• Proceedings of the Korean Society of Computer Information Conference
• /
• 2023.07a
• /
• pp.195-196
• /
• 2023

코로나19로 인한 비대면 사회의 발전으로 일반인들의 IT이용이 증가하였고, 우크라이나 전쟁이 장기화됨에 따라 주요 기반시설 및 글로벌 기업을 대상으로 대규모 사이버 공격 시도가 증가할 것으로 전망된다. 사이버 공격에는 대부분 악성코드가 활용이 된다. 본 논문에서는 2022년 및 2023년 1분기 중 사이버공격에 많이 활용된 악성코드들의 특징과 동향을 파악한다.

• Review of KIISC
• /
• v.19 no.6
• /
• pp.22-31
• /
• 2009

최근의 컴퓨터 통신 기술은 인터넷 기반으로 이루어지고 있으며 정치 경제 문화 등 사회 전 분야에 있어서 주요 기반 인프라를 구축하는데 없어서는 안 되는 핵심 요소 기술로 자리 잡았다. 이러한 인터넷상에서 기존의 악성코드와는 차별화되는 외부 공격자의 명령 제어를 받는 악성 네트워크인 봇넷이 인터넷 서비스의 보안 위협으로 등장하게 되었다. 최근의 봇넷은 매우 빠르게 진화하고 있으며 봇넷을 이용한 스팸 메일, 개인 정보 탈취, 금품 갈취형 분산 서비스 거부 공격 등은 사이버상의 공격을 주도하는 주요 이슈로 부상하였다. 본 연구에서는 이러한 봇넷의 악성 행위 동향과 함께 이에 대응할 수 있는 기술에 대해서 방향을 제시하고자 한다.

• Convergence Security Journal
• /
• v.18 no.3
• /
• pp.27-35
• /
• 2018

The certificate is electronic information issued by an accredited certification body to certify an individual or to prevent forgery and alteration between communications. Certified certificates are stored in PCs and smart phones in the form of encrypted files and are used to prove individuals when using Internet banking and smart banking services. Among the rapidly growing Android-based malicious applications are malicious apps that leak personal information, especially certificates that exist in the form of files. This paper proposes a method for judging whether malicious codes leak certificates by using DroidBox, an Android-based dynamic analysis tool.

• Journal of Platform Technology
• /
• v.9 no.3
• /
• pp.3-17
• /
• 2021

Advanced persistent threat (APT) attacks are attacks aimed at a particular entity as a set of latent and persistent computer hacking processes. These APT attacks are usually carried out through various methods, including spam mail and disguised banner advertising. The same name is also used for files, since most of them are distributed via spam mail disguised as invoices, shipment documents, and purchase orders. In addition, such Infostealer attacks were the most frequently discovered malicious code in the first week of February 2021. CDR is a 'Content Disarm & Reconstruction' technology that can prevent the risk of malware infection by removing potential security threats from files and recombining them into safe files. Gartner, a global IT advisory organization, recommends CDR as a solution to attacks in the form of attachments. There is a program using CDR techniques released as open source is called 'Dangerzone'. The program supports the extension of most document files, but does not support the extension of HWP files that are widely used in Korea. In addition, Gmail blocks malicious URLs first, but it does not block malicious URLs in mail systems such as Naver and Daum, so malicious URLs can be easily distributed. Based on this problem, we developed a 'Dangerzone' program that supports the HWP extension to prevent APT attacks, and a Chrome extension that performs URL checking in Naver and Daum mail and blocking banner ads.

• Journal of Internet Computing and Services
• /
• v.22 no.3
• /
• pp.27-35
• /
• 2021

With the development of the Internet, various IT technologies such as IoT, Cloud, etc. have been developed, and various systems have been built in countries and companies. Because these systems generate and share vast amounts of data, they needed a variety of systems that could detect threats to protect the critical data contained in the system, which has been actively studied to date. Typical techniques include anomaly detection and misuse detection, and these techniques detect threats that are known or exhibit behavior different from normal. However, as IT technology advances, so do technologies that threaten systems, and these methods of detection. Advanced Persistent Threat (APT) attacks national or companies systems to steal important information and perform attacks such as system down. These threats apply previously unknown malware and attack technologies. Therefore, in this paper, we propose a hybrid intrusion detection system that combines anomaly detection and misuse detection to detect unknown threats. Two detection techniques have been applied to enable the detection of known and unknown threats, and by applying machine learning, more accurate threat detection is possible. In misuse detection, we applied Classification based on Association Rule(CBA) to generate rules for known threats, and in anomaly detection, we used One-Class SVM(OCSVM) to detect unknown threats. Experiments show that unknown threat detection accuracy is about 94%, and we confirm that unknown threats can be detected.