• Proceedings of the Korea Information Processing Society Conference
• /
• 2005.11a
• /
• pp.1071-1074
• /
• 2005

본 논문에서는 침입탐지 도구에서 침입에 대한 대응을 능동적으로 할 수 있도록 하기 위한 공격대응 방법론을 연구하였다. 공격 대응 방법론을 도출하기 위해, NIDS에서 대표적인 공격 유형인 삽입공격, 회피공격, 서비스거부공격의 위험성을 분석하였고, 의심되는 공격에 대해 적절한 행동을 적용하기 위한 공격대응 형태와 공격 대응 방법론 및 공격 대응 상태를 연구하였다.

• The KIPS Transactions:PartC
• /
• v.12C no.1 s.97
• /
• pp.45-52
• /
• 2005

A damage scale of information property has been increasing rapidly by various illegal actions of information systems, which result from dysfunction of a knowledge society. Reinforcement in criminal investigation requests of network security has accelerated research and development of Intrusion Detection Systems(IDSs), which report intrusion-detection about these illegal actions. Due to limited designs of early IDSs, it is hard for the IDSs to cope with tricks to go around IDS as well as false-positive and false-negative trials in various network environments. In this paper, we showed that this kind of problems can be solved by using a Virtual Protocol Stack(VPS) that possesses automatic learning ability through an optimum-adaptive mobile code. Therefore, the enhanced IDS adapts dynamically to various network environments in consideration of monitored and self-learned network status. Moreover, it is shown that Insertion/Evasion attacks can be actively detected. Finally, we discussed that this method can be expanded to an intrusion detection technique that possesses adaptability in the various mixed network environments.