• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.4
• /
• pp.869-882
• /
• 2012

With the growth of Web services and the development of web exploit toolkits, web-based malware has increased dramatically. Using Javascript Obfuscation, recent web-based malware hide a malicious URL and the exploit code. Thus, pattern matching for network intrusion detection systems has difficulty of detecting malware. Though various methods have proposed to detect Javascript malware on a users' web browser, the overall detection is needed to counter advanced attacks such as APTs(Advanced Persistent Treats), aimed at penetration into a certain an organization's intranet. To overcome the limitation of previous pattern matching for network intrusion detection systems, a novel deobfuscating method to handle obfuscated Javascript is needed. In this paper, we propose a framework for effective hidden malware detection through an automated deobfuscation regardless of advanced obfuscation techniques with overriding JavaScript functions and a separate JavaScript interpreter through to improve jsunpack-n.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.6
• /
• pp.939-946
• /
• 2023

In the hyper-connected network, which network equipment is diverse and network structure is complex, the attack surface has also increased. In this environment, MTD(Moving Target Defense) technology is being researched as a method to fundamentally defend against cyber attacks by actively changing the attack surface. network-based MTD technologies are being widely studied. However, in order for network address mutation technology to be applied within the existing fixed IP-based system, research is needed to determine what impact it will have. In this paper, we studied the impact of applying network address mutation technology to the existing network protection system. As a result of the study, factors to be considered when firewall, NAC, IPS, and network address mutation technologies are operated together were derived, and elements that must be managed in network address mutation technology for interoperability with the network analysis system were suggested.

• Journal of Internet Computing and Services
• /
• v.19 no.5
• /
• pp.21-31
• /
• 2018

Cyber penetration attacks can not only damage cyber space but can attack entire infrastructure such as electricity, gas, water, and nuclear power, which can cause enormous damage to the lives of the people. Also, cyber space has already been defined as the fifth battlefield, and strategic responses are very important. Most of recent cyber attacks are caused by malicious code, and since the number is more than 1.6 million per day, automated analysis technology to cope with a large amount of malicious code is very important. However, it is difficult to deal with malicious code encryption, obfuscation and packing, and the dynamic analysis technique is not limited to the performance requirements of dynamic analysis but also to the virtual There is a limit in coping with environment avoiding technology. In this paper, we propose a machine learning based malicious code analysis technique which improve the weakness of the detection performance of existing analysis technology while maintaining the light and high-speed analysis performance applicable to commercial endpoints. The results of this study show that 99.13% accuracy, 99.26% precision and 99.09% recall analysis performance of 71,000 normal file and malicious code in commercial environment and analysis time in PC environment can be analyzed more than 5 per second, and it can be operated independently in the endpoint environment and it is considered that it works in complementary form in operation in conjunction with existing antivirus technology and static and dynamic analysis technology. It is also expected to be used as a core element of EDR technology and malware variant analysis.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.5
• /
• pp.1191-1204
• /
• 2012

As attackers try to paralyze information security systems, many researchers have investigated security testing to analyze vulnerabilities of information security products. Penetration testing, a critical step in the development of any secure product, is the practice of testing a computer systems to find vulnerabilities that an attacker could exploit. Security testing like penetration testing includes gathering information about the target before the test, identifying possible entry points, attempting to break in and reporting back the findings. Therefore, to obtain maximum generality, re-usability and efficiency is very useful for efficient security testing and vulnerability hunting activities. In this paper, we propose a threat analysis based software security testing technique for evaluating that the security functionality of target products provides the properties of self-protection and non-bypassability in order to respond to attacks to incapacitate or bypass the security features of the target products. We conduct a security threat analysis to identify vulnerabilities and establish a testing strategy according to software modules and security features/functions of the target products after threat analysis to improve re-usability and efficiency of software security testing. The proposed technique consists of threat analysis and classification, selection of right strategy for security testing, and security testing. We demonstrate our technique can systematically evaluate the strength of security systems by analyzing case studies and performing security tests.

• Journal of Digital Convergence
• /
• v.11 no.3
• /
• pp.273-277
• /
• 2013

Phishing attacks have been implemented in smarter, more advanced ways with the passage of time. Hackers use intelligent phishing attacks to take over computers and to penetrate internal networks in major organizations. So, in this paper, a model for a prevention of phishing attack spread is conceptual designed in order to protect internal users and sensitive or important information from sophisticated phishing attacks. Internal users simultaneously utilize both external web and organizational mail services. And hackers can take the both side equally as a vector. Thus, packets in each service must be monitored and stored to recognize threatening elements from both sides. The model designed in this paper extends the mail server based security structure used in conventional studies for the protection of Internet mail services accessed by intranet users. This model can build a list of phishing sites as the system checks e-mails compared to that of the method that directly intercepts accesses to phishing sites using a proxy server, so it represents no standby time for request and response processes.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.21 no.5
• /
• pp.1003-1008
• /
• 2017

The Internet of Things has attracted considerable research attention in recent years. In order for the new IoT technology to be widely used, the reliability and protection of information is required. IoT systems are very vulnerable to physical security due to their easy accessibility. Along with the development of SoC technology, many operating systems have been developed and many new operating systems have been introduced. In this paper, we describe the vulnerability analysis results for operating systems running on the ARMv7 Thumb Architecture hardware platform. For the recently introduced "Windows 10 IoT Core" operating system, I implemented the Zero-Day Attack by implanting the penetration code developed through the research into a specific IoT system. The virus detection test for the resulting penetration code was validated by referral to the "virustotal" site.

• Journal of the Korean Wood Science and Technology
• /
• v.25 no.2
• /
• pp.1-20
• /
• 1997

목재를 분해시키는 담자균류들은 목재 및 목질복합체에 쉽사리 침투하여 복잡한 리그노셀룰로오스 복합체를 분해시킨다. 이러한 분해에는 많은 효소시스템들이 복합적으로 작용하면서 상호 협동하는 것으로 보고되고 있다. 지금까지 일려진 효소들은 통상 3개의 그룹으로 나눌 수 있는데 그 하나는 목재성분을 직접적으로 공격하는 효소균들, 예를 들면 cellulase complex, laccase(LAC), lignin peroxidase(LIP), horse-radish peroxidase(HRP), manganese-independent peroxidase(MIP) 및 protocatechuate 3,4-dioxygenase(PCD) 등이 있고, 두번째 그룹으로서 manganese-dependent peroxidase(MnP), aryl alcohol oxidase(AAO) 및 glyoxal oxidase(GLO) 등인데, 이들 효소들은 목질을 직접적으로 공격하지 않고 제1그룹의 효소들과 협동하여 작용하는 것으로 알려지고 있다. 제3그룹의 효소들은 glucose oxidase(GOD) 및 cellobiose : quinone oxidoreductase(CBQ)로서 feedback type의 효소들로서 목재고분자의 분해시 대사의 고리를 결합시켜 주는 매우 중요한 기능을 하는 효소군들이다. 그러나 이 이외에도 다른 분해기구가 밝혀지고 있으며 기타 효소들에 의한 리그노셀룰로오스의 분해반응기구의 해명에는 상당한 시간이 걸릴 것으로 사료된다.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2013.10a
• /
• pp.685-687
• /
• 2013

Today, as wireless communications devices such as laptops, smart phones are generalized, wireless LAN has been widely installed in the corporate office conference rooms, industrial warehouses, Internet-ready classrooms, and even in a coffee shop. Though a wired network can be accessed and attacked only by the physical penetration, the wireless network which can be accessed anywhere within the reach of anyone has relative vulnerability by unauthorized users' attack. To defend these vulnerabilities, the introduction of WIDS / WIPS is required. In this paper, we recognize the limitations of WLAN security technology, review the current technology trends and propose the solutions in the future security problems.

• Review of KIISC
• /
• v.24 no.5
• /
• pp.46-50
• /
• 2014

제어시스템은 일반 업무환경에서 사용하고 있는 시스템과는 달리 업무망과 분리되어 운영되며, 비공개 제어프로토콜 사용으로 해커나 악성코드에 의해 사이버공격을 받을 가능성이 없다고 인식되어 왔다. 그러나 2010년 스턱스넷(Stuxnet) 악성코드가 이란의 핵시설 제어시스템에 침투하였고 2012년 듀크, 플레임 등 제어시스템을 대상으로 한 위협이 증가하게 되면서 제어시스템과 업무망 연계 지점의 보안 위협을 제거하기 위한 방안으로 물리적 일방향 자료전달 시스템의 도입이 추진되어 왔다. 본 논문에서는 배전DAS 업무망 연계를 위한 물리적 일방향 자료전달 시스템 구현에 대해서 설명하고 실증에 따른 결과를 제시한다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2010.06d
• /
• pp.30-35
• /
• 2010

현대 사회는 노트북, 스마트폰 등 무선 통신기기의 발전, 확산 및 유무선 통합 컨텐츠의 활발한 개발로 인해 어느 때보다 무선랜의 사용이 확산되고 있다. 하지만 물리적인 침투를 해야만 공격 및 내부정보 접근이 가능한 유선 네트워크에 비해 전파 도달 범위 내의 어디서나 누구나 접속이 가능한 무선 네트워크는 상대적으로 보안 취약점을 내포하고 있다. 이러한 취약점 개선을 위한 가장 중요한 정보가 무선 네트워크에 접속 대상인 인가, 비인가 사용자 정보를 얼마나 효율적으로 수집 관리하는 가에 있다. 현재는 OA 및 보안 관리자가 수동적으로 수집,관리하는 무선기기 정보를 본 논문에서는 자동화 수집 시스템 및 무선 침입차단시스템(WIPS)와 연계한 시스템 아키텍쳐를 제시하고 구현하였으며, 실제 이동통신사 무선 네트워크에 적용하여 정보 수집율이 향상되고 외부 침입에 대한 능동적 대처 능력이 향상되었음을 확인 하였다.