이어서 본 연구소에서 수행하고 있는 웜의 탐지 기법에 대해서 설명하고 간단한 탐지 결과를 보일 것이다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.12 no.3
• /
• pp.39-47
• /
• 2002

This paper deals with study of a new framework for the traceback of distributed DoS(Denial of Service) attacks in the Internet, in which many sources flood "spoofed" IP packets towards a single victim. In our scheme, the destination host traces those anonymous packets' losses, and infers the logical end-to-end paths back towards the sources. This method is based on the fact that there is a strong correlation between packet losses when those packets traverse along a same route, and the simulation results show high probabilities of detecting the topology under a certain condition. Compared with previous approaches, our scheme has a number of distinct features: It can be performed in realtime or non-realtime, without any supports of routers or ISPs. Our results may be applied to the inference of physical topology and to support previous approaches.pproaches.

• Journal of Internet Computing and Services
• /
• v.13 no.2
• /
• pp.41-49
• /
• 2012

Wireless network support and extended mobile network environment with exponential growth of smart phone users allow us to utilize the network anytime or anywhere. Malicious attacks such as distributed DOS, internet worm, e-mail virus and so on through high-speed networks increase and the number of patterns is dramatically increasing accordingly by increasing network traffic due to this internet technology development. To detect the patterns in intrusion detection systems, an existing research proposed an efficient algorithm called the jumping window algorithm and analyzed approximately 2,000 patterns in Snort 2.1.0, the most famous intrusion detection system. using the algorithm. However, it is inappropriate from the number of TCAM lookups and TCAM memory efficiency to use the result proposed in the research in current environment (Snort 2.9.0) that has longer patterns and a lot of patterns because the jumping window algorithm is affected by the number of patterns and pattern length. In this paper, we simulate the number of TCAM lookups and the required TCAM size in the jumping window with approximately 8,100 patterns from Snort-2.9.0 rules, and then analyse the simulation result. While Snort 2.1.0 requires 16-byte window and 9Mb TCAM size to show the most effective performance as proposed in the previous research, in this paper we suggest 16-byte window and 4 18Mb-TCAMs which are cascaded in Snort 2.9.0 environment.

• Journal of KIISE:Computing Practices and Letters
• /
• v.15 no.9
• /
• pp.675-684
• /
• 2009

Internet worm can cause a traffic problem through DDoS(Distributed Denial of Services) or other kind of attacks. In those manners, it can compromise the internet infrastructure. In addition to this, it can intrude to important server and expose personal information to attacker. However, current detection and response mechanisms to worm have many vulnerabilities, because they only use local characteristic of worm or can treat known worms. In this paper, we propose a new framework to detect unknown worms. It uses macroscopic characteristic of worm to detect unknown worm early. In proposed idea, we define the macroscopic behavior of worm, propose a worm detection method to detect worm flow directly in IP packet networks, and show the performance of our system with simulations. In IP based method, we implement the proposed system and measure the time overhead to execute our system. The measurement shows our system is not too heavy to normal host users.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.19 no.3
• /
• pp.25-32
• /
• 2019

The core of the block chain technology is solving the problem of agreement on double payment, and the PoW, PoS and DPoS algorithms used for this have been studied. PoW in-process proofs are consensus systems that require feasible efforts to prevent minor or malicious use of computing capabilities, such as sending spam e-mail or initiating denial of service (DoS) attacks. The proof of the PoS is made to solve the Nothing at stake problem as well as the energy waste of the proof of work (PoW) algorithm, and the decision of the sum of each node is decided according to the amount of money, not the calculation ability. DPoS is that a small number of authorized users maintain a trade consensus through a distributed network, whereas DPS provides consent authority to a small number of representatives, whereas PoS has consent authority to all users. If PoS is direct democracy, DPoS is indirect democracy. This study aims to contribute to the continuous development of the related field through the study of the algorithm of the block chain agreement.

• Journal of KIISE:Databases
• /
• v.37 no.5
• /
• pp.258-266
• /
• 2010

In this paper, we introduce a novel method to predict next update of blogs. The number of RSS feeds registered on meta-blogs is on the order of several million. Checking for updates is very time consuming and imposes a heavy burden on network resources. Since blog search engine has limited resources, there is a fix number of blogs that it can visit on a day. Nevertheless we need to maximize chances of getting new data, and the proposed method which predicts update probability on blogs could bring better chances for it. Also this work is important to avoid distributed denial-of-service attack for the owners of blogs. Furthermore, for the internet as whole this work is important, too, because our approach could minimize traffic. In this study, we assumed that there is a specific pattern to when a blogger is actively posting, in terms of days of the week and, more specifically, hours of the day. We analyzed 15,119 blogs to determine a blogger's posting preference. This paper proposes a method to predict the update probability based on a blogger's posting history and preferred days of the week. We applied proposed method to 12,115 blogs to check the precision of our predictions. The evaluation shows that the model has a precision of 0.5 for over 93.06% of the blogs examined.