• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.18 no.5
• /
• pp.1273-1300
• /
• 2024

In the complex virtual environment of cyberspace, comprised of digital and communication networks, ensuring the security of information is being recognized as an ongoing challenge. The importance of 'Cyber Situation Awareness (CSA)' is being emphasized in response to this. CSA is understood as a vital capability to identify, understand, and respond to various cyber threats and is positioned at the heart of cyber security strategies from a defensive perspective. Critical industries such as finance, healthcare, manufacturing, telecommunications, transportation, and energy can be subjected to not just economic and societal losses from cyber threats but, in severe cases, national losses. Consequently, the importance of CSA is being accentuated and research activities are being vigorously undertaken. A systematic five-step approach to CSA is introduced against this backdrop, and a deep analysis of recent research trends, techniques, challenges, and future directions since 2019 is provided. The approach encompasses current situation and identification awareness, the impact of attacks and vulnerability assessment, the evolution of situations and tracking of actor behaviors, root cause and forensic analysis, and future scenarios and threat predictions. Through this survey, readers will be deepened in their understanding of the fundamental importance and practical applications of CSA, and their insights into research and applications in this field will be enhanced. This survey is expected to serve as a useful guide and reference for researchers and experts particularly interested in CSA research and applications.

• Journal of Internet Computing and Services
• /
• v.23 no.5
• /
• pp.111-126
• /
• 2022

As operations that were only conducted in physical space in the past change to operations that include cyberspace, it is necessary to analyze how cyber attacks affect weapon systems using cyber systems. For this purpose, it would be meaningful to analyze a tool that analyzes the effects of physical weapon systems in connection with cyber. The ROK military has secured and is operating the US JMEM, which contains the results of analyzing the effects of physical weapon systems. JMEM is applied only to conventional weapon systems, so it is impossible to analyze the impact of cyber weapon systems. In this study, based on the previously conducted cyber attack damage assessment framework, a framework for analyzing the impact of cyber attacks on physical missions was presented. To this end, based on the MOE and MOP of physical warfare, a cyber index for the analysis of cyber weapon system effectiveness was calculated. In addition, in conjunction with JMEM, which is used as a weapon system effect manual in physical operations, a framework was designed and tested to determine the mission impact by comparing and analyzing the results of the battle in cyberspace with the effects of physical operations. In order to prove the proposed framework, we analyzed and designed operational scenarios through domestic and foreign military manuals and previous studies, defined assets, and conducted experiments. As a result of the experiment, the larger the decrease in the cyber mission effect value, the greater the effect on physical operations. It can be used to predict the impact of physical operations caused by cyber attacks in various operations, and it will help the battlefield commander to make quick decisions.

• Journal of IKEEE
• /
• v.22 no.2
• /
• pp.242-249
• /
• 2018

In this paper, we identify the code vulnerabilities that can be automatically detected through Visual Studio (VS) compiler and code analyzer based on a secure coding rule set which is optimized for development of battlefield information system. Then we describe a weak point item that can be dealt with at the implementation stage without depending on the understanding or ability of the individual programmer's secure coding through the implementation of the secure coding library. Using VS compiler and the code analyzer, the developers can detect only about 38% of security weaknesses. But with the help of the proposed secure coding library, about 48% of security weaknesses can be detected and prevented in the proactive diagnosis in the development stage.

• Journal of Internet Computing and Services
• /
• v.22 no.6
• /
• pp.115-127
• /
• 2021

With the development of science and technology around the world, the realm of cyberspace, following land, sea, air, and space, is also recognized as a battlefield area. Accordingly, it is necessary to design and establish various elements such as definitions, systems, procedures, and plans for not only physical operations in land, sea, air, and space but also cyber operations in cyberspace. In this research, the importance of cyber targets that can be considered when prioritizing the list of cyber targets selected through intermediate target development in the target development and prioritization stage of targeting processing of cyber operations was selected as a factor to be considered. We propose a method to calculate the score for the cyber target and use it as a part of the cyber target prioritization score. Accordingly, in the cyber target prioritization process, the cyber target importance category is set, and the cyber target importance concept and reference item are derived. We propose a TIR (Target Importance Rank) algorithm that synthesizes parameters such as Event Prioritization Framework based on PageRank algorithm for score calculation and synthesis for each derived standard item. And, by constructing the Stuxnet case-based network topology and scenario data, a cyber target importance score is derived with the proposed algorithm, and the cyber target is prioritized to verify the proposed algorithm.

• Convergence Security Journal
• /
• v.13 no.4
• /
• pp.77-83
• /
• 2013

As the network composed of numerous sensor nodes, sensor network conducts the function of sensing the surrounding information by sensor and of the sensed information. The concept of the battlefield is also changing to one that includes not only physical spaces but all areas including the networks of the nation's key industries and military facilities, energy facilities, transportation, and communication networks. In light of the changing warfare in terms of how it is conducted and what form it takes, the Korea military has to seek ways to effectively respond to threats of cyber warfare. In the past, although partial strategies on cyber warfare were studied, no research was done through the overall system flow. In this paper, key variables related to cyber warfare security are classified into personnel, management, and technology. A simple model and an extended model are suggested for each area, and based on the technology area of the extended model, formal methods are used to verify the validity and a detailed response strategy is suggested according to the identified leverage.

• Journal of Internet Computing and Services
• /
• v.23 no.5
• /
• pp.87-101
• /
• 2022

Cyber-attacks occur in the blink of an eye in cyberspace, and the damage is increasing all over the world. Therefore, it is necessary to develop a cyber common operational picture that can grasp the various assets belonging to the 3rd layer of cyberspace from various perspectives. By applying the method for grasping battlefield information used by the military, it is possible to achieve optimal cyberspace situational awareness. Therefore, in this study, the visualization screens necessary for the cyber common operational picture are identified and the criteria (response speed, user interface, object symbol, object size) are investigated. After that, the framework is designed by applying the identified and investigated items, and the visualization screens are implemented accordingly. Finally, among the criteria investigated by the visualization screen, an experiment is conducted on the response speed that cannot be recognized by a photograph. As a result, all the implemented visualization screens met the standard for response speed. Such research helps commanders and security officers to build a cyber common operational picture to prepare for cyber-attacks.

• Convergence Security Journal
• /
• v.22 no.1
• /
• pp.99-111
• /
• 2022

With current battlefield environment relying heavily on Network Centric Warfare(NCW), existing weaponary systems are evolving into a new concept that converges IT technology. Majority of the weaponary systems are implemented with numerous embedded softwares which makes such softwares a key factor influencing the performance of such systems. Furthermore, due to the advancements in both IoT technoogies and embedded softwares cyber threats are targeting various embedded systems as their scope of application expands in the real world. Weaponary systems have been developed in various forms from single systems to interlocking networks. hence, system level cyber security is more favorable compared to application level cyber security. In this paper, a secure real-time operating system has been designed, implemented and measured to protect embedded softwares used in weaponary systems from unknown cyber threats at the operating system level.

• Journal of Internet Computing and Services
• /
• v.22 no.6
• /
• pp.99-113
• /
• 2021

In these days, as cyberspace has been recognized as the fifth battlefield area following the land, sea, air, and space, attention has been focused on activities that view cyberspace as an operational and mission domain in earnest. Also, in the 21st century, cyber operations based on cyberspace are being developed as a 4th generation warfare method. In such an environment, the success of the operation is determined by the commander's decision. Therefore, in order to increase the rationality and objectivity of such decision-making, it is necessary to systematically establish and select a course of action (COA). In this study, COA is established by using the method of classifying operational elements necessary for cyber operation, and it is intended to suggest a direction for quantitative evaluation of COA. To this end, we propose a method of composing the COES (Cyber Operational Elements Set), which becomes the COA of operation, and classifying the cyber operational elements identified in the target development process based on the 5W1H Method. In addition, by applying the proposed classification method to the cyber operation elements used in the STUXNET attack case, the COES is formed to establish the attack COAs. Finally, after prioritizing the established COA, quantitative evaluation of the policy was performed to select the optimal COA.

• Convergence Security Journal
• /
• v.22 no.2
• /
• pp.131-141
• /
• 2022

Future battlefield domains are expanding to ground, sea, air, space, and cyber, so future military operations are expected to be carried out simultaneously and complexly in various battlefield domains. In addition, the application of convergence technologies that create innovations in all fields of economy, society, and defense, such as artificial intelligence, IoT, and big data, is being promoted. However, since the current Korean military C4I system manages warfighting function DBs in one DB server, the efficiency of combat performance is reduced utilization and distribution speed of data and operation response time. To solve this problem, research is needed on how to apply the 4th industrial revolution technologies such as AI, IoT, 5G, big data, and cloud to the Korean military C4I system, but research on this is insufficient. Therefore, this paper analyzes the problems of the current Korean military C4I system and proposes to apply the 4th industrial revolution technology in terms of operational mission, network and data link, computing environment, cyber operation, interoperability and interlocking capabilities.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2013.10a
• /
• pp.165-168
• /
• 2013

The USA has declared the cyber space as the 5th battlefield following land, sea, air, and space. In contrast to physical wars, in national cyberwarfare differentiation between friend and foe is impossible, and the boundaries between the lines of attack and defense are obscure. Therefore, to perform national cyberwarfare, credibility of all command delivery information performed in the cyber space should be confirmed. In this paper, the authors have determined the commands performed in national cyberwarfare, granted authorized IPv6 in space including the earth, moon and Mars for information credibility, and used LINK joints loaded with stealth functions to secure the credibility of command information.