• Convergence Security Journal
• /
• v.11 no.6
• /
• pp.67-72
• /
• 2011

A system that provides a ubiquitous service is a networked system that has to overcome their circumstances that the service survivability is weak. the survivability of a networked system is defined as an ability of the system that can offer their services without interruption, regardless of whether components comprising the system are under failures, crashes, or physical attacks. This paper presents an approach that end users can obtain a quantitative evaluation of U-service survivability to reflect intended cyber attacks causing the networked system to fall into byzantine failures in addition to the definition of the survivability. In this paper, a Jini system based on wireless local area networks is used as an example for quantitative evaluation of U-service survivability. This paper also presents an continuous time markov chain (CTMC) Model for evaluation of survivability of U-service that a Jini system provides, and an approach to evaluate the survivability of the U-service as a blocking probability that end users can not access U-services.

• Journal of the Institute of Electronics and Information Engineers
• /
• v.51 no.10
• /
• pp.137-144
• /
• 2014

The Electronic Support System collects and analyzes the received radar signals in order to cope with the electronic attack in real-time. The radar-pulse clustering system classifies the radar signals that are considered to be emitted by a single source. This paper proposed a radar-pulse clustering algorithm based on four kinds of features: the direction, frequency, pulse width, and the difference of arrival time between two successive pulses. The experiment results show that the proposing algorithm could trace the moving emitter and classify the timely separated signals into different classes.

• Proceedings of the Korean Information Science Society Conference
• /
• 2006.10d
• /
• pp.539-542
• /
• 2006

본 논문은 IPv6 환경에서 보다 안전한 DNS 구성에 대해 제안한다. DNS 서버는 도메인 네임을 해당하는 IP 주소로 맵핑하여 주는 시스템으로 IPv6 환경에서는 늘어나는 IP 주소의 길이로 인해 직접적인 사용이 힘들고, 현재 거의 모든 인터넷 응용 서비스들이 DNS를 이용하고 있다는 점에서 앞으로 그 중요성은 더욱 높아질 전망이다. 현재 사용되고 있는 DNS 서버의 구성은 1차, 2차 서버를 통해 1차 서버의 장애 발생 시 그 역할을 2차 DNS가 수행하는 방식이다. 그러나 이는 DNS 서버가 속해 있는 네트워크를 대상으로 하는 공격이나 장애에 대응하기 어렵고, DNS 서버의 이용자 또한 서비스의 연속성을 보장받기 어렵다. 이를 해결하기 위해 본 논문은 Anycast 전송 기술을 DNS 서버에 적용하여 재구성함으로써 장애 발생 시에도 안정적으로 도메인 네임 서비스를 사용자에게 제공할 수 있는 방안을 제시하였다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.16 no.6
• /
• pp.81-93
• /
• 2006

A file system is an evidence resource of cyber crime in computer forensics. Therefore the methods of recovering the file system and searching important information have been offered. However, the methods for finding a malicious fie in free blocks or slack spaces have not been suggested. In this paper, we propose an investigation method to find a maliciously executable fragmented file. After estimating if a file is executable with a machine code rate, we conclude it could be malicious by comparing a similarity of instruction sequences. To examine instruction sequences, we also propose a method of profiling malicious files using file and a method of comparing the continued scores. As the results, we could exactly pick out the malicious execution files, such as buffer overflow attack program, at fitting threshold level.

• Journal of Internet Computing and Services
• /
• v.22 no.2
• /
• pp.29-39
• /
• 2021

As damages to individuals, private sectors, and businesses increase due to newly occurring cyber attacks, the underlying network security problem has emerged as a major problem in computer systems. Therefore, NIDS using machine learning and deep learning is being studied to improve the limitations that occur in the existing Network Intrusion Detection System. In this study, a deep learning-based NIDS model study is conducted using the Convolution Neural Network (CNN) algorithm. For the image classification-based CNN algorithm learning, a discrete algorithm for continuity variables was added in the preprocessing stage used previously, and the predicted variables were expressed in a linear relationship and converted into easy-to-interpret data. Finally, the network packet processed through the above process is mapped to a square matrix structure and converted into a pixel image. For the performance evaluation of the proposed model, NSL-KDD, a representative network packet data, was used, and accuracy, precision, recall, and f1-score were used as performance indicators. As a result of the experiment, the proposed model showed the highest performance with an accuracy of 85%, and the harmonic mean (F1-Score) of the R2L class with a small number of training samples was 71%, showing very good performance compared to other models.

• The KIPS Transactions:PartC
• /
• v.16C no.2
• /
• pp.151-164
• /
• 2009

The importance of sensor networks as a base of ubiquitous computing realization is being highlighted, and espicially the security is recognized as an important research isuue, because of their characteristics.Several efforts are underway to provide security services in sensor networks, but most of them are preventive approaches based on cryptography. However, sensor nodes are extremely vulnerable to capture or key compromise. To ensure the security of the network, it is critical to develop security Intrusion Detection System (IDS) that can survive malicious attacks from "insiders" who have access to keying materials or the full control of some nodes, taking their charateristics into consideration. In this perper, we design a distributed and adaptive IDS architecture on sensor networks, respecting both of energy efficiency and IDS efficiency. Utilizing a modified HEED algorithm, a clustering algorithm, distributed IDS nodes (dIDS) are selected according to node's residual energy and degree. Then the monitoring results of dIDSswith detection codes are transferred to dIDSs in next round, in order to perform consecutive and integrated IDS process and urgent report are sent through high priority messages. With the simulation we show that the superiorities of our architecture in the the efficiency, overhead, and detection capability view, in comparison with a recent existent research, adaptive IDS.

• Journal of Digital Convergence
• /
• v.10 no.2
• /
• pp.141-146
• /
• 2012

U-healthcare, which grafted advanced IT technology onto medical technology, is in the limelight because it can provide medical services at anytime and anywhere. U-healthcare system applied RFID technology for Implantable Medical Device (IMD), but patient's biometric information can be easily exposed to third parties. In this article, RFID-based U-healthcare authentication protocol is proposed to prevent illegal usage for personal biometric information exposed to the third patty. The proposed protocol guarantees patients' biometric information integrity as compounding random numbers between administrators and hospital/clinic managers, and uses continuous number SEQ and time stamp T to synchronize IMD/administrators and administrators/hospital managers. Also, to protect user's privacy from the third party, patients' biometric information can be safely guarded by managing patients' security identifiers by administrators.

• Korean Security Journal
• /
• no.37
• /
• pp.325-354
• /
• 2013

The concept of national security and the fundamental system for crisis management have departed from traditional methods and the importance of a national critical infrastructure crisis management has been emphasized. A national critical infrastructure crisis means a situation where human resource, material and functional system that may have a material effect on the critical functions of the government, the vitality and integrity of society, national economy and the safety of the public becomes disabled due to causes such as terrorism or major disasters. Although North Korea had been subject to numerous rounds of negotiations and sanctions as it continually developed nuclear weapons since the 1960s, it has also showed off its nuclear armaments through successful nuclear testings and missile launches. As the development and threat of North Korea's weapons of mass destruction becomes more noticeable and the range of its risk expands, this study focuses on the potential for an absence of leadership for national crisis management where the country's leadership, which should serve the critical role and function of handling national crises, becomes completely destroyed by the unexpected initial attacks by North Korea. As a result, the purpose of this study is to propose safety measures for the country's leadership in preparation for North Korea's threat of nuclear weapons by examining the concept and degree of risk of weapons of mass destruction with a focus on nuclear weapons, analyzing the substance of the threat of North Korean nuclear weapons and evaluating such threat. In conclusion, first, to ensure the normal functioning of a national crisis management system in the event of a national crisis, we must seek safety measures that conform to the scope and succession order of the leadership of the national crisis management for an Enduring Constitutional Government (ECG) and the Continuity Of Operations (COOP). Second, in the event of a national ceremony, the gathering of the country's leadership all together in an open place should be avoided. In unavoidable circumstances, the next in rank that will act on behalf of the current leader should be designated and relevant safety measures should be taken. Third, during time of peace, in preparation for national crises, the scope of protection for the country's leadership should be prescribed and specific security and safety measures should be implemented. Fourth, the succession order for acting president in the case of the death of the president pursuant to Articles 71 and 26(1) of the National Government Organization Act should reconsidered to see whether it is a reasonable provision that takes into consideration a national crisis management that corresponds to the threat of North Korean nuclear weapons and weapons of mass destruction. Pursuant to the Basic Guidelines for National Crisis Management set out under Presidential Directive No. 229, the Korean government is currently operating a case-by-case "crisis management standard manual" and its sub-manuals and has also prepared the Presidential Security Service's security and safety measure regulations regarding the acting president. Therefore, the Korean government should actualize the above points in the case-by-case crisis management standard manual and security and safety measure regulations regarding the acting president to implement and legislate them.