• Journal of Internet Computing and Services
• /
• v.4 no.2
• /
• pp.69-80
• /
• 2003

Program Behavior Intrusion Detection Technique analyses system calls that called by daemon program or root authority, constructs profiles, and detectes modificated anomaly intrusions effectively. In this paper, the relation among system calls of processes is represented by bayesian network and Multiple Sequence Alignment. Program behavior profiling by Bayesian Network classifies modified anomaly intrusion behaviors, and detects anomaly behaviors. we had simulation by proposed normal behavior profiling technique using UNM data.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.34 no.5
• /
• pp.993-1006
• /
• 2024

The recent increase in public cloud usage has led to various security issues. In response, CPU manufacturers have introduced Trusted Execution Environment (TEE) technology, allowing secure service usage even with potentially untrustworthy cloud service providers. For instance, AMD offers VM-level TEE through SEV(Secure Encrypted Virtualization). However, it has been raised that confidential information can be leaked via page fault-based side-channel attacks on VMs protected by SEV. To address this, this paper proposes a method for real-time detection of such attacks in SEV environments. Nonetheless, since attackers can have hypervisor-level privileges under the SEV threat model, realizing this is challenging. To overcome this, we propose two approaches. First, using VMPL(Virtual Machine Privileged Level) to protect the detection program from untrusted hypervisors. Second, utilizing vPMU(virtual Performance Monitoring Unit) to derive new features for detecting page side-channel attacks. The designed and implemented detection program achieved a 95.38% accuracy in detecting page fault side-channel attacks.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 1998.12a
• /
• pp.389-401
• /
• 1998

역할기반 접근제어 정책은 정보보호를 위한 단순한 접근제어 수단으로서 뿐만 아니라, 사용자와 다양한 응용 소프트웨어로 구성된 환경에서 편리한 권한 관리 기능을 수행할 수 있어 일반적인 기업환경과 컴퓨터 운영체제, 데이터베이스와 같은 시스템에서 채택, 활용되고 있다. 본 논문에서는 역할기반 접근 제어 정책을 채택한 정보 시스템 환경에서 시스템이 관리하는 정보의 무결성 보장을 위한 세션기반 임무분리 특성을 제안하고, 정형적 기술방식을 Z 언어를 이용하여 표현하였다. 또한 제안된 특성을 기반으로 한 응용 프로그램 명세 요소를 이용한 응용 프로그램 설계 및 실행가능성 확인기능, 전체 시스템의 운영 구조에 대하여 기술하였다.

• The KIPS Transactions:PartC
• /
• v.10C no.4
• /
• pp.397-404
• /
• 2003

Intrusion detection techniques based on program behavior can detect potential intrusions against systems by analyzing system calls made by demon programs or root-privileged programs and building program profiles. But there is a drawback : large profiles must be built for each program. In this paper, we apply $X^2$ distance-based multivariate analysis to profiling program behavior and detecting abnormal behavior in order to reduce profiles. Experiment results show that profiles are relatively small and the detection rate is significant.

• Journal of IKEEE
• /
• v.16 no.4
• /
• pp.389-394
• /
• 2012

Most current systems have ignored security vulnerability concerned with boot firmware. It is highly likely that boot firmware may cause serious system errors, such as hardware manipulations by malicious programs or code, the operating system corruption caused by malicious code and software piracy under a condition of no consideration of security mechanism because boot firmware has an authority over external devices as well as hardware controls. This paper proposed a structural security mechanism based on software equipped with encrypted bootstrap patterns different from pre-existing bootstrap methods in terms of securely loading an operating system, searching for malicious codes and preventing software piracy so as to provide reliability of boot firmware. Moreover, through experiments, it proved its superiority in detection capability and overhead ranging between 1.5 % ~ 3 % lower than other software security mechanisms.

• The KIPS Transactions:PartC
• /
• v.11C no.1
• /
• pp.47-54
• /
• 2004

The growth of computer resource and network speed has increased requests for the use of remotely located computer systems by connecting through computer networks. This phenomenon has hoisted research activities for application service provision that uses server-based remote computing paradigm. The server-based remote computing paradigm has been developed as the ASP (Application Service Provision) model, which provides remote users through application sharing protocol to application programs. Security requirement such as confidentiality, availability, integrity should be satisfied to provide ASP service using centralized computing system. Existing Telnet or FTP service for a remote computing systems have satisfied security requirement by a simple access control to files and/or data. But windows-based centralized computing system is vulnerable to confidentiality, availability, integrity where many users use the same application program installed in the same computer. In other words, the computing system needs detailed security level for each user different from others, such that only authorized user or group of users can run some specific functional commands for the program. In this paper, we propose windows based centralized computing system that sets security policies for each user for the use of instructions of the application programs, and performs access control to the instructions based on the security policies. The system monitors all user messages which are executed through graphical user interface by the users connecting to the system. Ail Instructions, i.e. messages, for the application program are now passed to authorization process that decides if an Instruction is delivered to the application program based on the pre-defined security polices. This system can be used as security clearance for each user for the shared computing resource as well as shared application programs.

• Journal of the Korea Society of Computer and Information
• /
• v.8 no.1
• /
• pp.103-113
• /
• 2003

Program Behavior Intrusion Detection Technique analyses system calls that called by daemon program or root authority, constructs profiles. and detectes anomaly intrusions effectively. Anomaly detections using system calls are detected only anomaly processes. But this has a Problem that doesn't detect affected various Part by anomaly processes. To improve this problem, the relation among system calls of processes is represented by bayesian probability values. Application behavior profiling by Bayesian Network supports anomaly intrusion informations . This paper overcomes the Problems of various intrusion detection models we Propose effective intrusion detection technique using Bayesian Networks. we have profiled concisely normal behaviors using behavior context. And this method be able to detect new intrusions or modificated intrusions we had simulation by proposed normal behavior profiling technique using UNM data.

• Proceedings of the Plant Resources Society of Korea Conference
• /
• 2022.09a
• /
• pp.53-53
• /
• 2022

대한민국의 농업생명자원 중 식물유전자원은 농촌진흥청 국립농업과학원 농업유전자원센터와 지방자치단체, 대학, 연구소 등 전국 79개 관리기관에서 보존하고 있으며 책임기관인 농업유전자원센터에서는 종자 1,599종 246,097자원, 관리기관은 영양체자원 1,476종 26,254자원을 관리하고 있다. 유전자원 관리(수집/증식/등록/평가/분양 등) 업무 중 생산되는 대량의 정보를 관리하기 위해서 농업유전자원 정보를 DB 구축하였다. 구축된 정보는 학명 등 기초정보, 형태·저항성 등 특성 정보, 화상·종자량·활력·분양·증식 등으로 구분하여 데이터베이스화하고, 이 정보를 관리하기 위한 농업유전자원관리시스템(Germplasm Management System, GMS)을 운영하였으나 개선전 프로그램은 설치 후 주기적인 업데이트를 해야하고, 하드웨어 교체시 프로그램을 재설치를 해야하는 번거로움이 존재하였다. 이러한 문제를 해결하기 위해 HTML5 방식으로 개선하였다. 개선 프로그램은 웹 브라우저(크롬, 마이크로소트 엣지 등)에 실행 주소(genebank.rda.go.kr/gms)를 입력만 하면 전국 79개 관리기관에서 자원을 접수하고 평가한 정보를 어디에서든 확인이 가능하다(메뉴사용 및 권한설정은 필요). 개선된 농업유전자원 정보관리시스템은 국가적 차원의 통합관리를 지원하여 농업생명자원을 효율적으로 관리하고 수요자가 원하는 자원에 대한 적절한 정보제공을 함으로써 농업생명자원의 활용 촉진에 기여할 것으로 기대된다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.10 no.2
• /
• pp.79-92
• /
• 2000

기업환경에서 정보의 무결성은 중요한 보안 요구사항이다 의무분리 정책의 목적은 정보의 무결성을 필요로 하는 연산들을 여러 역할이나 사용자에게 분산시킴으로써 조직 내에서 관리하는 무결성 침해 가능성을 최소화하는 것이며 이것은 상업적 응용분야에서 중요하다. 전통적인 임의적 접근제어와 강제적 접근제어 정책의 대안인 역할 기반의 접근제어 기법은 응용에 따라 보호 객체들에 대한 접근을 역할들로 분류하여 단순한 권한 관리를 제공하며 의무분리 정책을 시행하기에 적합하다. 본 논문에서는 역할 기반의 접근제어에서 기존의 의무분리 안전성 조건의 취약성을 보완하여 응용 프로그램의 실행단위인 클래스에 기반한 개선된 동적 의무분리 기법을 제안하고 상호 배타적인 부트랜잭션들을 포함하고 있는 중첩-트랜잭션을 대상으로 이를 적용한다. 또한 여러 작업들이 동시에 실행되는 환경에서 감염된 트로이언 목마에 의해 발생될수 있는 정보의 유출 문제를 해결하고자 작업간 정보의 비밀성을 보장하는 동적의무분리 모델을 제시한다. 제안한 모델은 기존의 무결성 보장을 위해 제시되었던 Clark-Wilson 모델과 다른 의무분리 모델에 비해 관리가 용이하며, 동적으로 유지 관리되어야 하는 데이터의 양이 적고 객체 접근 확인 절차가 단순하여 구현방법이 용이한 장점이 있다 그리고 기존 의무분리 모델에서 고려되지 않은 병렬 수행 환경에서 작업 사이의 정보 유출 문제를 해결한다.

• Transportation Technology and Policy
• /
• v.2 no.2
• /
• pp.53-78
• /
• 2005

This is to introduce and overview regional transportation planning processes in the southwest region of the State of Washington, USA. First, significant roles of Growth Management Act (GMA) of the State of Washington in transportation planning are examined. Major functions and roles of Southwest Washington Regional Transportation Council (RTC) as an MPO in the southwest region of the State of Washington, are reviewed mainly from the regional transportation planning perspectives by examining regional transportation planning programs and coordination among the state and local cities and counties. Finally, processes and roles of Metropolitan Transportation Plan (MTP) are discussed. Regional transportation planning processes in a case of the southwest region of the State of Washington may be considered as a reference in regional transportation planning efforts in Korea.