• Korea Information Processing Society Review
• /
• v.10 no.2
• /
• pp.27-37
• /
• 2003

• Communications of the Korean Institute of Information Scientists and Engineers
• /
• v.20 no.11
• /
• pp.10-16
• /
• 2002

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.32 no.1C
• /
• pp.67-77
• /
• 2007

Virus throttling technique, one of many early worm detection techniques, detects Internet worm propagation by limiting connect requests within a certain ratio. The typical virus throttling controls the period of rate limiter autonomically by utilizing weighted average delay queue length to reduce connection delay time without hanving a large effect on worm detection time. In the existing virus throttling research, a minimum period of variable rate limiter is fired and a turning point which is a point that the period of rate limiter has been being decreased and starts to be increased is also fixed. However, these two performance factors have different effects on worm detection time and connection delay. In this paper, we analyze the effect of minimum period and turning point of variable rate limiter, and then propose an algorithm which determines values of performance factors by referencing current traffic pattern. Through deep experiments, it is verified that the proposed technique is more efficient in respect of reducing worm detection time and connection delay than the existing virus throttling which fixed the performance factors.

• Review of KIISC
• /
• v.16 no.2
• /
• pp.71-78
• /
• 2006

인터넷 주소 고갈 문제를 해결하고 QoS를 효과적으로 제공하기 위하여 IPv6가 개발되었다. IPv6는 IPSec이라는 자체의 보안 요소를 탑재하고 있기 때문에 보안의 중요성이 강조되는 유비쿼터스 사회에서 기존의 IPv4가 가지고 있든 문제점을 해결할 수 있을 것으로 기대한다. 그러나 IPv6의 도입에 따른 IPv4/IPv6 전환 시 보안 문제와 IPv6 자체의 보안 특성 등에 대하여 분석할 필요가 있다. 본고에서는 IPv6 환경에서 침입탐지 및 웜의 전파 특성에 대하여 기술하고자 한다.

• The KIPS Transactions:PartC
• /
• v.11C no.7 s.96
• /
• pp.993-998
• /
• 2004

As Worm Virus & DDoS attack appeares, the targets and damage of infringement accidents are extending from specific system or services to paralysis of the network itself. These attacks are expending very frequently and strongly, and ISP who will be used as the path of these attacks will face serious damages. But compare to Worm Virus & DDoS attack that generally occures in many Systems at one time with it's fast propagation velocity, network dimensional opposition is slow and disable to deal with the whole appearance for it is operated manually by the network manager. Therefore, this treatise present devices how to detect Worm Virus & DDoS attack's outbreak and the attacker(attacker IP adderss) automatically.

• The Magazine of the IEIE
• /
• v.31 no.8
• /
• pp.52-60
• /
• 2004

최근 인터넷 사용의 급증으로 인터넷 가입자 수가 폭발적으로 증가하고 있으며, 온라인 거래와 다양한 인터넷 서비스 제공 등으로 인하여 고속 네트워크 트래픽 양의 증가가 현저해지고 있다. 이러한 변화로 인하여 네트워크 사용자들은 예전보다 훨씬 많은 양의 정보를 고속 네트워크인프라를 통하여 쉽게 주고받을 수 있다. 이러한 편리함의 역기능으로 바이러스, 웜 및 해킹과 같은 사이버 테러를 말할 수 있으며, 이로 인하여 개인의 사생활 정보 유출은 물론 국가 안보까지 위협받는 상황에 이르렀다.(중략)

• 정보보호뉴스
• /
• s.136
• /
• pp.52-55
• /
• 2009

KISA 인터넷침해사고대응지원센터가 지난 1월 '2008년 침해사고 동향 및 2009년 전망'을 발표했다. 침해사고 동향을 분석하고 향후 등장할 위협을 예측하는 이 보고서는 국내외 정보보호 분야의 기술 지형을 한눈에 보여준다는 점에서 큰 의미를 지니고 있다. 웜 바이러스와 악성 봇 분야의 주요내용을 중심으로 2008년 침해사고 동향과 2009년을 전망해 본다.

• Journal of KIISE:Information Networking
• /
• v.36 no.2
• /
• pp.69-79
• /
• 2009

Today's Internet is one of the necessaries of our life. Anomalies of the Internet provoke social problems. For that reason, Internet Measurement which studies characteristics on Internet traffic attracts pubic attention. Recently, Traffic Dispersion Graph (TDG), a novel traffic analysis method, was proposed. The TDG is not a statistical analysis method but a graphical visualization method on interactions among network components. In this paper, we propose a new anomaly detection paradigm and its technique using TDG. The existing studies have focused on detecting anomalous packets of flows. On the other hand, we focus on detecting the sources of anomalous traffic. To realize our paradigm, we designed the TDG Clustering method. Through this method, we could classify anomalous hosts infected by various worm viruses. We obtained normal traffic through dropping traffic of the anomalous hosts. Especially, we expect that the TDG clustering method can be applied to real-time anomaly detection because calculations of the method are fast.

• Journal of the Korea Society of Computer and Information
• /
• v.11 no.6 s.44
• /
• pp.185-192
• /
• 2006

By mistaking normal packets for harmful traffic, it may not offer service according to the intention of attacker with harmful traffic, because it is not easy to classify network traffic for normal service and it for DUoS(Distributed DoS) attack like the Internet worm. And in the IPv6 environment these researches on harmful traffic are weak. In this dissertation, hosts in the IPv6 environment are attacked by NETWIB and their attack traffic is monitored, then the statistical information of the traffic is obtained from MIB(Management Information Base) objects used in the IPv6. By adapting the ESM(Exponential Smoothing Method) to this information, a normal traffic boundary, i.e., a threshold is determined. Input traffic over the threshold is thought of as attack traffic.

• The Journal of the Korea Contents Association
• /
• v.5 no.5
• /
• pp.172-181
• /
• 2005

The latest attack type against network traffic appeared by worm and bot that are advanced in DDoS. It is difficult to detect them because they are diversified, intelligent, concealed and automated. The exisiting traffic analysis method using SNMP has a vulnerable problem; it considers normal P2P and other application program to be harmful traffic. It also has limitation that does not analyze advanced programs such as worm and bot to harmful traffic. Therefore, we analyzed harmful traffic out Protocol and Port analysis. We also classified traffic by protocol, well-known port, P2P port, existing attack port, and specification port, apply singularity weight to detect, and analyze attack availability. As a result of simulation, it is proved that it can effectively detect P2P application, worm, bot, and DDoS attack.