• Proceedings of the Korea Information Processing Society Conference
• /
• 2017.04a
• /
• pp.291-294
• /
• 2017

최근 국내에서 신 변종 공격이 대량으로 발생함에 따라, 한정적인 보안전문 인력과 기존의 장비로 분석 및 대응하는데 어려움이 있다. 본 논문에서는, 대량으로 발생하는 침해사고에 대해 분석 우선순위를 확인하고자, 침해사고에 활용된 침해지표들의 위협을 분석하고 이를 정량적인 값인 침해지표 위협수준(TL_IoC, Threat Level of IoC)로 도출하는 방안을 제안한다. 이를 통해, 침해지표의 위협수준을 직관적으로 확인함으로써 침해사고의 대응수준을 신속하게 판단하고, 위협수준이 높은 침해사고에 대해 능동적으로 빠르게 분석함으로써 대량의 침해사고를 효율적으로 대응할 수 있다.

• KIPS Transactions on Computer and Communication Systems
• /
• v.5 no.11
• /
• pp.419-426
• /
• 2016

As the threat of cyber incident grows continuously, the need of IOC(Indicators of Compromise) is increasing to identify the cause of incidents and share it for quick response to similar incidents. But only few companies use it domestically and the research about the application of IOC is deficient compared to foreign countries. Therefore in this paper, a quick and standardized way to create IOC automatically based on the analysis result of malwares from Cuckoo Sandbox and its application is suggested.

• Convergence Security Journal
• /
• v.20 no.3
• /
• pp.21-28
• /
• 2020

In recent years, hacking and malware techniques have evolved and become sophisticated and complex, and numerous cyber-attacks are constantly occurring in various fields. Among them, the most widely used route for compromise incidents such as information leakage and system destruction was found to be E-Mails. In particular, it is still difficult to detect and identify E-Mail APT attacks that employ zero-day vulnerabilities and social engineering hacking techniques by detecting signatures and conducting dynamic analysis only. Thus, there has been an increased demand for indicators of compromise (IOC) to identify the causes of malicious activities and quickly respond to similar compromise incidents by sharing the information. In this study, we propose a method of extracting various forensic artifacts required for detecting and investigating Hacking E-Mails, which account for large portion of damages in security incidents. To achieve this, we employed a digital forensic indicator method that was previously utilized to collect information of client-side incidents.

• KIPS Transactions on Computer and Communication Systems
• /
• v.5 no.4
• /
• pp.95-102
• /
• 2016

Computer security incident such as confidential information leak and data destruction are constantly growing and it becomes threat to information in digital devices. To respond against the incident, digital forensic techniques are also developing to help digital incident investigation. With the development of digital forensic technology, a variety of forensic artifact has been developed to trace the behavior of users. Also, a diversity of forensic tool has been developed to extract information from forensic artifact. However, there is a issue that information from forensic tools has its own forms. To solve this problem, it needs to process data when it is output from forensic tools. Then it needs to compare and analyze processed data to identify how data is related each other and interpret the implications. To reach this, it calls for effective method to store and output data in the course of data processing. This paper aims to propose DFIOC (Digital Forensic Indicators Of Compromise) that is capable of transcribing a variety of forensic artifact information effectively during incident analysis and response. DFIOC, which is XML based format, provides "Evidence" to represent various forensic artifacts in the incident investigation. Furthermore, It provides "Forensic Analysis" to report forensic analysis result and also gives "Indicator" to investigate the trace of incidence quickly. By logging data into one sheet in DFIOC format for forensic analysis process, it is capable of avoiding unnecessary data processing. Lastly, since collected information is recorded in a normalized format, data input and output becomes much easier as well as it will be convenient to use for identification of collected information and analysis of data relationship.

• Journal of Korea Technology Innovation Society
• /
• v.15 no.3
• /
• pp.700-721
• /
• 2012

This paper deals with methods for determining the reasonable royalty rates in the valuation of patents. To calculate the reliable reasonable royalty rate of a patent, we review pros and cons of the 25% rule royalty calculating method and the recent trend of this method. We also review the game theory of Nash Bargaining equation and review the Investment of Rate of Return Method according to the financial analysis. Next, we refer to the reasonable royalty damage cases among the recent patent infringement cases in USA and analyze the corresponding patents. We extract the patent indicators from the patent bibliographic information. Finally, we obtain a regression model for calculating a reasonable royalty rate using the patent indicators and the reasonable royalty rates in the recent patent infringement cases.

• Review of KIISC
• /
• v.31 no.6
• /
• pp.41-46
• /
• 2021

홈, 산업 환경, 운송 네트워크 및 기타 장소의 사물 인터넷 장치가 계속 확산됨에 따라 악의적인 IoT 네트워크 공격자의 공격 표면도 증가하고 있다. 2021년 4월 IBM에 따르면 네트워크 공격 지표 중 전체 IoT 공격이 매년 500% 증가하고 있다. X-Force 연구에 따르면 이 급증은 주로 미라이 봇넷과 코드를 공유하는 비교적 새로운 봇넷인 Mozi 봇넷 활동에 의해 발생한다. 2020년에 이 악성코드는 한 해 동안 탐지된 총 IoT 공격의 89%를 차지했다. 2020년 3월 팔로알토 네트웍스의 Unit 42 IoT Threat Report에 따르면 IoT 임베디드 기기 대상 위협은 익스플로잇 감염, 멀웨어, 사용자 정보 탈취로 나뉜다. 그 중 IoT 임베디드 기기의 주요 익스플로잇은 네트워크 스캔, RCE, Command injection, Buffer Overflow 등으로 관찰된다. 본 논문에서는 이러한 IoT 환경에서의 취약점 악용 공격 대응 및 탐지 정책 생성을 위해 IoT 취약점을 악용한 익스플로잇을 분석 연구하였다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2023.05a
• /
• pp.392-393
• /
• 2023

매년 급증하는 악성코드(malware)로 인해 기업, 공공기관 등 다수의 PC가 있는 대상까지 피해 사례가 늘고 있다. 악성코드로 인한 침해사고 흔적에서 비정상적인 동작을 한 프로세스를 찾는 기술은 해당 PC의 침해 여부 판단, 사후 대응 등 사이버 보안에 기여할 수 있을 것이다. 본 연구에서는 최근접 이웃 방법을 활용하여 시스템 메모리 데이터에서 비정상 프로세스를 검출하는 방안을 제시한다. 또한 실험을 통해 제안 방법이 정확도 및 여러 지표에서 우수한 성능을 달성함을 보였다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.5
• /
• pp.987-999
• /
• 2021

Recently, Federated learning has become an issue due to privacy invasion caused by data. Federated learning is safe from privacy violations because it does not need to be collected into a server and does not require learning data. As a result, studies on application methods for utilizing distributed devices and data are underway. However, Federated learning is no longer safe as research on the reconstruction attack to restore learning data from gradients transmitted in the Federated learning process progresses. This paper is to verify numerically and visually how well data reconstruction attacks work in various data situations. Considering that the attacker does not know how the data is constructed, divide the data with the class from when only one data exists to when multiple data are distributed within the class, and use MNIST data as an evaluation index that is MSE, LOSS, PSNR, and SSIM. The fact is that the more classes and data, the higher MSE, LOSS, and PSNR and SSIM are, the lower the reconstruction performance, but sufficient privacy invasion is possible with several reconstructed images.

• The Journal of Society for e-Business Studies
• /
• v.26 no.4
• /
• pp.37-52
• /
• 2021

Due to the spread of COVID-19, it is rapidly changing from face-to-face to non-face-to-face work environments and is changing to a digital work environment that can be accessed anytime, anywhere, providing convenience to all lives. However, the number of breaches, personal information leakage, and technology leakage targeting SMEs that are vulnerable to security continues to increase. Accordingly, the government has been continuously promoting the information security consulting support project for SMEs every year since 2014. Therefore, this study intends to develop a performance model and measurement methodology for continuous and more systematic support and efficient management of information protection support projects in consideration of the importance of information security for SMEs. It is intended to be used as basic data when setting future operational directions and goals. The main method of this study is to derive performance models and indicators for SME information security support projects based on domestic literature, case studies, and survey results, utilize expert advice to verify the developed performance measurement indicators, and use pilot-test questionnaires. Conduct evaluation through surveys. Based on the verified indicators, we would like to present a performance model and measurement index for the information security support project for SMEs.

• Journal of Digital Convergence
• /
• v.14 no.8
• /
• pp.11-18
• /
• 2016

The purpose of this study is to compare the differences in human rights perception between people with disabilities and staffs in the disabled residential facilities. Using data from the '2014 Human Rights Survey on Disability in the Disabled Residential Facilities' for 602 facilities, the study compared their perception of human rights(16 items), including human rights guarantee(12 items) and human rights violation(4 items). Result showed that the rate of perception for human rights guarantee and violation(except staff violation) of staffs was higher than people with disabilities(p<.05). This study demonstrated that there were significant differences in human right perception between people with disabilities and staffs. The cause of this difference would be the conflict between roles of staff and needs of person with disabilities, absence of human rights indicators by mutual consent between the two. Our findings suggested a need for study on strategies to solve gap of perception between the two, such as integrated human rights education, developing consensual human rights indicators.