• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.4
• /
• pp.961-974
• /
• 2015

With the advancement of SIEM from ESM, it allows deep correlated analysis using huge amount of data. By collecting software's vulnerabilities from assessment with certain classification measures (e.g., CWE), it can improve detection rate effectively, and respond to software's vulnerabilities by analyzing big data. In the phase of monitoring and vulnerability diagnosis Process, it not only detects predefined threats, but also vulnerabilities of software in each resources could promptly be applied by sharing CCE, CPE, CVE and CVSS information. This abstract proposes a model for effective detection and response of software vulnerabilities and describes effective outcomes of the model application.

• Journal of Korea Multimedia Society
• /
• v.14 no.10
• /
• pp.1335-1347
• /
• 2011

The dissemination and use of mobile applications have been rapidly expanding these days. And in such a situation, the security of mobile applications has emerged as a new issue. Although the safety of general software such as desktop and enterprise software is systematically achieved from the development phase to the verification phase through secure coding, there have been not sufficient studies on the safety of mobile applications yet. This paper deals with deriving weakness enumeration specialized in mobile applications and implementing a tool that can automatically analyze the derived weakness. Deriving the weakness enumeration can be achieved based on CWE(Common Weakness Enumeration) and CERT(Computer Emergency Response Team) relating to the event-driven method that is generally used in developing mobile applications. The analysis tool uses the dynamic tests to check whether there are specified vulnerabilities in the source code of mobile applications. Moreover, the derived vulnerability could be used as a guidebook for programmers to develop mobile applications.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.2
• /
• pp.243-253
• /
• 2022

Recently, cyber attacks on national infrastructure facilities have continued to occur. As a result, the vulnerabilities of ICS-CERTs have more than doubled from last year, and the vulnerabilities to industrial control systems such as nuclear facilities are increasing day by day. Most control system operators formulate vulnerability countermeasures based on the vulnerability information sources of industrial control systems provided by ICS-CERT in the United States. However, it is difficult to apply this to the security of domestic control systems because ICS-CERT does not contain all relevant vulnerability information and does not provide vulnerabilities to domestic manufacturer's products. In this research, we will utilize publicly available vulnerability-related information such as CVE, CWE, ICS-CERT, and CPE to discover vulnerabilities that may exist in control system assets and may occur in the future. I proposed a plan that can predict possible vulnerabilities and applied it to information on major domestic control systems.

• Convergence Security Journal
• /
• v.22 no.1
• /
• pp.11-17
• /
• 2022

Cyber attacks on national infrastructure, including large-scale power outages in Ukraine, have continued in recent years. As a result, ICS-CERT vulnerabilities have doubled compared to last year, and vulnerabilities to industrial control systems are increasing day by day. Most control system operators develop vulnerability countermeasures based on the vulnerability information sources provided by ICS-CERT in the United States. However, it is not applicable to the security of domestic control systems because it does not provide weaknesses in Korean manufacturers' products. Therefore, this study presents a vulnerability analysis framework that integrates CVE, CWE, CAPE, and CPE information related to the vulnerability based on ICS-CERT information (1843 cases). It also identifies assets of nuclear facilities by using CPE information and analyzes vulnerabilities using CVE and ICS-CERT. In the past, only 8% of ICS-CERT's vulnerability information was searched for information on any domestic nuclear facility during vulnerability analysis, but more than 70% of the vulnerability information could be searched using the proposed methodology.

• Journal of the Korea Society of Computer and Information
• /
• v.22 no.3
• /
• pp.81-88
• /
• 2017

In this paper, we classified the weaknesses of C/C++ programs listed in CWE based on the diagnostic information produced at each stage of program compilation. Our classification identifies which stages should be responsible for analyzing the weaknesses. We also present algorithmic frameworks for detecting typical weaknesses belonging to the classes to demonstrate validness of our scheme. For the weaknesses that cannot be analyzed by using the diagnostic information, we separated them as a group that are often detectable by the analyses that simulate program execution, for instance, symbolic execution and abstract interpretation. We expect that classification of weaknesses, and diagnostic information accordingly, would contribute to systematic development of static analyzers that minimizes false positives and negatives.

• Annual Conference of KIPS
• /
• 2012.11a
• /
• pp.1057-1059
• /
• 2012

스마트폰이 대중화되면서 안드로이드 애플리케이션의 보안문제가 대두되고 있다. PC환경의 소프트웨어는 개발단계에서부터 시큐어코딩을 통해 안전성을 확보하고 있으나 안드로이드 애플리케이션의 경우는 연구가 더 필요한 상황이다. 본 논문에서는 CWE(Common Weakness Enumeration)의 취약점 분류 체계와 CAPEC(Common Attack Pattern Enumeration and Classification)의 공격 패턴 분류 체계와 CERT(Computer Emergency Response Team)의 취약점 발생 예방을 위한 정책들을 통해 안드로이드 애플리케이션의 최신화된 취약점 목록을 도출하고 카테고리별로 분류하여 취약점을 효율적으로 분석하는 기법을 제안한다.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.17 no.4
• /
• pp.77-83
• /
• 2021

As Open Source Software(OSS) recently invigorates, many companies actively use the OSSes in their business software. With such OSS invigoration, our web application is developed in order to provide the safety in using the OSSes, and update the information on the new vulnerabilities and the patches at all times by crawling the web pages of the relevant OSS home pages and the managing organizations of the vulnerabilities. By providing the updated information, our application helps the OSS users and developers to be aware of such security issues, and gives them to work in the safer environment from security risks. In addition, our application can be used as a security platform to greatly contribute to preventing potential security incidents not only for companies but also for individual developers.

• Wind and Structures
• /
• v.32 no.3
• /
• pp.249-265
• /
• 2021

As high-rise buildings become more and more slender and flexible, the wind effect has become a major concern to modern buildings. At present, wind engineering for high-rise buildings mainly focuses on the following four issues: wind excitation and response, aerodynamic damping, aerodynamic modifications and proximity effect. Taking these four issues of concern in high-rise buildings as the mainline, this paper summarizes the development history and current research progress of wind engineering for high-rise buildings. Some critical previous work and remarks are listed at the end of each chapter. From the future perspective, the CFD is still the most promising technique for structural wind engineering. The wind load inversion and the introduction of machine learning are two research directions worth exploring.

• Food Science and Preservation
• /
• v.24 no.6
• /
• pp.834-841
• /
• 2017

This study was carried out to investigate the anti-oxidative and anti-inflammatory effects of hot water extracts of Ligularia fischeri cultivated in Youngyanggun. We obtained hot water extract (HWE) and cold water extract (CWE) from L. fischeri. The anti-oxidative activities of L. fischeri extracts were measured by 2,2-diphenyl-1-picrylhydrazyl radical scavenging activity. The anti-inflammatory effects of L. fischeri were evaluated in human mast cell line-1 (HMC-1) cells stimulated with phorbol-12-myristate-13-acetate plus A23187 (PMACI). The solid yields of HWE was 150% higher than CWE solid yield. Total polyphenol contents of HWE were $198.07{\pm}0.24mg/g$. The value of anti-oxidative activities of HWE were shown $IC_{50}$ $28.2{\pm}0.04ug/mL$. We showed that HWE significantly reduced the PMACI-induced the production of IL-6 (0.01-1 mg/mL), IL-8 (0.1-1 mg/mL), and $TNF-{\alpha}$ (0.01-1 mg/mL). These results indicate that the HWE of L. fischeri can be used as a functional material due to its antioxidant and anti-inflammatory activities.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.19 no.12
• /
• pp.863-871
• /
• 2018

Existing vulnerability analysis tools are prone to missed detections, incorrect detections, and over-detection, which reduces accuracy. In this paper, cross-checking based on a vulnerability detection method using static and dynamic analysis is proposed, which develops and manages safe applications and can resolve and analyze these problems. Risks due to vulnerabilities are computed, and an intelligent vulnerability detection technique is used to improve accuracy and evaluate risks under the final version of the application. This helps the development and execution of safe applications. Through incorporation of tools that use static analysis and dynamic analysis techniques, our proposed technique overcomes weak points at each stage, and improves the accuracy of vulnerability detection. Existing vulnerability risk-evaluation systems only evaluate self-risks, whereas our proposed vulnerability risk-evaluation system reflects the vulnerability of self-risk and the detection accuracy in a complex fashion to evaluate relative. Our proposed technique compares and analyzes existing analysis tools, such as lists for detections and detection accuracy based on the top 10 items of SANS at CWE. Quantitative evaluation systems for existing vulnerability risks and the proposed application's vulnerability risks are compared and analyzed. We developed a prototype analysis tool using our technique to test the application's vulnerability detection ability, and to show that our proposed technique is superior to existing ones.