• Electronics and Telecommunications Trends
• /
• v.22 no.1 s.103
• /
• pp.37-50
• /
• 2007

차세대 인터넷 표준인 IPv6가 제정되고 보급되기 시작하면서 IPv6에서의 보안이 중요한 이슈로 등장하고 있다. IPv6는 기존의 IPv4와 달리 IPsec을 기본적으로 지원하여 보안성이 강화될 것으로 예상하고 있으나 IPv6 환경으로의 전환, IPv6 프로토콜 스펙의 변경 등의 요인으로 인하여 보안에 대한 필요성이 증대되고 있다. 본 고에서는 IPv6환경의 보안위협 및 공격들을 분석하고 침입탐지/차단 기술의 관점에서 이러한 보안문제를 해결하기 위한 방법을 기술한다.

• Review of KIISC
• /
• v.22 no.7
• /
• pp.21-26
• /
• 2012

가상화 기술은 클라우드 컴퓨팅 환경에 있어서 주요 기술 가운데 하나이며, 최근 가상화 관련 연구가 활발히 이루어지고 있다. 특히 클라우드 컴퓨팅 환경 기반의 가상화 구현에 있어서 중요한 기술로는 하이퍼바이저가 있다. 또한 클라우드에서의 주요 이슈 중에 하나인 정보의 보호와 관련하여, 악의적인 공격을 탐지하고 대처할 수 있는 가상화 시스템의 분석에 대해 연구되고 있다. 본 논문에서는 클라우드 컴퓨팅 환경에서의 주요 기술과 대표적인 가상화 플랫폼에 대해 알아보며, 가상화 시스템에서의 네트워크 분석 기법과 관련된 동향을 통해 클라우드 컴퓨팅 환경에 있어 정보의 보호 측면에 대해 전반적으로 논의해 보도록 한다.

• Review of KIISC
• /
• v.27 no.6
• /
• pp.29-32
• /
• 2017

현대 사회에서 주요 사회적 이슈가 되는 CCTV, 네트워크 프린터, 스마트 가전기기 등 IoT 장비 해킹 사고의 발생 횟수 및 피해 규모는 지속적으로 증가하고 있다. 최근 침해사고 사례를 살펴보면, 엔드포인트에 해당하는 IoT 장비의 허술한 보안대책으로 인하여 악성코드 설치 및 실행을 탐지하지 못한 피해가 대부분이다. 이로 인해 IoT 장비에 대한 악성 프로세스 실행 제어 제품이 개발되어 도입되는 추세이지만, 아직까지 안전성 평가에 대한 연구가 부족한 실정이다. 따라서 본 논문에서는 IoT 장비에 대한 악성 프로세스 실행 제어 제품의 기본 보안요구사항을 식별하고, 필요한 시험항목과 시험 시 유의사항에 대해 제안한다.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2024.01a
• /
• pp.97-98
• /
• 2024

4차 산업 혁명의 시작으로 인공지능이 빠르게 발달함에 따라 현재 생성형 인공지능이 주목받고 있다. 이에 따라 딥보이스 기술과 딥페이크 기술을 활용하여 다양한 범죄가 발생하고 있어 관련 사례와 이를 해결하기 위해 진행 중인 연구에 대해서 조사하였다. 딥보이스와 딥페이크를 탐지하는 연구는 지속되고 있지만 관련 기술이 상용화되어 있지 않아 범죄를 예방하기에는 부족한 실정이다. 범죄에 악용되는 속도가 빨라지고 있는 만큼 더 많은 연구가 신속하게 이루어져야 한다.

• KIPS Transactions on Computer and Communication Systems
• /
• v.6 no.3
• /
• pp.135-142
• /
• 2017

DDoS (Distributed Denial of Service) exhausts the target server's resources using the large number of zombie pc, As a result normal users don't access to server. DDoS Attacks steadly increase by many attacker, and almost target of the attack is critical system such as IT Service Provider, Government Agency, Financial Institution. In this paper, We will introduce the CNN (Convolutional Neural Network) of deep learning based real-time detection system for DNS amplification Attack (DNS DDoS Attack). We use the dataset which is mixed with collected data in the real environment in order to overcome existing research limits that use only the data collected in the experiment environment. Also, we build a deep learning model based on Convolutional Neural Network (CNN) that is used in pattern recognition.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.2
• /
• pp.267-277
• /
• 2022

Due to the increasing proportion of cloud and remote working environments, various information security incidents are occurring. Insider threats have emerged as a major issue, with cases in which corporate insiders attempting to leak confidential data by accessing it remotely. In response, insider threat detection approaches based on machine learning have been developed. However, existing machine learning methods used to detect insider threats do not take biases and variances into account, which leads to limited performance. In this paper, boosting-type ensemble learning algorithms are applied to verify the performance of malicious insider detection, conduct a close analysis, and even consider the imbalance in datasets to determine the final result. Through experiments, we show that using ensemble learning achieves similar or higher accuracy to other existing malicious insider detection approaches while considering bias-variance tradeoff. The experimental results show that ensemble learning using bagging and boosting methods reached an accuracy of over 98%, which improves malicious insider detection performance by 5.62% compared to the average accuracy of single learning models used.

• Convergence Security Journal
• /
• v.22 no.3
• /
• pp.101-110
• /
• 2022

As the cases of using artificial intelligence in various fields increase, attempts to solve various issues through artificial intelligence in the intrusion detection field are also increasing. However, the black box basis, which cannot explain or trace the reasons for the predicted results through machine learning, presents difficulties for security professionals who must use it. To solve this problem, research on explainable AI(XAI), which helps interpret and understand decisions in machine learning, is increasing in various fields. Therefore, in this paper, we propose an explanatory AI to enhance the reliability of machine learning-based intrusion detection prediction results. First, the intrusion detection model is implemented through XGBoost, and the description of the model is implemented using SHAP. And it provides reliability for security experts to make decisions by comparing and analyzing the existing feature importance and the results using SHAP. For this experiment, PKDD2007 dataset was used, and the association between existing feature importance and SHAP Value was analyzed, and it was verified that SHAP-based explainable AI was valid to give security experts the reliability of the prediction results of intrusion detection models.

• Journal of the Korea Society for Simulation
• /
• v.19 no.4
• /
• pp.151-159
• /
• 2010

Currently, by using the Internet, We can do varius things such as Web surfing, email, on-line shopping, stock trading on your home or office. However, as being out of the concept of security from the beginning, it is the big social issues that malicious user intrudes into the system through the network, on purpose to steal personal information or to paralyze system. In addition, network intrusion by ordinary people using network attack tools is bringing about big worries, so that the need for effective and powerful intrusion detection system becomes very important issue in our Internet environment. However, it is very difficult to prevent this attack perfectly. In this paper we proposed the algorithm for the detection of DoS attacks, and developed attack detection tools. Through learning in a normal state on Step 1, we calculate thresholds, the number of packets that are coming to each port, the median and the average utilization of each port on Step 2. And we propose values to determine how to attack detection on Step 3. By programing proposed attack detection algorithm and by testing the results, we can see that the difference between the median of packet mounts for unit interval and the average utilization of each port number is effective in detecting attacks. Also, without the need to look into the network data, we can easily be implemented by only using the number of packets to detect attacks.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.10 no.4
• /
• pp.811-817
• /
• 2009

The rapid growth of network based IT systems has resulted in continuous research of security issues. Probe intrusion detection is an area of increasing concerns in the internet community. Recently, a number of probe intrusion detection schemes have been proposed based on various technologies. However, the techniques, which have been applied in many systems, are useful only for the existing patterns of probe intrusion. They can not detect new patterns of probe intrusion. Therefore, it is necessary to develop a new Probe Intrusion Detection technology that can find new patterns of probe intrusion. In this paper, we proposed a new network based probe intrusion detector(NePID) using anomaly traffic analysis and fuzzy cognitive maps that can detect intrusion by the denial of services attack detection method utilizing the packet analyses. The probe intrusion detection using fuzzy cognitive maps capture and analyze the packet information to detect syn flooding attack. Using the result of the analysis of decision module, which adopts the fuzzy cognitive maps, the decision module measures the degree of risk of denial of service attack and trains the response module to deal with attacks. For the performance evaluation, the "IDS Evaluation Data Set" created by MIT was used. From the simulation we obtained the max-average true positive rate of 97.094% and the max-average false negative rate of 2.936%. The true positive error rate of the NePID is similar to that of Bernhard's true positive error rate.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.3
• /
• pp.585-600
• /
• 2012

Security issues in online games are increasing as the online game industry grows. Real money trading (RMT) by online game users has become a security issue in several countries including Korea because RMT is related to criminal activities such as money laundering or tax evasion. RMT-related activities are done by professional work forces, namely gold-farmers, and many of them employ the automated program, bot, to gain cyber asset in a quick and efficient way. Online game companies try to prevent the activities of gold-farmers using game bots detection algorithm and block their accounts or IP addresses. However, game bot detection algorithm can detect a part of gold-farmer's network and IP address blocking also can be detoured easily by using the virtual private server or IP spoofing. In this paper, we propose a method to detect gold-farmer groups by analyzing their connection patterns to the online game servers, particularly information on their routing and source locations. We verified that the proposed method can reveal gold-farmers' group effectively by analyzing real data from the famous MMORPG.