• Proceedings of the Korea Information Processing Society Conference
• /
• 2014.04a
• /
• pp.424-425
• /
• 2014

2014년 가트너에서 조사된 통계 자료에 의하면 스마트폰 사용자 4명중 3명은 안드로이드인 것으로 나타났다. 즉, 안드로이드에서 취약점이 발생할 경우 다른 스마트폰 OS에서 취약점이 발생할 때보다 3배 이상의 피해가 예상된다고 할 수 있다. 따라서 안드로이드 환경에서 앱에 대한 취약점을 찾고 조치를 취해야하는 작업이 지속되어야 한다. 그러나 취약점을 찾고 조치를 취하기 위해 분석가는 많은 시간을 소모하는데 비해 앱의 증가 속도는 매우 빨라 취약점 점검을 위한 자동화 도구는 필수적일 수밖에 없다. 이에 본 연구는 안드로이드 환경에서 작동하는 앱을 대상으로 취약점 점검을 수행하는 도구를 개발하고 연구하였다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.5
• /
• pp.1167-1177
• /
• 2019

In this paper, the improved security operation model based on the vulnerability database is studied. The proposed model consists of information protection equipment, vulnerability database, and a dashboard that visualizes and provides the results of interworking with detected logs. The evaluation of the model is analyzed by setting up a simulated attack scenario in a virtual infrastructure. In contrast to the traditional method, it is possible to respond quickly to threats of attacks specific to the security vulnerabilities that the asset has, and to find redundancy between detection rules with a secure agent, thereby creating an optimal detection rule.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.13 no.5
• /
• pp.69-79
• /
• 2003

We analyze key business process by using IDEF method in the perspective of business continuity, identify key information assets by using Skandia model, and use Nessus Version 1.4.2 to assess vulnerability about the sever of library information system according to OCTAVE(The Operationally Critical Threat, Asset, and Vulnerability Evaluation) approach. We suggest the vulnerability assessment case for introducing improved OCTAVE method including IDEF method and Skandia model.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2008.11a
• /
• pp.1024-1027
• /
• 2008

RFID는 자동 객체 식별 기술로써 유비쿼터스 환경과의 연결을 통해서 적용 범위가 더욱 확대되고 있다. 그러나 RFID 시스템은 전파를 이용하는 통신 구조와 낮은 태그 가격 제약으로 인해서 사용자의 프라이버시 문제와 악의적인 공격노출 등의 위험이 발생하고 있다. 이런 문제점들을 해결하기 위해 물리적인 방법과 암호학적인 접근 방법 등 많은 방법들이 제안되었다. 그 중에서 해시 체인 기법은 다른 방법과 비교하여 강력한 보안 수준을 제공하면서도 간단한 인증 과정이 장점이다. 그러나 재전송 공격과 스푸핑 공격에 취약한 문제점을 가지고 있다. 따라서 본 논문은 기존 해시 체인의 장점을 유지하면서 보안 취약성을 개선한 RFID 인증 프로토콜을 제안한다. 계산 효율성을 고려하여 최소한의 난수와 비트 연산(XOR)을 이용하여 보안 취약성을 개선한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.34 no.4
• /
• pp.667-680
• /
• 2024

If the software is not updated after the vulnerability is disclosed, it can continue to be attacked. As a result, the importance of N-day detection is increasing as attacks that exploit vulnerabilities increase. However, there is a problem that it is difficult to find specific version information in the published vulnerability database, or that the wrong version or software is outputted. There is also a limitation in that the connection between the published vulnerability databases is not good. In order to overcome these limitations, this paper proposes a method of building information including comprehensive vulnerability information such as CVE, CPE, and Exploit Database into an integrated database. Furthermore, by developing a website for searching for vulnerabilities based on an integrated database built as a result of this study, it is effective in detecting and utilizing vulnerabilities in specific software versions and Windows operating systems.

• Journal of the Society of Disaster Information
• /
• v.15 no.4
• /
• pp.626-633
• /
• 2019

Purpose: The primery objecting of this paper is to explore the seismics fragility of curved bridge based on the change of girder section. Method: The cross section of the bridge structure was constructed with I, T, and Box shapes and then, in order to perform the seismic fragility 24 seismic ground motions were used, including Gyeongju Pohang Earthquake. Result: Fist, T-Shape of the bridge strucrue was much fragility in terms of the stress on girder section, in comparison to the other shapes. The seismic fragilies of the structures with respect to displacement(drift ratio), however, were shown simialr. Conclusion: In other to wvaluation the seismic fragility of curved structure using different girder shapes, analytical models of the structure were constructed and then, the probability failure of box-shape girder was shown lower probability. In further, Parametric studies of curved structures must be conducted.

• KIPS Transactions on Software and Data Engineering
• /
• v.5 no.3
• /
• pp.139-144
• /
• 2016

When, Software is developed, Applying development methods considering security, it is generated the problem of additional cost. These additional costs are caused not consider security in many developing organization. Even though, proceeding the developments, considering security, lack of ways to get the cost of handling the vulnerability throughput within the given cost. In this paper, propose a method for calculating the vulnerability throughput for using a security vulnerability processed cost-effectively. In the proposed method focuses on the implementation phase of the software development phase, leveraging static analysis tools to find security vulnerabilities in CWE TOP25. The found vulnerabilities are define risk, transaction costs, risk costs and defines the processing priority. utilizing the information in the CWE, Calculating a consumed cost in a detected vulnerability processed through a defined priority, and controls the vulnerability throughput in the input cost. When applying the method, it is expected to handle the maximum risk of vulnerability in the input cost.

• Journal of the Korea Society of Computer and Information
• /
• v.17 no.2
• /
• pp.127-137
• /
• 2012

Recently, as modern Internet uses mashups, Web 3.0, JavaScript/AJAX widely, the rate at which new vulnerabilities are being discovered is increasing rapidly. It can subsequently introduce big security threats. In order to efficiently mitigate these web application vulnerabilities and security threats, it is needed to rank vulnerabilities based on severity and consider the severe vulnerabilities during a specific phase of software development lifecycle (SDLC) for web applications. In this paper, we have first verified whether the risk rating methodology of OWASP Top 10 vulnerabilities is a reasonable one or not by analyzing the vulnerability data of web applications in the US National Vulnerability Database (NVD). Then, by inspecting the vulnerability information of web applications based on OWASP Top-10 2010 list and CWE (Common Weakness Enumeration) directory, we have mapped the web-related entries of CWE onto the entries of OWASP Top-10 2010 and prioritized them. We have also presented which phase of SDLC is associated with each vulnerability entry. Using this approach, we can prevent or mitigate web application vulnerabilities and security threats efficiently.

• Journal of the Korean Association of Geographic Information Studies
• /
• v.17 no.4
• /
• pp.129-143
• /
• 2014

The purpose of this study is to evaluate flooding vulnerability considering spatial characteristics focused on Changwon-si, Gyeongsangnam-do. Assessment Factors are water cycle area ratio, surface runoff, and precipitation. And construction of assessment factors and vulnerability was analyzed by GIS program. Water cycle ratio and surface runoff were vulnerable in urban area. Precipitation was often distributed in agriculture of the northern region. Results of flooding vulnerability were low in agriculture and forest of the northern region. In contrast, urban area was high because there has covered impervious land cover. Analytical results of flooding vulnerability density using hotspot spatial cluster analysis were high in urban area. And these areas were situated in down stream so flooding were generated. Therefore, flooding vulnerability assessment of this study can help for selecting construction sites of pervious land cover and rainwater management facilities in urban and environmental planning.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.4
• /
• pp.709-722
• /
• 2022

The recent "Log4j Security Vulnerability Incident" has occurred, and the information system that uses the open source "Log4J" has been exposed to vulnerabilities. The incident brought great vulnerabilities in the information systems of South Korea's major government agencies or companies and global information systems, causing problems with open source vulnerabilities. Despite the advantages of many advantages, the current development paradigm, which is developed using open source, can easily spread software security vulnerabilities, ensuring open source safety and reliability. You need to check the open source. However, open source vulnerability scan tools have various languages and functions. Therefore, the existing software evaluation criteria are ambiguous and it is difficult to evaluate advantages and weaknesses, so this paper has developed a new evaluation criteria for the vulnerability analysis tools of open source