• The Journal of the Korea Contents Association
• /
• v.5 no.6
• /
• pp.360-367
• /
• 2005

Corporation's computerization developed by diffusion of internet, and dysfunction of Information is increasing greatly with virus, computing network infringement. Therefore, the today, corporation security is more and more emphasized. Security solution by that importance of security rises so is developing together Security solution is developing to ESM system in existing single system and important thing is function of each security solution and optimizing design of policy. Existent security policy taking a serious view security from external invasion but security of interior the importance rise the today. Accordingly, must construct ESM system of new structure for this. This paper proposes and embodied integration security administration system that solidify interior security utilizing IDS. Experiment external IP and ID access and analyzed the result.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2013.10a
• /
• pp.685-687
• /
• 2013

Today, as wireless communications devices such as laptops, smart phones are generalized, wireless LAN has been widely installed in the corporate office conference rooms, industrial warehouses, Internet-ready classrooms, and even in a coffee shop. Though a wired network can be accessed and attacked only by the physical penetration, the wireless network which can be accessed anywhere within the reach of anyone has relative vulnerability by unauthorized users' attack. To defend these vulnerabilities, the introduction of WIDS / WIPS is required. In this paper, we recognize the limitations of WLAN security technology, review the current technology trends and propose the solutions in the future security problems.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.12 no.3
• /
• pp.61-76
• /
• 2002

To ensure PKI systems' reliability, the security for PKI systems evaluation is required. But, unfortunately, the systematic security evaluation and certification of PKI systems is insufficient. In Korea, Firewall and intrusion detection system's security evaluation and certification has been enforced, but research of PKI systems’ evaluation is insufficient. This paper provides a PKI system evaluation criteria. This paper specifies a 7 level of the functional and assurance security requirements for a PKI system. And this PKI system evaluation criteria provides a compatibility with CC(Common Criteria) and KISES(Korea Information Security Evaluation Systems).

• Korean Security Journal
• /
• no.22
• /
• pp.15-35
• /
• 2010

A larceny means stealing others' properties, as one of crime types most closely connected with common people. Along with fraud, it is the mostly common property crime; in particular, the largest number of people are exposed to a burglary. This study aims to find the schemes to utilize private guards according to the characteristics of burglary. To do so, a questionnaire survey was conducted into an actual condition of official statistics of burglary and into the criminals of burglary, with a view to understanding the behavioral characteristics of burglary and suggesting defense mechanisms to prevent the crime. Burglary is not just a major crime to be dealt with by public guards like the police but also one to be handled increasingly more by private guards. It is why this study intends to identify how to utilize private guards in preventing the crime. Investigations were made into 208 burglars, who were inmates of 10 correctional institutions (prisons or detention houses) across the country. It is found that only about 24% of burglars committed the crime through rational choice, about 60.7% were feared of their arrest at the time of their crime, and a very high percentage (69.9%) of them were assured of their successful crime. Burglaries usually happened at night, mostly in a summer day when everybody goes away from home for vacation. Primarily, the crimes took place in a private house of urban residential quarters. What burglars considered mostly for target selection includes 'profitability,' followed by 'surveillance' and 'risk.' Most (42%) of them committed the crime for the first time ever. Generally, they were not inclined to commit the crime while under the influence of alcohol or drug, which might prevent them from making reasonable decisions. 73.9% of the criminals said that they committed the crime singly without any accomplices.

• The KIPS Transactions:PartC
• /
• v.8C no.5
• /
• pp.607-614
• /
• 2001

With a remarkable growth and expansion of Internet, the security issues emerged from intrusions and attacks such as computer viruses, denial of services and hackings to destroy information have been considered as serious threats for Internet and the private networks. To protect networks from those attacks, many vendors have developed various security systems such as firewalls, intrusion detection systems, and access control systems. However, managing those systems individually requires too much work and high cost. Thus, in order to manage integrated security management and establish consistent security management for various security products, the policy model of PN-ISMS (Policy Based Integrated Security Management System) has become very important. In this paper, present the hierarchical policy model which explore the refinement of high-level/conceptual policies into a number of more specific policies to form a policy hierarchy. A formal method of policy description was used as the basis of the mode in order to achieve precision and generality. Z-Notation was chosen for this propose. The Z-Notation is mathematical notation for expressing and communicating the specifications of computer programs. Z uses conventional notations of logic and set theory organized into expressions called schemas.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.25 no.1
• /
• pp.69-74
• /
• 2021

Internet access is also increasing as online activities increase due to the influence of Corona 19. However, network attacks are also diversifying by malicious users, and DDoS among the attacks are increasing year by year. These attacks are detected by intrusion detection systems and can be prevented at an early stage. Various data sets are used to verify intrusion detection algorithms, but in this paper, CICIDS2017, the latest traffic, is used. DDoS attack traffic was analyzed using the decision tree. In this paper, we analyzed the traffic by using the decision tree. Through the analysis, a decisive feature was found, and the accuracy of the decisive feature was confirmed by proceeding the decision tree to prove the accuracy of detection. And the contents of false positive and false negative traffic were analyzed. As a result, learning the feature and the two features showed that the accuracy was 98% and 99.8% respectively.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.21 no.4
• /
• pp.15-23
• /
• 2021

In most hacking attacks, hackers intrudes inside for a long period of time and attempts to communicate with the outside using a circumvent connection to achieve purpose. research in response to advanced and intelligent cyber threats has been mainly conducted with signature-based detection and blocking methods, but recently it has been extended to threat hunting methods. attacks from organized hacking groups are advanced persistent attacks over a long period of time, and bypass remote attacks account for the majority. however, even in the intrusion detection system using intelligent recognition technology, it only shows detection performance of the existing intrusion status. therefore, countermeasures against targeted bypass rwjqthrwkemote attacks still have limitations with existing detection methods and threat hunting methods. in this paper, to overcome theses limitations, we propose a model that can detect the targeted circumvent connection remote attack threat of an organized hacking group. this model designed a threat hunting process model that applied the method of verifying the origin IP of the remote circumvent connection, and verified the effectiveness by implementing the proposed method in actual defense information system environment.

• Journal of the Korean Institute of Intelligent Systems
• /
• v.18 no.5
• /
• pp.679-684
• /
• 2008

The slow port scan attack detection is the one of the important topics in the network security. We suggest an abnormal traffic control framework to detect slow port scan attacks using fuzzy rules. The abnormal traffic control framework acts as an intrusion prevention system to suspicious network traffic. It manages traffic with a stepwise policy: first decreasing network bandwidth and then discarding traffic. In this paper, we show that our abnormal traffic control framework effectively detects slow port scan attacks traffic using fuzzy rules and a stepwise policy.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2001.10b
• /
• pp.939-942
• /
• 2001

인터넷 사용자가 급격히 증가함에 따라 정보통신 산업의 발전이 되었지만, 이에 따른 역기능 또한 크게 증가하고 있는 추세이며, 이를 차단하고, 탐지하는 기술이 해킹기술을 앞지르지 못하고 있으며 수동적 입장에서 해킹 사례를 분석하거나, 접근 차체를 차단하는 방법을 택하고 있지만 새로운 해킹 시도에 노출되고, 피해가 계속되고 있다. 따라서 우리가 제안하는 Anomaly IDS는 능동적 입장에서 해킹기법에 대해 대처하고, 새로운 형태의 해킹기술을 탐지함으로써, 보호하려는 시스템에 대한 능동적 보안수단을 제공한다. 본 논문에서는 기존 Anomaly IDS에서의 문제점을 보완하는 다계층적 측면에서 Audit Data를 통계적으로 학습하여 패턴을 생성하고 탐지하는 시스템을 설계 및 구현하였다.

• Convergence Security Journal
• /
• v.15 no.6_2
• /
• pp.3-10
• /
• 2015

Recent massive data breaches or major security incidents show that threats posed by insiders have greatly increased over time. Especially, authorized insiders can cause more serious problems than external hackers can. Therefore there is a growing need to introduce a system that can monitor the insider threats in real time and prevent data breaches or security incidents in early-stage. In this paper, we propose a EITMS(Enterprise Insider-Threats Management System). EITMS detects the abnormal behaviors of authorized insiders based on the normal patterns made from their roles, duties and private activities. And, in order to prevent breaches and incidents in early-stage, a scoring system that can visualize the insider threats is also included.