• Journal of Internet Computing and Services
• /
• v.21 no.2
• /
• pp.91-97
• /
• 2020

Recently, phishing attacks targeting those involved in defense, security and unification have been on the rise. In particular, hacking attack organization Kimsuky has been engaged in activities to collect important information from public organizations through phishing attacks since 2013. In this paper, profiling analysis of phishing mail attack organization was performed. Through this process, we estimated the purpose of the attack group and suggested countermeasures.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.21 no.4
• /
• pp.15-23
• /
• 2021

In most hacking attacks, hackers intrudes inside for a long period of time and attempts to communicate with the outside using a circumvent connection to achieve purpose. research in response to advanced and intelligent cyber threats has been mainly conducted with signature-based detection and blocking methods, but recently it has been extended to threat hunting methods. attacks from organized hacking groups are advanced persistent attacks over a long period of time, and bypass remote attacks account for the majority. however, even in the intrusion detection system using intelligent recognition technology, it only shows detection performance of the existing intrusion status. therefore, countermeasures against targeted bypass rwjqthrwkemote attacks still have limitations with existing detection methods and threat hunting methods. in this paper, to overcome theses limitations, we propose a model that can detect the targeted circumvent connection remote attack threat of an organized hacking group. this model designed a threat hunting process model that applied the method of verifying the origin IP of the remote circumvent connection, and verified the effectiveness by implementing the proposed method in actual defense information system environment.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.34 no.3
• /
• pp.417-430
• /
• 2024

As modern technology advances and the proliferation of the internet continues, cyber threats are also on the rise. To effectively counter these threats, the importance of utilizing Cyber Threat Intelligence (CTI) is becoming increasingly prominent. CTI provides information on new threats based on data from past cyber incidents, but the complexity of data and changing attack patterns present significant analytical challenges. To address these issues, this study aims to utilize graph data that can comprehensively represent multidimensional relationships. Specifically, the study constructs a heterogeneous graph based on malware data, and uses the metapath2vec node embedding technique to more effectively identify cyber attack groups. By analyzing the impact of incorporating topology information into traditional malware data, this research suggests new practical applications in the field of cyber security and contributes to overcoming the limitations of CTI analysis.

• Review of KIISC
• /
• v.29 no.1
• /
• pp.13-19
• /
• 2019

나날이 발전하고 있는 ICT 기술과 차량과의 융합은 차량을 대상으로 하는 사이버 위협과 공격을 더욱 증대시킨다. 그러나 차량 보안을 연구하는 산업계, 학계 연구 그룹들 또한 다양한 접근 방법을 통해 이러한 위협과 공격을 앞서 예방하고 탐지하기 위해 노력하고 있다. 2018 정보보호 R&D 데이터 챌린지에서는 차량주행 데이터기반 도난탐지 트랙을 마련하였다. 이는 운전자별 주행 데이터에 대한 분석을 통해 현재 주행 중인 운전자를 식별하는 챌린지로써 국내 및 해외에서 처음으로 진행된 트랙이다. 이번 2018 정보보호 R&D 데이터 챌린지 중 차량주행 데이터기반 도난탐지 트랙에 참가한 참가자들은 주행 데이터를 통계적 기반으로 분석하여 모델링 하였으며, 분석하는 과정에 있어 의미 있는 분류 결과를 도출해 내었다. 일반적으로, 한 가정이 보유하고 있는 차량이 가족들 이외 다른 이들에게는 잘 공유되지 않는다는 점을 고려한다면, 비록 소수의 운전 참가자이지만 5명을 대상으로 하는 본 실험이 의미가 있다고 본다. 이번 정보보호 R&D 데이터 챌린지를 통해, 운전자 주행 데이터가 도난 탐지를 위한 운전자 분류뿐만 아니라, 운전자에게 특화된 의료와 보험과 같은 맞춤형 서비스를 제공할 수 있는 가능성을 확인할 수 있었다.

• Convergence Security Journal
• /
• v.23 no.4
• /
• pp.33-41
• /
• 2023

In recent years, advanced persistent threat (APT) attack organizations have exploited various vulnerabilities and attack techniques to target companies and institutions with national core technologies, distributing ransomware and demanding payment, stealing nationally important industrial secrets and distributing them on the black market (dark web), selling them to third countries, or using them to close the technology gap, requiring national-level security preparations. In this paper, we analyze the attack methods of attack organizations such as Kimsuky and Lazarus that caused industrial secrets leakage damage through APT attacks in Korea using the MITRE ATT&CK framework, and derive 26 cybersecurity-related administrative, physical, and technical security requirements that a company's security system should be equipped with. We also proposed a security framework and system configuration plan to utilize the security requirements in actual field. The security requirements presented in this paper provide practical methods and frameworks for security system developers and operators to utilize in security work to prevent leakage of corporate industrial secrets. In the future, it is necessary to analyze the advanced and intelligent attacks of various APT attack groups based on this paper and further research on related security measures.

• The Journal of the Korea Contents Association
• /
• v.19 no.9
• /
• pp.637-645
• /
• 2019

The RFID group proof is an extension of the yoking proof proving that multiple tags are scanned by a reader simultaneously. Existing group proof schemes provide only delayed tag loss detection which detects loss of tag response in a verification phase. However, delayed tag loss detection is not suitable for real-time applications where tag loss must be detected immediately. In this study, I propose a tag response loss detection scheme which detects loss of tag response in the proof generation process quickly. In the proposed scheme, the tag responds with the sequence number assigned to the tag group, and the reader detects the loss of the tag response through the sequence number. Through an experiment for indistinguishability, I show that the sequence number is secure against an analyzing message attack to distinguish between specific tags and tag groups. In terms of efficiency, the proposed scheme requires fewer transmissions and database operations than existing techniques to determine which tags response is lost.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.27 no.1
• /
• pp.87-96
• /
• 2023

As the number of security vulnerabilities increases yearly, security threats continue to occur, and the vulnerability risk is also important. We devise a security threat score calculation reflecting trends to determine the risk of security vulnerabilities. The three stages considered key elements such as attack type, supplier, vulnerability trend, and current attack methods and techniques. First, it reflects the results of checking the relevance of the attack type, supplier, and CVE. Secondly, it considers the characteristics of the topic group and CVE identified through the LDA algorithm by the Jaccard similarity technique. Third, the latest version of the MITER ATT&CK framework attack method, technology trend, and relevance between CVE are considered. We used the data within overseas sites provide reliable security information to review the usability of the proposed final formula CTRS. The scoring formula makes it possible to fast patch and respond to related information by identifying vulnerabilities with high relevance and risk only with some particular phrase.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2013.11a
• /
• pp.800-803
• /
• 2013

이메일을 기반으로 좀비PC 및 봇넷그룹을 탐지하는 알고리즘은 기존에 연구가 되었으나, 기존의 검증방식은 가상의 메일계정을 이용해 스팸메일을 수집하는 스팸트랩 시스템에서 추출한 이메일을 대상으로 하였다. 본 논문에서는 상용환경의 이메일을 대상으로 좀비PC를 탐지하고, 좀비PC를 이용한 추가 사이버 공격을 예방하기 위해 기존의 알고리즘을 보완하고, 이에 대한 좀비PC 탐지결과를 분석한다. 이를 통해, 주요 포탈 및 기업의 메일서버에서 수신하는 이메일을 대상으로 좀비IP를 탐지하여, 스팸메일을 차단하고 ISP와 연계하여 실제 조치를 유도할 수 있을 것으로 기대한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2009.04a
• /
• pp.1489-1492
• /
• 2009

현대 사회는 IT 기술의 발전과 인터넷 및 디바이스의 발전으로 인해 다양한 기술이 융합된 컨버전스 현상이 급진전되고 있으며, 방송과 통신의 융합 흐름은 더욱 가속화될 전망을 보이고 있으며, 특히 현재 제공되고 있는 IPTV(Internet Protocol Television) 서비스를 통해 빠른 성장세를 보이고 있다. 그러나 이와 같은 IPTV는 기존 IP 네트워크 기반으로 서비스를 제공하고 있으며, 이는 이전의 사이버공격 기술이 그대로 적용될 수 있는 문제점을 내포하고 있다. 따라서 본 연구에서는 IPTV 실시간 방송 서비스 환경에서 AAA 서버를 이용한 멀티캐스트 키 관리 기술을 제안하였다. 멀티캐스트 키 구조는 계층적 트리 방식을 적용하였으며, ID 기반 멀티캐스트 키 관리 기술을 제안하여 안전하고 효율적인 서비스를 제공할 수 있도록 하였다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.20 no.6
• /
• pp.237-249
• /
• 2010

If one analyzes recent cyber incidents including personal information infringement cases, it seems like actual attack is targeting Internet service providers but actually they are targeting Internet service users. For many users, all the services were not provided to them as they have signed for in the contract or personal informations, which users have provided to service providers when signing contracts, were disclosed to public without users' consent causing aftereffect. As a result, importance of S-SLA indexes, which is to be included in the SLA to be signed between a user and a service provider, is ever more increasing. Especially, if there is a S-SLA indexes for anti-virus services, service providers have to provide a high quality of service as they have signed in the SLA. However, there wasn't any researches in the S-SLA area domestically and there are only limited SLA indexes related to system or service maintenances at the moment. Therefore, this paper analyses security functions in anti-virus services and proposes S-SLA indexes for different security level.