• International Journal of Computer Science & Network Security
• /
• 제24권1호
• /
• pp.52-60
• /
• 2024

APT (Advanced Persistent Threat) attack is a dangerous, targeted attack form with clear targets. APT attack campaigns have huge consequences. Therefore, the problem of researching and developing the APT attack detection solution is very urgent and necessary nowadays. On the other hand, no matter how advanced the APT attack, it has clear processes and lifecycles. Taking advantage of this point, security experts recommend that could develop APT attack detection solutions for each of their life cycles and processes. In APT attacks, hackers often use phishing techniques to perform attacks and steal data. If this attack and phishing phase is detected, the entire APT attack campaign will be crash. Therefore, it is necessary to research and deploy technology and solutions that could detect early the APT attack when it is in the stages of attacking and stealing data. This paper proposes an APT attack detection framework based on the Network traffic analysis technique using open-source tools and deep learning models. This research focuses on analyzing Network traffic into different components, then finds ways to extract abnormal behaviors on those components, and finally uses deep learning algorithms to classify Network traffic based on the extracted abnormal behaviors. The abnormal behavior analysis process is presented in detail in section III.A of the paper. The APT attack detection method based on Network traffic is presented in section III.B of this paper. Finally, the experimental process of the proposal is performed in section IV of the paper.

• 컴퓨터교육학회논문지
• /
• 제14권6호
• /
• pp.65-73
• /
• 2011

최근 사이버공격을 보면 전세계 해킹공격 트랜드로 APT 공격이 지속 발생하고 있다. 특히, HTTP Get Flooding 공격은 사이버공격기법 중 가장 효과적인 공격 중 하나이다. 기존의 HTTP Get Flooding 공격 기술에 대해 알아보고 ATP 공격 특성을 결합한 새로운 공격 기술을 제안한다. 본 논문은 HTTP Get Flooding 기술을 이용하여 효과적인 APT 공격 도구 제작 관한 내용이다. 이 공격도구를 통해 지속적인 DDoS 공격에 대한 적극적 방어 대책이 필요하다.

• International Journal of Internet, Broadcasting and Communication
• /
• 제13권4호
• /
• pp.1-10
• /
• 2021

The purpose of the study is to contribute to the positive development of blockchain technology by providing data to examine security vulnerabilities and threats to blockchain-based services and review countermeasures. The findings of this study are as follows. Threats to the security of blockchain-based services can be classified into application security threats, smart contract security threats, and network (P2P) security threats. First, application security threats include wallet theft (e-wallet stealing), double spending (double payment attack), and cryptojacking (mining malware infection). Second, smart contract security threats are divided into reentrancy attacks, replay attacks, and balance increasing attacks. Third, network (P2P) security threats are divided into the 51% control attack, Sybil attack, balance attack, eclipse attack (spread false information attack), selfish mining (selfish mining monopoly), block withholding attack, DDoS attack (distributed service denial attack) and DNS/BGP hijacks. Through this study, it is possible to discuss the future plans of the blockchain technology-based ecosystem through understanding the functional characteristics of transparency or some privacy that can be obtained within the blockchain. It also supports effective coping with various security threats.

• Journal of the Korean Society for Industrial and Applied Mathematics
• /
• 제27권1호
• /
• pp.75-86
• /
• 2023

The angle of attack is highly sensitive to pitch point in the airfoil shape and the decline of pitch point value induces smaller angle of attack, which implies that airfoil profile possessing closer pitch point to the airfoil tip reacts more sensitively to upcoming wind. The method of conformal transformation functions is employed for airfoil profiles and airfoil surfaces are expressed with a trigonometric series form. Attack angle and ideal lift coefficient distributions are investigated for various airfoil profiles in wind turbine blade regarding conformal transformation and pitch point. The conformed angle function representing the surface angle of airfoil shape generates various attack angle distributions depending on the choice of surface angle function. Moreover, ideal attack angle and ideal lift coefficient are susceptible to the choice of airfoil profiles and uniform loading area. High ideal attack angle signifies high pliability to upcoming wind, and high ideal lift coefficient involves high possibility to generate larger electric energy. According to results obtained pitch point, airfoil shape, uniform loading area, and the conformed airfoil surface angle function are crucial factors in the determination of angle of attack.

• 한국컴퓨터정보학회논문지
• /
• 제24권10호
• /
• pp.41-48
• /
• 2019

2018년 Cui 등은 생체 정보를 사용하는 three-factor 원격 사용자 인증 프로토콜을 제안하였다. Cui 등은 자신들의 인증 프로토콜이 도청 공격, 스마트카드 분실 공격, 특별히 DoS(denial-of-service) 공격에 안전하다고 주장하였다. 또한 그들은 패스워드 추측 공격, 가장 공격, 그리고 익명성 공격 등에 안전하다고 주장하였다. 그러나 본 논문에서는 Cui 등의 인증 프로토콜을 분석하고, 이 인증 프로토콜이 재생 공격, 내부자 공격, 스마트카드 분실 공격, 그리고 사용자 가장 공격 등에 취약함을 보인다. 게다가 우리는 Cui 등의 인증 프로토콜의 설계 오류도 함께 제시한다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제11권4호
• /
• pp.2149-2170
• /
• 2017

Application-layer Distributed Denial-of-Service (DDoS) attack is one of the leading security problems in the Internet. In recent years, the attack strategies of application-layer DDoS have rapidly developed. This paper introduces a new attack strategy named Path Vulnerabilities-Based (PVB) attack. In this attack strategy, an attacker first analyzes the contents of web pages and subsequently measures the actual response time of each webpage to build a web-resource-weighted-directed graph. The attacker uses a Top M Longest Path algorithm to find M DDoS vulnerable paths that consume considerable resources when sequentially accessing the pages following any of those paths. A detection mechanism for such attack is also proposed and discussed. A finite-state machine is used to model the dynamical processes for the state of the user's session and monitor the PVB attacks. Numerical results based on real-traffic simulations reveal the efficiency of the attack strategy and the detection mechanism.

• 한국정보통신학회:학술대회논문집
• /
• 한국정보통신학회 2015년도 춘계학술대회
• /
• pp.639-642
• /
• 2015

MANET(Mobile Ad-Hoc Network)의 라우팅 기능에 대한 공격인 홀 공격은 네트워크 전송성능에 중요한 영향을 미친다. MANET은 단말기만으로 구성되는 임시 네트워크로 악성공격에 대한 대응이 쉽지 않아 홀 공격에 매우 취약하여 전송성능에 치명적인 영향을 받을 수 있다. 본 연구에서는 홀공격의 일종은 그레이홀 공격이 MANET의 전송 성능에 미치는 영향을 컴퓨터 시뮬레이션을 사용하여 분석하여 본다. 연구의 대상 트래픽으로는 음성 트래픽을 사용하였으며, 그레이홀 공격의 영향을 블랙홀 공격과 비교하여 본다. 본 연구의 방법과 결과는 MANET에서 악성공격에 대응하기 위한 자료로 활용될 수 있다.

• 디지털산업정보학회논문지
• /
• 제16권1호
• /
• pp.79-92
• /
• 2020

As the number of systems increases and the network size increases, automated attack prediction systems are urgently needed to respond to cyber attacks. In this study, we developed four types of information gathering sensors for collecting asset and vulnerability information, and developed technology to automatically generate attack graphs and predict attack targets. To improve performance, the attack graph generation method is divided into the reachability calculation process and the vulnerability assignment process. It always keeps up to date by starting calculations whenever asset and vulnerability information changes. In order to improve the accuracy of the attack target prediction, the degree of asset risk and the degree of asset reference are reflected. We refer to CVSS(Common Vulnerability Scoring System) for asset risk, and Google's PageRank algorithm for asset reference. The results of attack target prediction is displayed on the web screen and CyCOP(Cyber Common Operation Picture) to help both analysts and decision makers.

• 한국시뮬레이션학회논문지
• /
• 제12권2호
• /
• pp.63-73
• /
• 2003

The major objective of this paper is to propose the method of attacker and host modeling for cyber-attack simulation. In the security modeling and simulation for information assurance, it is essential the modeling of attacker that is able to generate various cyber-attack scenarios as well as the modeling of host, which is able to represent behavior on attack concretely The security modeling and simulation, which was announced by Cohen, Nong Ye and etc., is too simple to concretely analyze attack behavior on the host. And, the attacker modeling, which was announced by CERT, Laura and etc., is impossible to represent complex attack excepting fixed forms. To deal with this problem, we have accomplished attacker modeling by adopted the rule-based SES which integrates the existing SES with rule-based expert system for synthesis and performed host modeling by using the DEVS formalism. Our approach is to show the difference from others in that (ⅰ) it is able to represent complex and repetitive attack, (ⅱ) it automatically generates the cyber-attack scenario suitable on the target system, (ⅲ) it is able to analyze host's behavior of cyber attack concretely. Simulation tests performed on the sample network verify the soundness of proposed method.

• 정보처리학회논문지:컴퓨터 및 통신 시스템
• /
• 제2권3호
• /
• pp.125-132
• /
• 2013

본 논문은 DDoS 공격과 유사한 트래픽을 생성하고 ISP를 포함한 네트워크를 통해 실제 운용 중인 웹서버에 전송하여 결과를 분석하였다. 결과 분석을 위해서 대응 장비의 관리 주체에 따라 DDoS 공격의 대응 방법을 ISP(Top), 네트워크(Middle), 시스템(Bottom) 레벨 대응으로 분류하였으며 전송 트래픽을 특징에 따라 4종으로 분류하였다. 실험 결과는 48개 홈페이지의 대응 레벨별 평균 공격 성공률과 공격 분류별 평균 공격 성공률을 기술 및 분석하였으며 2개의 예외 상황에 대해서 기술하였다. 5장에서는 실험 결과를 기반으로 피해완화방안을 제시하였다.