• Proceedings of the Korea Information Processing Society Conference
• /
• 2024.05a
• /
• pp.846-849
• /
• 2024

다양한 분야에서 QR 코드가 급속도로 확산되면서, QR 코드를 악용하여 사용자를 악성 웹사이트로 리디렉션하는 '큐싱(Qshing)'이라는 새로운 형태의 사이버 범죄가 등장했다. 이에 본 연구에서는 일반화 성능을 향상시키기 위해 교차 검증(CV)을 활용하여 QR 코드 스캔과 관련된 악성 URL을 탐지하도록 설계된 스태킹 앙상블 모델을 제안한다. 이러한 통합은 실제 애플리케이션에서 높은 성능을 기대할 수 있도록 설계되었다. 본 연구는 이 모델이 기존의 연구보다 QR 코드 관련 사이버 위협에 대처하는 보다 효과적인 수단을 제공할 것으로 기대한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2024.05a
• /
• pp.327-328
• /
• 2024

본 논문에서는 DarkWebGuard라는 실시간 악성 URL 탐지 시스템을 소개하고, 그 개발에 사용된 도구와 알고리즘에 대해 논의합니다. DarkWebGuard는 머신러닝을 기반으로 하며, 인터넷 보안에 대한 현재의 요구를 충족시키기 위해 개발되었습니다. 이 시스템은 사용자와 시스템을 보호하기 위해 악성 URL을 실시간으로 탐지하고 분류합니다.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.20 no.7
• /
• pp.1290-1295
• /
• 2016

Recently, as mobile internet usage has been increasing rapidly, malware attacks through user's web browsers has been spreading in a way of social engineering or drive-by downloading. Existing defense mechanism against drive-by download attack mainly focused on final download sites and distribution paths. However, detection and prevention of injection sites to inject malicious code into the comprised websites have not been fully investigated. In this paper, for the purpose of improving defense mechanisms against these malware downloads attacks, we focus on detecting the injection site which is the key source of malware downloads spreading. As a result, in addition to the current URL blacklist techniques, we proposed the enhanced method which adds features of detecting the injection site to prevent the malware spreading. We empirically show that the proposed method can effectively minimize malware infections by blocking the source of the infection spreading, compared to other approaches of the URL blacklisting that directly uses the drive-by browser exploits.

• Smart Media Journal
• /
• v.13 no.6
• /
• pp.9-15
• /
• 2024

In recent trends, there has been an increase in 'Qshing' attacks, a hybrid form of phishing that exploits fake QR (Quick Response) codes impersonating government agencies to steal personal and financial information. Particularly, this attack method is characterized by its stealthiness, as victims can be redirected to phishing pages or led to download malicious software simply by scanning a QR code, making it difficult for them to realize they have been targeted. In this paper, we have developed a classification technique utilizing machine learning algorithms to identify the maliciousness of URLs embedded in QR codes, and we have explored ways to integrate this with existing QR code readers. To this end, we constructed a dataset from 128,587 malicious URLs and 428,102 benign URLs, extracting 35 different features such as protocol and parameters, and used AutoML to identify the optimal algorithm and hyperparameters, achieving an accuracy of approximately 87.37%. Following this, we designed the integration of the trained classification model with existing QR code readers to implement a service capable of countering Qshing attacks. In conclusion, our findings confirm that deriving an optimized algorithm for classifying malicious URLs in QR codes and integrating it with existing QR code readers presents a viable solution to combat Qshing attacks.

• Journal of the Korea Society of Computer and Information
• /
• v.27 no.5
• /
• pp.149-156
• /
• 2022

Recently, there have been many reports of document-type malicious code injecting malicious code into Microsoft Office files. Document-type malicious code is often hidden by encoding the malicious code in the document. Therefore, document-type malware can easily bypass anti-virus programs. We found that malicious code was inserted into the Visual Basic for Applications (VBA) macro, a function supported by Microsoft Office. Malicious codes such as shellcodes that run external programs and URL-related codes that download files from external URLs were identified. We selected 354 keywords repeatedly appearing in malicious Microsoft Office files and defined the number of times each keyword appears in the body of the document as a feature. We performed machine learning with SVM, naïve Bayes, logistic regression, and random forest algorithms. As a result, each algorithm showed accuracies of 0.994, 0.659, 0.995, and 0.998, respectively.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2014.07a
• /
• pp.365-367
• /
• 2014

최근 웹 서비스의 증가와 악성코드는 그 수를 판단 할 수 없을 정도로 빠르게 늘어나고 있다. 매년 늘어나는 악성코드는 금전적 이윤 추구가 악성코드의 주된 동기가 되고 있으며 이는 공공기관 및 보안 업체에서도 악성코드를 탐지하기 위한 연구가 활발히 진행되고 있다. 본 논문에서는 실시간으로 패킷을 분석할수 있는 필터링과 웹 크롤링을 통해 도메인 및 하위 URL까지 자동적으로 탐지할 수 있는 악성코드 탐지 시스템을 제안한다.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.38B no.6
• /
• pp.473-484
• /
• 2013

Shorten URL service is the method of using short URL instead of long URL, it redirect short url to long URL. While the users of microblog increased rapidly, as the creating and usage of shorten URL is convenient, shorten url became common under the limited length of writing on microblog. E-mail, SMS and books use shorten URL well, because of its simplicity. But, there is no relativeness between the most of shorten URLs and their target URLs, user can not expect the target URL. To cover this problem, there is attempts such as changing the shorten URL service name, inserting the information of website into shorten URL, and the usage of shortcode of physical address. However, each ones has the limits, so these are the trouble of automation, relatively long address, and the narrowness of applicable targets. SHRT is complementary to the attempts, as getting the idea from the writing system of Arabic. Though the writing system of Arabic has no vowel alphabet, Arabs have no difficult to understand their writing. This paper proposes SHRT, new method of URL Shortening. SHRT makes user guess the target URL using Relative word of the lowest domain of target URL without vowels.

• Review of KIISC
• /
• v.23 no.6
• /
• pp.13-20
• /
• 2013

전자금융서비스 활용이 급격히 증가함에 따라 (예) 인터넷 자동이체, 조회) 이를 악용한 범죄 역시 증가하고 있다. 특히, 금융서비스 제공자를 사칭한 문자 메시지나 이메일을 전송하여 실제와 유사한 허위 URL에 접속하도록 유도하는 파밍 공격이 이러한 범죄의 대표적인 예이다. 이에 따라 다양한 대응방안들이 등장했지만 이들은 공통된 취약점이 존재한다. 기존 사이트들의 적극적인 참여가 필요하며, IP주소의 위조에 취약하다는 것이다. 이와 같은 문제점을 해결하기 위해 본 논문은 인터넷 주소 등록기관을 통한 URL 검증 기법을 제안한다. 제안된 기법에서는 주어진 URL의 등록기관 및 국가를 검증하여 악성 사이트로 유도하는 URL을 탐지한다. 제시된 방법의 정확도를 평가하기 위해 인터넷 금융과 관련된 총 44개 URL의 등록기관 및 국가를 검증해 보았으며, 90%이상의 정상 사이트 및 80% 이상의 비정상 사이트를 정확히 판별해 낼 수 있음을 확인하였다.

• Convergence Security Journal
• /
• v.15 no.1
• /
• pp.3-9
• /
• 2015

In this paper, a detection technique of smishing using a TaintDroid is suggested. Suggesting system detects malicious acts by transmitting a URL to the TaintDroid server and installing a relevant application to a virtual device of the TaintDroid server, when a smartphone user receives a text message including the URL suspected as a smishing. Through this we want to distinguish an application that can not install because of suspicion of a smishing in an actual smartphone whether said application is malicious application or not by testing with the virtual device of said system. The detection technique of a smishing using the TaintDroid suggested in this paper is possible to detect in a new form a smishing with a text message and to identifying which application it is through analysis of results from a user.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.25 no.9
• /
• pp.1227-1233
• /
• 2021

QR Code has been used in various forms such as simple business cards and URLs. Recently, the influence of Corona 19 Fundemik has led to the use of QR Codes to track travel routes through visits and entry / exit records, and QR Code usage has skyrocketed. In this way, most people have come to use it in the masses and are constantly under threat. In the case of QR Code, you do not know what you are doing until you execute it. Therefore, if you undoubtedly execute a QR Code with a malicious URL inserted, you will be directly exposed to security threats. Therefore, this paper provides a cloud-based malware QR Code detection system that can make a normal connection only when there is no abnormality after determining whether it is a malicious QR Code when scanning the QR Code.