• Journal of Internet Computing and Services
• /
• v.22 no.1
• /
• pp.41-50
• /
• 2021

Cyber Kill Chain is derived from Kill chain of traditional military terms. Kill chain means "a continuous and cyclical process from detection to destruction of military targets requiring destruction, or dividing it into several distinct actions." The kill chain has evolved the existing operational procedures to effectively deal with time-limited emergency targets that require immediate response due to changes in location and increased risk, such as nuclear weapons and missiles. It began with the military concept of incapacitating the attacker's intended purpose by preventing it from functioning at any one stage of the process of reaching it. Thus the basic concept of the cyber kill chain is that the attack performed by a cyber attacker consists of each stage, and the cyber attacker can achieve the attack goal only when each stage is successfully performed, and from a defense point of view, each stage is detailed. It is believed that if a response procedure is prepared and responded, the chain of attacks is broken, and the attack of the attacker can be neutralized or delayed. Also, from the point of view of an attack, if a specific response procedure is prepared at each stage, the chain of attacks can be successful and the target of the attack can be neutralized. The cyber command and control system is a system that is applied to both defense and attack, and should present defensive countermeasures and offensive countermeasures to neutralize the enemy's kill chain during defense, and each step-by-step procedure to neutralize the enemy when attacking. Therefore, thist paper proposed a cyber kill chain model from the perspective of defense and attack of the cyber command and control system, and also researched and presented the threat classification/analysis/prediction framework of the cyber command and control system from the defense aspect

• Convergence Security Journal
• /
• v.22 no.3
• /
• pp.25-32
• /
• 2022

Recently, the image processing industry has been activated as deep learning-based technology is introduced in the image recognition and detection field. With the development of deep learning technology, learning model vulnerabilities for adversarial attacks continue to be reported. However, studies on countermeasures against poisoning attacks that inject malicious data during learning are insufficient. The conventional countermeasure against poisoning attacks has a limitation in that it is necessary to perform a separate detection and removal operation by examining the training data each time. Therefore, in this paper, we propose a technique for reducing the attack success rate by applying modifications to the training data and inference data without a separate detection and removal process for the poison data. The One-shot kill poison attack, a clean label poison attack proposed in previous studies, was used as an attack model. The attack performance was confirmed by dividing it into a general attacker and an intelligent attacker according to the attacker's attack strategy. According to the experimental results, when the proposed defense mechanism is applied, the attack success rate can be reduced by up to 65% compared to the conventional method.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.15 no.3
• /
• pp.101-109
• /
• 2019

In addition to enabling access, database accounts play a protective role by defending the database from external attacks. However, because only a single account is used in the database, the account becomes the subject of vulnerability attacks. This common practice is due to the lack of database support, large numbers of users, and row-based database permissions. Therefore if the logic of the application is wrong or vulnerable, there is a risk of exposing the entire database. In this paper, we propose a Least-Privilege Account Separation Model (LPASM) that serves as an information guardian to protect the database from attacks. We separate database accounts depending on the role of application services. This model can protect the database from malicious attacks and prevent damage caused by privilege escalation by an attacker. We classify the account control policies into four categories and propose detailed roles and operating plans for each account.

• Management Science and Financial Engineering
• /
• v.19 no.2
• /
• pp.31-36
• /
• 2013

We propose a war-game model that is appropriate for a raid-type warfare in which, a priori, the maneuver of the attacker is relatively certain. The model is based on a multi-weapon extention of the Lanchester's law. Instead of a continuous time dynamic game with the differential equations from the Lanchester's law, however, we adopt a multi-period model relying on a time-discretization of the Lanchester's law. Despite the obvious limitation that two players make a move only on the discrete time epochs, the pragmatic model has a manifold justification. The existence of an equilibrium is readily established by its equivalence to a finite zero-sum game, the existence of whose equilibrium is, in turn, well-known to be no other than the LP-duality. It implies then that the war-game model dictates optimal strategies for both players under the assumption that any strategy choice of each player will be responded by a best strategy of her opponent. The model, therefore, provides a sound ground for finding an efficient reinforcement of a defense system that guarantees peaceful equilibria.

• Convergence Security Journal
• /
• v.23 no.2
• /
• pp.27-36
• /
• 2023

In recent years, ransomware attacks have become more organized and specialized, with the sophistication of attacks targeting specific individuals or organizations using tactics such as social engineering, spear phishing, and even machine learning, some operating as business models. In order to effectively respond to this, various researches and solutions are being developed and operated to detect and prevent attacks before they cause serious damage. In particular, honeypots can be used to minimize the risk of attack on IT systems and networks, as well as act as an early warning and advanced security monitoring tool, but in cases where ransomware does not have priority access to the decoy file, or bypasses it completely. has a disadvantage that effective ransomware response is limited. In this paper, this honeypot is optimized for the user environment to create a reliable real-time dynamic honeypot file, minimizing the possibility of an attacker bypassing the honeypot, and increasing the detection rate by preventing the attacker from recognizing that it is a honeypot file. To this end, four models, including a basic data collection model for dynamic honeypot generation, were designed (basic data collection model / user-defined model / sample statistical model / experience accumulation model), and their validity was verified.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.6
• /
• pp.1077-1086
• /
• 2023

The searchable encryption model allows to selectively search for encrypted data stored on a remote server. In a real-world scenarios, the model must be able to support multiple search keywords, multiple data owners/users. In this paper, these models are referred to as Multi Ranked Searchable Encryption model. However, at the time this paper was written, the proposed models use fully-trusted trapdoor centers, some of which assume that the connection between the user and the trapdoor center is secure, which is unlikely that such assumptions will be kept in real life. In order to improve the practicality and security of these searchable encryption models, this paper proposes a new Multi Ranked Searchable Encryption model which uses random keywords to protect search words requested by the data downloader from an honest-but-curious trapdoor center with an external attacker without the assumptions. The attacker cannot distinguish whether two different search requests contain the same search keywords. In addition, experiments demonstrate that the proposed model achieves reasonable performance, even considering the overhead caused by adding this protection process.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.19 no.1
• /
• pp.135-144
• /
• 2009

This paper deals with an information security problem that involves the strategies of both an attacker and an administrator of a web-based system. A game-theoretic model for the problem, based on an Stackelberg game environment, is presented. In the model, the administrator selects a set of anti-virus vaccines to cope with potential system attackers and the intruder chooses attacking modes that are most effective against the administrator's chosen set of vaccines. Moreover, the model considers a number of practical constraints, such as a budget limit on the vaccine purchase and a limit on the system performance. In addition, two different scenario analyses are provided, based on the results of the proposed model applied to a simulated pseudo-real-world data.

• Journal of Internet Computing and Services
• /
• v.23 no.6
• /
• pp.15-26
• /
• 2022

Various subjects are carrying out cyberattacks using a variety of tactics and techniques. Additionally, cyberattacks for political and economic purposes are also being carried out by groups which is sponsored by its nation. To deal with cyberattacks, researchers used to classify the malware family and the subjects of the attack based on malware signature. Unfortunately, attackers can easily masquerade as other group. Also, as the attack varies with subject, techniques, and purpose, it is more effective for defenders to identify the attacker's purpose and goal to respond appropriately. The essential goal of cyberattacks is to threaten the information security of the target assets. Information security is achieved by preserving the confidentiality, integrity, and availability of the assets. In this paper, we relabel the attacker's goal based on MITRE ATT&CK® in the point of CIA triad as well as classifying cyber security reports to verify the labeling method. Experimental results show that the model classified the proposed CIA label with at most 80% probability.

• Journal of Internet Computing and Services
• /
• v.18 no.6
• /
• pp.35-46
• /
• 2017

Recently, attackers using malicious code in cyber security have been increased by attaching malicious code to a mail and inducing the user to execute it. Especially, it is dangerous because it is easy to execute by attaching a document type file. The author analysis is a research area that is being studied in NLP (Neutral Language Process) and text mining, and it studies methods of analyzing authors by analyzing text sentences, texts, and documents in a specific language. In case of attack mail, it is created by the attacker. Therefore, by analyzing the contents of the mail and the attached document file and identifying the corresponding author, it is possible to discover more distinctive features from the normal mail and improve the detection accuracy. In this pager, we proposed IADA2(Intelligent Attack mail Detection based on Authorship Analysis) model for attack mail detection. The feature vector that can classify and detect attack mail from the features used in the existing machine learning based spam detection model and the features used in the author analysis of the document and the IADA2 detection model. We have improved the detection models of attack mails by simply detecting term features and extracted features that reflect the sequence characteristics of words by applying n-grams. Result of experiment show that the proposed method improves performance according to feature combinations, feature selection techniques, and appropriate models.

• Electronics and Telecommunications Trends
• /
• v.33 no.1
• /
• pp.78-88
• /
• 2018

As the traffic environment gradually changes to autonomous driving and intelligent transport systems, vehicles are becoming increasingly complicated and intelligent, and their connectivity is greatly expandinged. As a result, attack vectors of such vehicles increasing, and security threats further expanding. Currently, various solutions for vehicle security are being developed and applied, but the damage caused by cyber attacks is still increasing. In recent years, vehicles such as the Tesla Model S and Mitsubishi Outlander have been hacked and remotely controlled by an attacker. Therefore, there is a need for advanced security technologies to cope with increasingly intelligent and sophisticated automotive cyber attacks. In this article, we introduce the latest trends of autonomous vehicles and their security threats, as well as the current status and issues of security technologies to cope with them.