• Journal of Internet Computing and Services
• /
• v.18 no.5
• /
• pp.87-94
• /
• 2017

Due to the recent advances of IT industry, many companies and institutions have been used electronic documents rather than original paper copies. However, the characteristic of electronic document allows it to be readily damaged from proscribed copying, counterfeit, and falsification. These can cause the serious security problems for electronic documents. Conventional security methods for digital documents involve adding a separated image or marker, but these methods can reduce the readability of document. Therefore, we proposed a digital Jikin (Korean traditional stamp) which is normally used to identify the source or author of a document in asia. The proposed digital Jikin can preserve the readability of electronic document while protecting the document from proscribed copying, counterfeit, or falsification using image processing approach. In this paper, a digital Jikin application is designed and implemented under android platform and it converts the critical information of document onto the digital Jikin. The proposed digital Jikin contains important information in the boundary of Jikin not only about the author of documents or source, but also keywords, number of images, and many more. Therefore, the authenticity of document or whether the document has been altered or not by other person can be evaluated by the server. The proposed digital Jikin can be sent to a server through the wireless networks and can be stored using PHP and MySQL. We believe that the proposed method can offer the better and simple solution for strengthening the security of electronic document.

• KIPS Transactions on Computer and Communication Systems
• /
• v.6 no.3
• /
• pp.159-168
• /
• 2017

Smartphone malware has increased because Smartphone users has increased and smartphones are widely used in everyday life. Since 2012, Android has been the most mobile operating system. Owing to the open nature of Android, countless malware are in Android markets that seriously threaten Android security. Most of Android malware detection program does not detect malware to which bypass techniques apply and also does not detect unknown malware. In this paper, we propose lightweight method for detection of Android malware using static analysis and deep learning techniques. For experiments we crawl 7,000 apps from the Google Play Store and collect 6,120 malwares. The result show that proposed method can achieve 98.05% detection accuracy. Also, proposed method can detect about unknown malware families with good performance. On smartphones, the method requires 10 seconds for an analysis on average.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2013.01a
• /
• pp.263-264
• /
• 2013

본 연구에서는 기존의 홈오토메이션 보안 솔루션에서 더욱 기능이 확장된 보안솔루션 설계 및 구현하였다. 구현된 안드로이드 기반의 애플리케이션은 스마트폰으로 서버와의 통신을 통해 CCTV에서 촬영된 영상을 원격지에서 직접 확인 할 수 있고, 사용자는 사용에 친숙한 안드로이드 애플리케이션을 통해 CCTV의 방향을 제어함으로써 기존의 보안솔루션에 비해 보다 효과적인 보안성을 제공한다.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2014.01a
• /
• pp.385-386
• /
• 2014

최근 강력범죄와 빈집을 대상으로 하는 범죄가 증가함에 따라 언제 어디서나 실시간으로 주거지를 확인하고 대응을 할 수 있는 보안 솔루션에 대한 요구가 증가하고 있다. 본 논문에서 구현된 보안솔루션은 서버와의 통신을 통해 실시간으로 사용자의 스마트폰 애플리케이션에서 내부 침입을 확인할 수 있으며, 내부의 개폐장치를 스마트폰 애플리케이션을 통해 동작하는 보안 솔루션을 제안한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.3
• /
• pp.479-490
• /
• 2013

Recently, the number of attacks by malicious application has significantly increased, targeting Android-platform mobile terminal such as Samsung Galaxy Note and Galaxy Tab 10.1. The malicious application can be distributed to currently used mobile devices through open market masquerading as an normal application. An attacker inserts malicious code into an application, which might threaten privacy by rooting attack. Once the rooting attack is successful, malicious code can collect and steal private data stored in mobile terminal, for example, SMS messages, contacts list, and public key certificate for banking. To protect the private information from the malicious attack, malicious code detection, rooting attack detection and countermeasure method are required. To meet this end, this paper investigates rooting attack mechanism for Android-platform mobile terminal. Based on that, this paper proposes countermeasure system that enables to extract and collect events related to attacks occurring from mobile terminal, which contributes to active protection from malicious attacks.

• Journal of Internet Computing and Services
• /
• v.14 no.3
• /
• pp.35-46
• /
• 2013

As mobile terminal environment gets matured, the use of Android platform based mobile terminals has been growing high. Recently, the number of attacks by malicious application is also increasing as Android platform is vulnerable to private information leakage in nature. Most of these malicious applications are easily distributed to general users through open market or internet and an attacker inserts malicious code into malicious app which could be harmful tool to steal private data and banking data such as SMS, contacts list, and public key certificate to a remote server. To cope with these security threats more actively, it is necessary to develop countermeasure system that enables to detect security vulnerability existing in mobile device and take an appropriate action to protect the system against malicious attacks. In this sense, this paper aggregates diverse system events from multiple mobile devices and also implements a system to detect attacks by malicious application.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.3
• /
• pp.499-505
• /
• 2014

According to the increasing use of smart devices such as smart phones and tablets, the service that targets mobile office, finance and e-government for convenience of usage and productivity has emerged significantly. As a result, important information is treated with the smart devices and also, the malicious activity that targets smart devices is increasing steadily. In particular, the damage case by harmful sites, malware distribution sites and phishing sites that targets smart devices has occurred steadily and it has emerged as a social issue. In the case of smart devices, the Android platform is occupied the 90% in Korea, 2013 therefore the method of device block level is required to resolve the social issues of smart devices. In this paper, we propose a method that can be effectively blocked when you try to access an illegal site to Web browser on the Android platform and develop the application and also analyze the wrong site block function.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.5
• /
• pp.881-893
• /
• 2020

CFI(Control Flow Integrity) is a mitigation mechanism that protects programs by verifying control flows. IFCC(Indirect Function Call Checks) and SCS(Shadow Call Stack), CFI supported by LLVM Clang compiler, were introduced to protect applications in Android. IFCC protects function calls and SCS protects function returns. In this paper, we propose attacks to bypass CFI on the application environment with IFCC and SCS. Even if IFCC and SCS were applied to user applications, it was confirmed that there were many code segments not protected by IFCC and SCS in the application memory. We execute code in CFI unprotected segments to construct 1) bypassing IFCC to call a protected function, 2) modulating return address via SCS bypass. We identify code segments not protected by IFCC and SCS in Android10 QP1A. 191005.007.A3. We also implement proof-of-concept exploits to demonstrate that modulation of control flow is possible in an environment where IFCC and SCS are applied.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.6
• /
• pp.1491-1498
• /
• 2017

As the use of smartphones and the launch of various apps have increased rapidly, the number of malicious apps has also increased, and the damage is continuing. The Google Market where Android apps are registered is inevitably present at the same time as normal apps and malicious apps even though there are regulations for app registration. Especially, as social networks are activated, users are connected with social networks, and the ratings, downloads and awareness information are reflected in the number of downloaded apps. As a result, when users choose their apps by simply reflecting ratings, popularity, popular comments, and highly-categorized apps, malicious app downloads can sometimes cause significant harm. Therefore, this study first analyzed the tendency of malicious apps by directly crawling and analyzing long-term social information in the currently active Android market.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.1
• /
• pp.45-55
• /
• 2019

DEX file and share objects (also known as the SO file) are important components that define the behaviors of an Android application. DEX file is implemented in Java code, whereas SO file under ELF file format is implemented in native code(C/C++). The two layers - Java and native can communicate with each other at runtime. Malicious applications have become more and more prevalent in mobile world, they are equipped with different evasion techniques to avoid being detected by anti-malware product. To avoid static analysis, some applications may perform malicious behavior in native code that is difficult to analyze. Existing researches fail to extract the call relationship which includes both Java code and native code, or can not analyze multi-DEX application. In this study, we design and implement a system that effectively extracts the call relationship between Java code and native code by analyzing DEX file and SO file of Android application.