• Proceedings of the Korean Information Science Society Conference
• /
• 2002.10e
• /
• pp.565-567
• /
• 2002

DDOS공격은 최근 인터넷 환경에서 큰 위험요소로 부각되고 있다. 하지만, DDOS공격을 완벽하게 막아내는 것은 현재까지 알려진 방법으로는 거의 불가능하다. 그 이유는DDOS 공격이 Vulnerability Exploit을 이용한 공격방법이 아니라 Network Resource를 고갈시켜서 공격대상 호스트의 서비스를 차단하기 때문이다. 그래서, DDOS공격을 방어하기 위해서는 DDOS공격 트래픽에 대한 정확한 분석과 탐지가 선행되어야 한다. 본 논문을 통해서 여러 가지 DDOS공격 Traffic의 특징을 살펴보고, Web traffic과의 차이를 통해 DDOS traffic을 탐지하는 방법을 제안하고자 한다.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.9 no.2
• /
• pp.91-96
• /
• 2009

The attacks of DDoS use the weakness of Internetworks which can send unlimited great data packets without identification of IP address. In this paper, we propose a solution method for DDoS attacks using CDN technology. The performance evaluation of the proposed solution method is performed via simulation.

• Journal of Internet of Things and Convergence
• /
• v.3 no.1
• /
• pp.9-11
• /
• 2017

Recently, with the widespread use of the Internet and mobile devices, the number of attacks by hackers using the network is increasing. When connecting a network, packets are exchanged and communicated, which includes various information. We analyze the information of these packets using hierarchical clustering analysis and classify normal and abnormal packets to detect attacks. With this analysis method, it will be possible to detect attacks by analyzing new packets.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.04a
• /
• pp.389-391
• /
• 2003

최근 인터넷 사용이 증가하고, 인터넷에 대한 접속이 손쉬워 지고, 인터넷 상에서 손쉽게 해킹 도구를 획득할 수 있게 됨에 따라서 네트워크 침해 사고가 급증하고 있다. 이런 상황에서 IDS(Intrusion Detection System)은 이러한 문제론 해결하기 위한 하나의 대안으로 제시되고, 실제 사용되고 있다. 그런데 침입 탐지시스템이 보고하는 공격은 실제 시스템이나 네트워크에 있어서 공격으로 처리되지 않아도 될 보고들이 존재하게 된다. 이를 줄여서 실제 관리자들이 더욱 정확한 침입에 대한 경고를 접하여 신속하게 대응할 수 있도록 할 수 있다. 이를 위해서 본 논문에서는 지역 망 내에 존재하는 대상 시스템들의 정보를 이용하도록 한다. 이를 이용하는 방법으로 호스트 취약점 분석 모듈을 이용하는 방법과 에이전트를 각 호스트에 설치하여 호스트의 정보를 수집하고, 이를 미리 정의된 패턴과 함께 침입 탐지 시스템의 공격 판단에 사용하는 방법을 제시한다. 이를 통해서 침입 판단의 정확도를 높이고 관리자의 업무 효율을 높이도록 한다.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2022.07a
• /
• pp.245-246
• /
• 2022

최근 IoT 환경에서 기계학습을 이용한 공격 탐지 모델의 연구가 활발히 진행되고 있으며, 탐지 정확도도 점차 향상되고 있다. 하지만, IoT 환경의 특징인 저 사양 하드웨어, 고차원의 특징, 방대한 트래픽 등으로 인해 탐지성능이 저하되는 문제가 있다. 따라서 본 논문에서는 MQTT(Message Queuing Telementry Transport) 프로토콜 기반의 IoT 환경에서 수집된 데이터셋을 대상으로 주성분 분석(Principal Component Analysis)과 LightGBM을 이용하여 데이터셋 차원을 감소시키고, 공격 클래스를 분류하였다. 실험결과 원본 데이터셋 차원을 주성분 3개(약 9%)로 감소시켰음에도 모든 특징(33개)을 사용한 실험결과와 거의 유사한 성능을 보였다. 또한 기존 연구의 특징 선택을 통한 탐지 모델과 비교하였을 때도 분류성능이 더 우수한 것으로 나타났다.

• Journal of Internet Computing and Services
• /
• v.21 no.2
• /
• pp.91-97
• /
• 2020

Recently, phishing attacks targeting those involved in defense, security and unification have been on the rise. In particular, hacking attack organization Kimsuky has been engaged in activities to collect important information from public organizations through phishing attacks since 2013. In this paper, profiling analysis of phishing mail attack organization was performed. Through this process, we estimated the purpose of the attack group and suggested countermeasures.

• Convergence Security Journal
• /
• v.23 no.2
• /
• pp.37-45
• /
• 2023

Cyber deception technology plays a crucial role in monitoring attacker activities and detecting new types of attacks. However, along with the advancements in deception technology, the development of Anti-honeypot technology has allowed attackers who recognize the deceptive environment to either cease their activities or exploit the environment in reverse. Currently, deception technology is unable to identify or respond to such situations. In this study, we propose a predictive model using Markov chain analysis to determine the identification of attackers who infiltrate deceptive environments. The proposed model for deception status determination is the first attempt of its kind and is expected to overcome the limitations of existing deception-based attacker analysis, which does not consider attackers who identify the deceptive environment. The classification model proposed in this study demonstrated a high accuracy rate of 97.5% in identifying and categorizing attackers operating in deceptive environments. By predicting the identification of an attacker's deceptive environment, it is anticipated that this model can provide refined data for numerous studies analyzing deceptive environment intrusions.

• Journal of the Korea Society for Simulation
• /
• v.19 no.4
• /
• pp.151-159
• /
• 2010

Currently, by using the Internet, We can do varius things such as Web surfing, email, on-line shopping, stock trading on your home or office. However, as being out of the concept of security from the beginning, it is the big social issues that malicious user intrudes into the system through the network, on purpose to steal personal information or to paralyze system. In addition, network intrusion by ordinary people using network attack tools is bringing about big worries, so that the need for effective and powerful intrusion detection system becomes very important issue in our Internet environment. However, it is very difficult to prevent this attack perfectly. In this paper we proposed the algorithm for the detection of DoS attacks, and developed attack detection tools. Through learning in a normal state on Step 1, we calculate thresholds, the number of packets that are coming to each port, the median and the average utilization of each port on Step 2. And we propose values to determine how to attack detection on Step 3. By programing proposed attack detection algorithm and by testing the results, we can see that the difference between the median of packet mounts for unit interval and the average utilization of each port number is effective in detecting attacks. Also, without the need to look into the network data, we can easily be implemented by only using the number of packets to detect attacks.

• Journal of Internet Computing and Services
• /
• v.10 no.3
• /
• pp.51-60
• /
• 2009

This paper proposes a reliable 2-mode authentication framework for probabilistic key pre-distribution in Wireless Sensor Network (WSN) that guarantees the safe defense against different kinds of attacks: Hello flood attacks, Wormhole attacks, Sinkhole attack, location deployment attacks, and Man in the middle attack. The mechanism storing the trust neighbor IDs reduces the dependence on the cluster head and as the result; it saves the power energy for the authentication process as well as provides peer-to-peer communication.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.29 no.5B
• /
• pp.491-497
• /
• 2004

In this Paper, we W a Hovel global traffic control architecture to isolate malicious network attacks and protect network infrastructure in Internet backbone networks. Unlike existing methods based on individual packets or flows, since the proposed detection and control methods are operated on the aggregate traffic level, the computational complexity can k significantly reduced, and they are applicable to develop a global defense architecture against network attack. Experimental results show that the proposed scheme can detect the network attack symptoms very exactly and quickly and protect the network resources as well as the normal traffic flows very efficiently.