• Proceedings of the Korean Society of Computer Information Conference
• /
• 2015.07a
• /
• pp.63-66
• /
• 2015

본 논문에서는 미러링 환경에서 동작하는 악성링크 차단 및 URL 필터링 시스템에서 URL 접속을 차단할 수 있는 페이지 리다이렉션 기술을 소개한다. 미러링(Mirroring: Out of Path) 환경에서 URL 패킷을 차단하기 위해서 많이 사용하고 있는 방법으로는 RST (Reset) 패킷을 전송하여 세션을 종료하는 방법이다. 이 방법은 요청 서버에 RST(Reset) 패킷을 보내 강제로 종료하는 방식이기 때문에 사용자에게 접근 차단과 관련된 상태 등의 정보를 알려줄 수 없다. 현재 인라인(In-line) 방식에서 사용되고 있는 페이지 리다이렉션 기술을 미러링 환경에서 구현하여 사용자에게 차단 정보를 보여줄 수 있으며 다양한 장비 개발 환경에서 유용하게 사용할 수 있는 기술이라고 판단한다.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2002.11a
• /
• pp.31-34
• /
• 2002

인터넷 상에서 사이버 공격은 특정 서버에 대해 서비스 요청 패킷을 플러딩 시킴으로써 상용 서비스의 제공을 방해하는 패킷 형태의 공격과 특정 호스트에 연결 설정을 통해 침입함으로써 특정 정보의 획득이나 변경을 목적으로 하는 세션 설정 형태의 공격이 있다. 본 논문에서는 로컬 도메인 보호에 치우쳐 있는 현재의 네트워크 보안 메카니즘에 비해 공격자에 대해서 강력한 대응을 가능하게 하는 공격자의 공격 세션 추적 및 차단에 대한 액티브 네트워크 기반의 네트워크 보안 메카니즘에 대해 기술한다.

• Journal of the Institute of Electronics and Information Engineers
• /
• v.50 no.2
• /
• pp.152-160
• /
• 2013

This paper proposes a prediction reputation system for the anti-SPIT solution in real-time VoIP environment. The existing schemes need to get the user's feedback and/or have experienced the time delay and overload as session initiates due to real-time operation. To solve these problems, the proposed scheme predicts the reputation through the statistical analysis based on the period of session initiation of each caller and the call duration of each receiver. As per the second mentioned problem, this scheme performs the prediction before session initiation, therefore, it's proper for real-time VoIP environment.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2012.11a
• /
• pp.873-876
• /
• 2012

RFC 4271 에 규정되어 있는 BGP 는 대규모네트워크 망에서 효과적인 라우팅 정보전달을 위해 사용되어지는 프로토콜이다. 이러한 BGP 는 TCP Port 179 번을 사용함에 따라 TCP/IP 가 가지고 있는 보안위협에 노출되어 있다. BGP 보안 위협은 AS-PATH 공격, IP Hijacking 공격, BGP Neighbor 공격으로 라우터 자체의 보안설정으로 대부분 방어가 가능하나 BGP SYN Attack 에 대해서는 취약하다. BGP SYN Attack 은 호스트나 서버가 아닌 BGP 를 사용하는 라우터를 직접 공격하여 라우터의 TCP 나 BGP 관련 리소스를 고갈시켜 정상적인 기존 BGP 세션을 단절시키거나 새로운 BGP 세션 연결을 방해하여 결국 BGP 라우팅 정보를 교란하여 네트워크를 마비시킬 수 있다. 본 논문에서는 이러한 BGP SYN Attack 에 차단하기 위하여 이웃라우터간 안정적인 BGP 연결을 위해 설정한 BGP Neighbor Password 를 Key 로 활용한 개선된 BGP TCP 구조를 제안한다.

• Journal of the Korea Society of Computer and Information
• /
• v.17 no.10
• /
• pp.79-88
• /
• 2012

In this paper, we design a mutual authentication protocol which divided sessions from an authenticated session are updated periodically. And in order to minimize the traffic overhead for session authentication, we also introduce dynamic session management according to sampling rate of medical sensor type. And randomize the divided session time. This model has the effect of blocking the integrity and confidentiality intrusion of rogue gateway. Moreover, efficiency is provided through medical data to be transmitted have different sampling rate. In order to evaluate this model, it was embodied and experimented in TinyOS 2.1 environment. The result, we got an overall validity from three types of experiment.

• Journal of the Korea Society of Computer and Information
• /
• v.18 no.8
• /
• pp.95-104
• /
• 2013

DDoS attacks have became as a social threat since 2009 7.7 DDoS turmoil. Even though defence techniques have been developing to provide against those threats, they become much more sophisticate. In recent years, the attack form of DDoS is changing from high amount of traffic attack of network layers to highly sophisticate small amount of application layers. To make matters worse, attack agent for the attack has became very intelligent so that it is difficult to be blocked since it can't be distinguished from normal PCs. In the user authentication system(such as CAPTCHA) User intervention is required to distinguish normal PCs and intelligent attack agents and in particular, in a NAT environment, IP-based blocking method can be cut off the normal users traffic at the same time. This research examined defense techniques which are able to distinguish between agent and normal PC and effectively block ways the HTTP DDoS offense applying one-time session key based authentication method using Cookie which is used in HTTP protocol to protect web sever from sophisticate application layer of DDoS.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.19 no.7
• /
• pp.1568-1576
• /
• 2015

This paper proposes a prediction reputation system for the anti-SPIT solution in real-time VoIP environment. Increased accuracy of the determination as to whether spam or not by deriving a threshold based on SPIT presence in the existing paper. The existing schemes need to get the user's feedback and/or have experienced the time delay and overload as session initiates due to real-time operation. To solve these problems, the proposed scheme predicts the reputation through the statistical analysis based on the period of session initiation of each caller and the call duration of each receiver. As per the second mentioned problem, this scheme performs the prediction before session initiation, therefore, it's proper for real-time VoIP environment.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.17 no.10
• /
• pp.732-742
• /
• 2016

This study suggests methods of defense against low-level high-bandwidth DDoS attacks by adding a solution with a time limit factor (TLF) to an existing high-bandwidth DDoS defense system. Low-level DDoS attacks cause faults to the service requests of normal users by acting as a normal service connection and continuously positioning the connected session. Considering this, the proposed method makes it possible for users to show a down-related session by considering it as a low-level DDoS attack if the abnormal flow is detected after checking the amount of traffic. However, the service might be blocked when misjudging a low-level DDoS attack in the case of a communication fault resulting from a network fault, even with a normal connection status. Thus, we made it possible to reaccess the related information through a certain period of blocking instead of a drop through blacklist. In a test of the system, it was unable to block the session because it recognized sessions that are simply connected with a low-level DDoS attack as a normal communication.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.14 no.1
• /
• pp.219-236
• /
• 2014

In this paper, we propose a novel Proxy Mobile IPv6 network bandwidth-efficient handoff scheme. MN are classified into slow and fast one. At first MN should be registered in the microcell for bandwidth efficient handoff scheme. microcell is overlapped to handle the overflow session request which is nested. Overflow session request in macrocell requests to go back from the boundary of the microcell to new microcell. If idle session traffic is in a cell, it is requested by the target microcell. Analysis model was developed, an existing session of the session blocking probability and forcing termination probability of the session request have improved considerably. If the total traffic load of the system is not very large, the proposed scheme has the best bandwidth efficiency and provides better quality of service (QoS) to MN without costs of a lot of processing on the system.

• The Journal of the Korea Contents Association
• /
• v.11 no.2
• /
• pp.142-151
• /
• 2011

All medical information over sensor networks need to transmit and process securely in the u-Health services. The reliability of transmission between u-Health medical sensor devices and gateway is very important issue. When the user moves to other place with u-Health devices, its signal strength is going down and is far from the coverage of gateway. In this case, Malicious user can be carried out an intrusion under the situation. And also rogue gateway can be tried to steal medical information. Therefore, it needs mutual authentication between sensor devices and gateway. In this paper, we design a mutual authentication protocol which divided sessions from an authenticated session are updated periodically. And in order to reduce the traffic overhead for session authentication, we also introduce dynamic session management according to sampling rate of medical sensor type. In order to verify this, we implemented the programs for the test-bed, and got an overall success from three types of experiment.