• Journal of the military operations research society of Korea
• /
• v.33 no.2
• /
• pp.115-127
• /
• 2007

The army developed the ATCIS(Army Tactical Command Information System) for the battlefield information system with share the command control information through the realtime. The using the public key and the encryption equipment in the ATCIS is enough to the confidentiality, integrity. but, it is vulnerable about the availability with the zero day attack. In this paper, we implement the worm propagation simulation on the ATCIS infrastructure through the modelling on the ATCIS operation environment. We propose the countermeasures based on the results from the simulation.

• Journal of KIISE:Computing Practices and Letters
• /
• v.14 no.5
• /
• pp.517-521
• /
• 2008

A worm is a malware that propagates quickly from host to host without any human intervention. Need of early worm detection has changed research paradigm from signature based worm detection to the behavioral based detection. To increase effectiveness of proposed solution, in this paper we present mechanism of detection and prevention of worm in distributed fashion. Furthermore, to minimize the worm destruction; upon worm detection we propagate the possible attack aleγt to neighboring nodes in secure and organized manner. Considering worm behavior, our proposed mechanism detects worm cycles and infection chains to detect the sudden change in network performance. And our model neither needs to maintain a huge database of signatures nor needs to have too much computing power, that is why it is very light and simple. So, our proposed scheme is suitable for the ubiquitous environment. Simulation results illustrate better detection and prevention which leads to the reduction of infection rate.

• Journal of Korea Multimedia Society
• /
• v.9 no.3
• /
• pp.333-341
• /
• 2006

Recently, Random Constant worm is increasing The worm retards the availability of the overall network by exhausting resources such as CPU resource and network bandwidth, and damages to an uninfected system as well as an infected system. This paper analyzes the Power-Law network which possesses the preferential characteristics to restrain the worm from spreading. Moreover, this paper suggests the model which dynamically controls the spread of the worm using information about depth distribution of the delivery node which can be seen commonly in such network. It has also verified that the load for each node was minimized at the optimal depth to effectively restrain the spread of the worm by a simulation.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.17 no.1
• /
• pp.57-66
• /
• 2007

Scanning worms increase network traffic load because they randomly scan network addresses to find hosts that are susceptible to infection. Since propagation speed is faster than human reaction, scanning worms cause severe network congestion. So we need to build an early detection system which can automatically detect and quarantine such attacks. We propose algorithms to detect scanning worms using network traffic characteristics such as variance, variance to mean ratio(VMR) and correlation coefficient. The proposed algorithm have been verified by computer simulation. Compared to existing algorithm, the proposed algorithm not only reduced computational complexity but also improved detection accuracy.

• Journal of the Institute of Electronics Engineers of Korea CI
• /
• v.47 no.5
• /
• pp.67-74
• /
• 2010

Recently, the early detection and prevention of worm research is mainly studying based on the analysis of generalized worm propagation property. However, it is not easy to do Worm early detection with its attributes because the modeling method for Worm propagation is vague and not specified yet. Worm scanning method is exceedingly effect to Worm propagation process. This paper describes a modeling method and its simulations to estimate various worm growth patterns and their corresponding propagation algorithms. It also tests and varies the impact of various improvements, starting from a trivial simulation of worm propagation and the underlying network infrastructure. It attempts to determine the theoretical maximum propagation speed of worms and how it can be achieved. Moreover, we present the feasibility of the proposed model based on real testbed for verification.

• Journal of the Korea Society for Simulation
• /
• v.15 no.4
• /
• pp.1-10
• /
• 2006

Computer virus modeling and simulation research has conducted with focus on the network vulnerability analysis. But computer virus shows the biological virus characters such as proliferation, reproduction and evolution. Therefore it is necessary to research the computer virus modeling and simulation using the Artificial life technique. The approach of computer modeling and simulation using Artificial life provides the analysis method about the effects on the network by computer virus and the behavior mechanism of computer virus. Hence this paper proposes the methodology of computer virus modeling and simulation using Artificial life, which is effected to contribute the research on the computer virus vaccine.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.32 no.5B
• /
• pp.277-285
• /
• 2007

In this paper, we present a simulation model of Slammer worm propagation process which caused serious disruptions on Internet in the you of 2003 and analyze the process of Slammer by using NS-2. Recently introduced NS-2 modeling called "Detailed Network-Abstract Network Model" had enabled packet level analysis. However, it had deficiency of accommodating only small sized network. By extending the NS-2 DN-AN model to AN-AN model (Abstract Network-Abstract Network model), it is effectively simulated that the whole process from the initial infection to the total network congestion on hourly basis not only for the Korean network but also for the rest of the world networks. Furthermore, the progress of the propagation from Korean network to the other country was also simulated through the AN-AN model. 8,848 hosts in Korean network were infected in 290 second and 66,152 overseas hosts were infected in 308 second. Moreover, the scanning traffics of the worm at the Korean international gateway saturated the total bandwidth in 154 seconds for the inbound traffic and in 135 seconds for the outbound one.

• Journal of the Korea Institute of Military Science and Technology
• /
• v.11 no.1
• /
• pp.43-50
• /
• 2008

The army developed the ATCIS(Army Tactical Command Information System) for the battlefield information system with share the command control information through the realtime. The using the public key and the encryption equipment in the ATCIS is enough to the confidentiality, integrity. But, it is vulnerable about the availability with the zero day attack. In this paper, we implement the worm propagation simulation on the ATCIS infrastructure through the modelling on the ATCIS operation environment. We propose the countermeasures based on the results from the simulation.

• Proceedings of the Korea Society for Simulation Conference
• /
• 2004.05a
• /
• pp.13-19
• /
• 2004

본 논문은 SIMVA(Simulation Vulnerability Analyzer)를 이용한 시뮬레이션 기반의 네트워크 취약성 분석을 주목적으로 한다 SIMVA는 네트워크 상태를 감시하고, 이를 토대로 취약성을 분석하기 위하여 개발된 S/W로서, SES/MB (System Entity Structure / Model Base) 프레임워크 및 DEVS(Discrete Event System Specification) 이론을 적용하여 네트워크 보안 모델링을 수행할 수 있으며, 취약성 메트릭스를 통하여 정량적으로 취약성을 분석할 수 있다. 본 연구에서는 SIMVA를 이용하여 최근 네트워크 보안 문제에 심각한 영향을 미치는 슬래머 웜 공격 시나리오에 대한 취약성 분석을 수행함으로써 SIMVA의 검증 및 적용 가능성을 제시한다.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2003.12a
• /
• pp.132-136
• /
• 2003

최근 사이버 테러에 대한 관심이 고조되면서 사이버 테러 시뮬레이터가 필요하게 되었다. 사이버 테러 시뮬레이터는 침입 행위 및 방어 행위를 모델링하여 침입에 대한 피해 정도, 방어 대책의 효과성 등을 파악하기 위한 도구이다. 이 도구를 통해서 사이버테러에 대한 예방과 복구가 가능하기 때문이다. 이를 위해 기존의 시뮬레이터들은 시뮬레이션 수행 전에 모든 시나리오를 작성해 놓고 시뮬레이션을 수행하였다. 그러나 사람의 판단 및 행위를 모델링하지 못한 시뮬레이션은 정확한 결과를 나타내지 못하였다. 따라서 본 논문에서는 기존 사이버 테러 시뮬레이터에 동적 시뮬레이션 요소를 첨가함으로써 정확히 네트워크 침입 및 방어 행위를 표현하고자 하였다. 또한 이를 위한 시뮬레이터 구조 변경 방법을 제안하였다. 시뮬레이터를 구현한 후에는 슬래머 웜의 시뮬레이션 결과를 수행하여 기능이 올바로 구현되었음을 확인하였다.