• 한국국방경영분석학회지
• /
• 제18권1호
• /
• pp.47-60
• /
• 1992

A class of allocation problems can be modeled in a linear programming formulation. But in reality, the coefficient of both the cost and constraint equations can not be generally determined by crisp numbers due to the imprecision or fuzziness in the related parameters. To account for this. a fuzzy version is considered and solved by transforming to a conventional non-linear programming model. This gives a solution as well as the degree that the solution satisfies the objective and constraints simultaneously and hence will be very useful to a decision maker. An attacker assignment problem for multiple fired targets has been modeled by a linear programming formulation by Lemus and David. in which the objective is to minimize the cost that might occur on attacker's losses during the mission. A fuzzy version of the model is formulated and solved by transforming it to a conventional nonlinear programming formulation following the Tanaka's approach. It is also expected that the fuzzy approach will have wide applicability in general allocation problems

• 한국컴퓨터정보학회논문지
• /
• 제22권10호
• /
• pp.83-92
• /
• 2017

Reconnaissance is performed gathering information from a series of scanning probes where the objective is to identify attributes of target hosts. Network reconnaissance of IP addresses and ports is prerequisite to various cyber attacks. In order to increase the attacker's workload and to break the attack kill chain, a few proactive techniques based on the network-based moving target defense (NMTD) paradigm, referred to as IP address mutation/randomization, have been presented. However, there are no commercial or trial systems deployed in real networks. In this paper, we propose a threat model and the request for requirements for developing NMTD techniques. For this purpose, we first examine the challenging problems in the NMTD mechanisms that were proposed for the legacy TCP/IP network. Secondly, we present a threat model in terms of attacker's intelligence, the intended information scope, and the attacker's location. Lastly, we provide seven basic requirements to develop an NMTD mechanism for the legacy TCP/IP network: 1) end-host address mutation, 2) post tracking, 3) address mutation unit, 4) service transparency, 5) name and address access, 6) adaptive defense, and 7) controller operation. We believe that this paper gives some insight into how to design and implement a new NMTD mechanism that would be deployable in real network.

• 정보보호학회논문지
• /
• 제27권6호
• /
• pp.1419-1429
• /
• 2017

최근 환경기반 인증 기술로 사용자의 로그인 히스토리를 계정도용 또는 정상 로그인으로 분류한 후 사용자별로 통계모델을 만들어 사용자를 인증하는 Reinforced authentication이 제안되었다. 하지만 Reinforced authentication은 사용자가 과거에 계정도용을 당한 적이 없으면 공격을 당할 가능성이 높다. 본 논문은 이러한 문제점을 해결하기 위해 기계학습 알고리즘을 이용하여 사용자 환경정보와 타인의 환경정보를 함께 학습시켜 2-Class 사용자 모델을 만드는 무자각 인증 기술을 제안한다. 제안한 기술의 성능을 평가하기 위해 목표 사용자에 대해 아무 정보도 없는 무 지식 공격자와 목표 사용자에 대해 한 가지의 정보만 알고 있는 정교한 공격자에 대한 Evasion Attack을 실험하였다. 무 지식 공격자에 대한 실험 결과 Class 0의 Precision과 Recall 각각 1.0과 0.998로 측정되었으며, 정교한 공격자에 대한 실험결과 Class 0의 Precision과 Recall 각각 0.948과 0.998로 측정되었다.

• 융합보안논문지
• /
• 제23권2호
• /
• pp.37-45
• /
• 2023

사이버 기만 기술은 공격자의 활동을 모니터링하고 새로운 유형의 공격을 탐지하는 데 중요한 역할을 한다. 그러나 기만 기술의 발전과 더불어 Anti-honeypot 기술 또한 발전하여 기만환경임을 알아챈 공격자가 기만환경에서의 활동을 중단하거나 역으로 기만환경을 이용하는 사례들도 존재하지만 현재 기만 기술은 이러한 상황을 식별하거나 대응하지 못하고 있다. 본 연구에서는 마코프 체인 분석 기법을 이용하여 기만환경에 침입한 공격자의 기만환경 식별 여부 예측 모델을 제안한다. 본 연구에서 제안하는 기만 여부 판단 모델은 확인한 바로는 공격자의기만환경 식별 여부를 판단하기 위한 최초의 시도이며 기만환경을 식별한 공격자를 고려하지 않는 기존의 기만기술 기반 공격자 분석에 대한 연구의 제한사항을 극복할 수 있을 것으로 예상한다. 본 연구에서 제안한 분류 모델은 기만환경임을 식별하고 활동하는 공격자 분류에 97.5%의 높은 정확도를 보였으며 공격자의 기만환경 식별여부 예측을 통해 수많은 기만환경 침입 데이터 분석 연구에 정제된 데이터를 제공할 수 있을 것으로 기대된다.

• 한국시뮬레이션학회논문지
• /
• 제10권1호
• /
• pp.83-92
• /
• 2001

For the prevention of the network intrusion from damaging the system, both IDS (Intrusion Detection System) and Firewall are frequently applied. The collaboration of IDS and Firewall efficiently protects the network because of making up for the weak points in the each demerit. A model has been constructed based on the DEVS (Discrete Event system Specification) formalism for the simulation of the system that consists of IDS and Firewall. With this model we can simulation whether the intrusion detection, which is a core function of IDS, is effectively done under various different conditions. As intrusions become more sophisticated, it is beyond the scope of any one IDS to deal with them. Thus we placed multiple IDS agents in the network where the information helpful for detecting the intrusions is shared among these agents to cope effectively with attackers. If an agent detects intrusions, it transfers attacker's information to a Firewall. Using this mechanism attacker's packets detected by IDS can be prevented from damaging the network.

• 정보보호학회논문지
• /
• 제13권4호
• /
• pp.161-168
• /
• 2003

We discuss the security of two famous password authenticated key exchange protocols, EKE2 and PAK. We introduce ′insider assisted attack′ Based on this assumption we point out weakness of the security of EKE2 and PAK protocols. More precisely, when the legitimate user wants to find other user′s password, called "insider-assisted attacker", the attacker can find out many ephemeral secrets of the server and then after monitoring on line other legitimate user and snatching some messages, he can guess a valid password of the user using the previous information. Of course for this kind of attack there are some constraints. Here we present a full description of the attack and point out that on the formal model, one should be very careful in describing the adversary′s behavior.

• 한국국방경영분석학회지
• /
• 제22권1호
• /
• pp.30-42
• /
• 1996

This study deals with an optimal firecar location and allocation models under uncertain enemy attack at the airforce base. It allocates just one firecar on the runaway and the other firecars on the headquarter of firecar company in usual situation. It is possible for several facilities at the airforce base to be attacked simultaneously by missiles enemy air attacker, other things under uncertain enemy attack. We formulate two stochastic LP location-allocation models to deal with uncertainty. One model is to locate all firecars on one site like present situation. We generate a new firecar location with a weighted average method. We call this model "centralized allocation model". The other model is to distribute firecars on several possible sites. We call this model "distributed allcoation model". Finally, we compare two models with computer experimentations on 8 airforce bases.on 8 airforce bases.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제11권4호
• /
• pp.2149-2170
• /
• 2017

Application-layer Distributed Denial-of-Service (DDoS) attack is one of the leading security problems in the Internet. In recent years, the attack strategies of application-layer DDoS have rapidly developed. This paper introduces a new attack strategy named Path Vulnerabilities-Based (PVB) attack. In this attack strategy, an attacker first analyzes the contents of web pages and subsequently measures the actual response time of each webpage to build a web-resource-weighted-directed graph. The attacker uses a Top M Longest Path algorithm to find M DDoS vulnerable paths that consume considerable resources when sequentially accessing the pages following any of those paths. A detection mechanism for such attack is also proposed and discussed. A finite-state machine is used to model the dynamical processes for the state of the user's session and monitor the PVB attacks. Numerical results based on real-traffic simulations reveal the efficiency of the attack strategy and the detection mechanism.

• 정보보호학회논문지
• /
• 제13권5호
• /
• pp.113-127
• /
• 2003

WAP의 보안 프로토콜인 WTLS는 무선 인터넷 프로토콜에서 TCP의 보안에 사용하는 TLS를 무선 환경에 맞게 최적한 것으로, 안전하고 효율적인 서비스 제공을 목적으로 하고 있다. WTLS 프로토콜은 Handshake, ChangeCipherSpec, Alert, Application Data 등 4개의 프로토콜로 구성되어 있으며, 본 논문에서는 Handshake 프로토콜에 대해 master secret를 설정하는 과정과 특징을 분석하고, 이를 기반으로 하여 능동적 공격자 모델에 대한 안전성을 분석한다. 또한 안전성 분석 결과를 바탕으로 능동적 공격자 모델에 안전하고 다양한 보안 서비스를 제공할 수 있는 새로운 Handshake 프로토콜을 제안한다.

• 한국경영과학회지
• /
• 제38권4호
• /
• pp.1-9
• /
• 2013

We propose a heuristic algorithm for war-game model that is appropriate for warfare in which the maneuver of the attacker is relatively certain. Our model is based on a multi-weapon extention of the Lanchester's square law. However, instead of dealing with the differential equations, we use a multi-period linear approximation which not only facilitates a solution method but also reflects discrete natures of warfare. Then our game model turns out to be a continuous game known to have an ${\varepsilon}$-Nash equilibrium for all ${\varepsilon}{\geq}0$. Therefore, our model approximates an optimal warfare strategies for both players as well as an efficient reinforcement of area defense system that guarantees a peaceful equilibrium. Finally, we report the performance of a practical best-response type heuristic for finding an ${\varepsilon}$-Nash equilibrium for a real-scale problem.