• Proceedings of the Korean Information Science Society Conference
• /
• 2002.04a
• /
• pp.850-852
• /
• 2002

일반 어플리케이션 형태의 커널 백도어가 커널의 일부로 수행되는 커널 모듈 형태의 백도어로 변화함에따라, 기존의 백도어 탐지 기술로는 이에 대처할 수 없게되었다. 이에 최근 커널 백도어에 대웅하여 Chkrootkit, Kstat등의 백도어 탐지 툴이 개발되어 사용되고 있지만, 이러한 툴들은 커널 백도어 설치여부 추정이나 탐지 수준으로 예방이나 발견후의 대응은 어려운 실정이다. 이에 본 논문에서는 커널 백도어의 예방, 탐지 및 복구 기술을 제시하고, 제시한 기술을 바탕으로 구현한 커널 백도어 대응 시스템을 보인다. 이 시스템은 커널 모듈의 선택적 로딩으로 커널 백도어를 예방하며, 커널에 보안 시스템 콜을 추가하여 커널 백도어 행위 탐지 및 복구 기능을 함으로써 커널 백도어에 대해 종합적이고 실시간적인 대응을 가능하게 한다

• Journal of Korea Multimedia Society
• /
• v.19 no.1
• /
• pp.51-59
• /
• 2016

Physical security protecting people from physical threats, such as a person or vehicle, has received a great attention. However, it has many risks of hacking and other security threats because it is highly dependent on automated management systems. In addition, a representative system of physical security, a CCTV control system has a high risk of hacking, such as video interceptions or video modulation. So physical security needs urgent security measures in accordance with these threats. In this paper, we examine the case of security threats that have occurred in the past, prevent those from threatening the physical security, and analyze the security problem with the threats. Then we study the countermeasures to prevent these security threats based on the problems found in each case. Finally we study for the method to apply these countermeasures.

• The Journal of Asian Finance, Economics and Business
• /
• v.4 no.4
• /
• pp.79-86
• /
• 2017

The purpose of this research is to examine reasons and evaluate strategies implemented by the Indian banking industry in tackling jay-customers in general and in light of the recent demonetization in particular. After a thorough germane literature and theoretical framework on jay-customers and Indian banking industry, researchers framed a well-structured questionnaire for collecting banking employees opinions along with a set of questions framed to conduct in-depth personal interviews with banking customers. The collected data were summarized, coded, and controlled by using Software R and the selected hypotheses were analyzed by the observance of percentile values. More than 90 percent of banking employees said lack of proper supply of cash from the Reserve Bank of India is the major reason for this kind of customer behaviour and shockingly 95 percent of banking customers expressed backdoor preference given by banking employees to some big customers is the major reason. The research confined only two state capitals Amaravati and Bangalore in India and covered only two largest banks one in public and private sector. The research provides useful insight into the crucial reasons for jay-customers' behaviour from the dyadic perspective of both employees and customers of the Indian banking industry.

• Convergence Security Journal
• /
• v.14 no.5
• /
• pp.37-47
• /
• 2014

A Trojan malicious code is one of largest malicious codes and has been known as a virus that causes damage to a system as itself. However, it has been changed as a type that picks user information out stealthily through a backdoor method, and worms or viruses, which represent a characteristic of the Trojan malicious code, have recently been increased. Although several modeling methods for analyzing the diffusion characteristics of worms have proposed, it allows a macroscopic analysis only and shows limitations in estimating specific viruses and malicious codes. Thus, in this study an ESP model that can estimate future occurrences of Trojan malicious codes using the previous Trojan data is proposed. It is verified that the estimated value obtained using the proposed model is similar to the existing actual frequency in causes of the comparison between the obtained value and the result obtained by the Markov chain.

• The KIPS Transactions:PartC
• /
• v.13C no.1 s.104
• /
• pp.11-18
• /
• 2006

In the field of network defense, a lot of researches are directed toward locating the source of network attacks. When an intruder launches attack not from their own computer but from intermediate hosts that they previously compromised, and these intermediate hosts are called stepping-stones. There we two kinds of traceback technologies : IP packet traceback and connection traceback. We focused on connection traceback in this paper This paper classifies process structures of detoured attack type in stepping stone, designs an algorithm for traceback agent, and implements the traceback system based on the agent

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.31 no.3B
• /
• pp.199-206
• /
• 2006

In this paper, we analyzed the weakness of the Back-door type private network which was effective method of system security and transmission speed in the same area without firewall system, and presented the solution to improve it. To prove the effect of this solution, Windows based systems and UNIX based systems are set up in same area, data transmission was tried. According to the result, this solution can maintain the advantage of the Back-door type private network and can have the advantage of removing file server and increasing operation efficiency by reducing the number of operation.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.5
• /
• pp.1185-1189
• /
• 2016

In modern society, the number of embedded devices has been increasing. However, embedded devices is growing, and the backdoor and vulnerabilities are found continously. It is necessary for this analysis. In this paper, we developed a tool to extract the base address information for the static analysis environment built of the embedded device's firmware. By using this tool, we built the environment for static analysis. As a result, this point enables us to parse the strings and to check the reference. Also, through the increased number of functions, we proved the validity of the tool.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2002.04b
• /
• pp.971-974
• /
• 2002

일반적으로 악의적인 사용자는 시스템에 공격을 가해 관리자 권한을 취득한 후 그 시스템에 쉽게 침입하기 위해 백도어를 설치해 놓는다. 이전의 백도어는 대부분 사용자 영역에서 수행중인 응용 프로그램의 형태로 설치가 되었다. 그러나 최근에는 로더블 모듈과 같은 운영체제의 확장 방법을 이용하여 커널 영역에서 수행되는 백도어가 나타나게 되었다. 이러한 커널 백도어를 구현하는 방식은 크게 시스템 콜 테이블을 수정하는 방법과 시스템 콜 처리 루틴을 수정하는 방법의 두 가지로 나눌 수 있다. 본 논문에서는 기존에 구현된 커널 백도어의 특성 분석을 하였으며, 이를 기반으로 커널 백도어를 효율적으로 차단 및 탐지할 수 있는 방안을 제안하고 있다. 본 논문에서 언급하는 방안은 커널 메모리 영역에 대한 분석을 통하여 백도어가 시스템 콜 테이블을 수정하거나 시스템 콜 처리 루틴을 변경할 수 없도록 하는 보호 메커니즘을 적용하고 있다. 이를 통하여 커널 내부로 적재되어 백도어를 생성하는 악의적인 모듈의 가능성을 원천적으로 방지할 수 있다.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2022.10a
• /
• pp.333-336
• /
• 2022

With the development of IT technology, cybercrime is becoming sophisticated and intelligent. In particular, in the case of BackDoor, which is used in the APT attack (intelligent continuous attack), it is very important to detect malicious behavior and respond to infringement because it is often unaware that it has been damaged by an attacker. This paper aims to build an EDR platform that can monitor, analyze, and respond to malicious behavior in real time by collecting, storing, analyzing, and visualizing logs in an endpoint environment in real time using open source-based analysis solutions ELK Stack and Sysmon.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2023.05a
• /
• pp.582-584
• /
• 2023

연합학습(Federated Learning)에서는 여러 참가자가 서로 간의 데이터를 공유하지 않고 협력하여 하나의 모델을 학습할 수 있다. 그 중 수직 연합학습(Vertical Federated Learning)은 참가자 간에 동일한 샘플에 대해 서로 다른 특성(Feature)를 가지고 학습한다. 또한 서로 다른 특성(Feature)에는 입력의 라벨(Label)도 포함하기 때문에 라벨을 소유한 참가자 외에는 라벨 정보 또한 접근할 수 없다. 이처럼 다양한 참가자가 학습에 참여하는 경우 악의적인 참가자에 의해 모델이 포이즈닝 될 여지가 존재함에도 불구하고 수직 연합학습에서는 관련 연구가 부족하다. 포이즈닝 공격 중 백도어 공격은 학습 과정에 관여하여 특정 입력 패턴에 대해서 모델이 공격자가 원하는 타겟 라벨로 예측하도록 오염시키는 공격이다. 수직 연합학습에서는 참가자가 학습과 추론 모든 과정에서 관여하기 때문에 백도어 공격에 취약할 수 있다. 본 논문에서는 수직 연합학습에서의 최신 백도어 공격과 한계점에 대해 분석한다.