• Convergence Security Journal
• /
• v.9 no.4
• /
• pp.43-53
• /
• 2009

In the information society, information security is a critical issue for defense cyber network system. This paper provides a result of a study on the defense cyber exercise system for cyber warfare. So far, defense cyber exercise system has been uneffective and is not systematic even if several exercises has been implemented. In order to overcome these problems, a systematic and integrated cyber exercise process is suggested. Under the suggested system, we expect that cyber exercise for cyber warfare will be implemented with more effective manner.

• Journal of the Korea Society for Simulation
• /
• v.13 no.3
• /
• pp.11-20
• /
• 2004

The major objective of this paper is to perform modeling of cyber attack and defense using vulnerability metrics. To do this, we have attempted command level modeling for realizing an approach of functional level proposed by Nong Ye, and we have defined vulnerability metrics that are able to apply to DEVS(Discrete Event System Specification) and performed modeling of cyber attack and defense using this. Our approach is to show the difference from others in that (i) it is able to analyze behaviors of systems being emerged by interaction between functional elements of network components, (ii) it is able to analyze vulnerability in quantitative manner, and (iii) it is able to establish defense suitably by using the analyzed vulnerability. We examine an example of vulnerability analysis on the cyber attack and defense through case study.

• Proceedings of the Korea Society for Simulation Conference
• /
• 2003.06a
• /
• pp.191-198
• /
• 2003

The major objective of this paper is to perform modeling of cyber attack and defense using vulnerability metrics. To do this, we have attempted command level modeling for realizing an approach of functional level proposed by Nong Ye, and we have defined vulnerability metrics that are able to apply to DEVS(Discrete Event System Specification) and performed modeling of cyber attack and defense using this. Our approach is to show the difference from others in that (ⅰ) it is able to analyze behaviors of system emerged by interaction with functional elements of components composing network and each other, (ⅱ) it is able to analyze vulnerability in quantitative manner, and (ⅲ) it is able to establish defense suitably by using the analyzed vulnerability. We examine an example of vulnerability analysis on the cyber attack and defense through case study.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.5
• /
• pp.805-821
• /
• 2020

Cyber defense exercise should require training on the latest cyber attacks and have a similar process to defense cyber attacks. In addition, it is also important to train on cyber resilience that can perform normal tasks or support equivalent tasks regardless of cyber attacks. In this paper, we proposed and developed a cyber range that can strengthen the elements of cyber resilience by performing cyber defense exercise in real time based on the cyber crisis alert issued when a cyber attack occurs in Korea. When BLUE, YELLOW, ORANGE, and RED warnings are issued according to the cyber crisis, our system performs proactive response, real time response, and post response according to the alarm. It can improve trainee's capability to respond to cyber threats by performing cyber defense exercise in a cyber crisis environment similar to the actual situation of Korea.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.5
• /
• pp.1153-1165
• /
• 2019

Recently, threats of hacking have been increasing on the national intelligence service network and key infrastructure, including the defense field. The defense information system responds to threats from the outside through the network separation, but if the defense information system is hacked, it has a serious impact on the operations of wartime or peacetime military forces. Today, cyberattacks and threats are rising to unpredictable levels and making it practically impossible to completely block and prevent hacking threats completly. So, in this study proposed a maturity model to assess the level of cyber-resilience, which is the ability to ensure the system's viability and maintain continuity through rapid response and recovery if signs of cyberattacks by the defense information system are expected or occurred. The proposed maturity model is expected to contribute to improving the cyber security level of the defense information system by assessing the level of cyber resilience of the defense information system and identifying and supplementing fields that are lacking.

• Journal of Internet Computing and Services
• /
• v.16 no.5
• /
• pp.1-9
• /
• 2015

As attacks in cyber space become advanced and complex, monotonous defense approach of one-one matching manner between attack and defense may be limited to defend them. More efficient defense method is required. This paper proposes multi layers security scheme that can support to defend assets against diverse cyber attacks in systematical and adaptive. We model multi layers security scheme based on Defense Zone including several defense layers and also discuss essential technical elements necessary to realize multi layers security scheme such as cyber threats analysis and automated assignment of defense techniques. Also effects of multi layers security scheme and its applicability are explained. In future, for embodiment of multi layers security scheme, researches about detailed architecture design for Defense Zone, automated method to select the best defense technique against attack and modeling normal state of asset for attack detection are needed.

• Convergence Security Journal
• /
• v.20 no.4
• /
• pp.91-101
• /
• 2020

We analyzed APT attack cases that occurred overseas in the past using a cyber kill chain model and a TTP model. As a result of the analysis, we found that the cyber kill chain model is effective in figuring out the overall outline, but is not suitable for establishing a specific defense strategy, however, TTP model is suitable to have a practical defense system. Based on these analysis results, it is suggested that defense technology development which is based on TTP model to build defense-in-depth system for preparing cyber attacks.

• Journal of Internet Computing and Services
• /
• v.24 no.6
• /
• pp.107-117
• /
• 2023

It must be possible to assess how combat actions taking place in cyberspace affect the military's major mission systems and weapon systems. In order to analyze the mission impact caused by a cyber attack through cyber M&S, the target mission system and cyber warfare elements must be built as a model and a scenario for simulation must be authored. Many studies related to mission impact analysis due to cyber warfare have been conducted focusing on the United States, and existing studies have authored separate scenarios for physical battlefields and cyber battlefields. It is necessary to build a simulation environment that combines a physical battlefield model and a cyber battlefield model, and be able to integrate and author mission scenarios and cyber attack/defense scenarios. In addition, the physical battlefield and cyber battlefield are different work areas, so authoring two types of scenarios for simulation is very complicated and time-consuming. In this paper, we propose a method of using mission system information to prepare the data needed for scenario authoring in advance and using the pre-worked data to author an integrated scenario. The proposed method is being developed by reflecting it in the design of the scenario authoring tool, and an integrated scenario authoring in the field of counter-fire warfare is being performed to prove the proposed method. In the future, by using a scenario authoring tool that reflects the proposed method, it will be possible to easily author an integrated scenario for mission impact analysis in a short period of time.

• Journal of Internet Computing and Services
• /
• v.23 no.6
• /
• pp.1-13
• /
• 2022

As the information and communication environment develops, the environment of military facilities is also development remarkably. In proportion to this, cyber threats are also increasing, and in particular, APT attacks, which are difficult to prevent with existing signature-based cyber defense systems, are frequently targeting military and national infrastructure. It is important to identify attack groups for appropriate response, but it is very difficult to identify them due to the nature of cyber attacks conducted in secret using methods such as anti-forensics. In the past, after an attack was detected, a security expert had to perform high-level analysis for a long time based on the large amount of evidence collected to get a clue about the attack group. To solve this problem, in this paper, we proposed an automation technique that can classify an attack group within a short time after detection. In case of APT attacks, compared to general cyber attacks, the number of attacks is small, there is not much known data, and it is designed to bypass signature-based cyber defense techniques. As an attack model, we used MITRE ATT&CK® which modeled many parts of cyber attacks. We design an impact score considering the versatility of the attack techniques and proposed a group similarity score based on this. Experimental results show that the proposed method classified the attack group with a 72.62% probability based on Top-5 accuracy.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.4
• /
• pp.985-994
• /
• 2016

Since the inauguration of Defense Acquisition Program Administration(DAPA) in 2006, the national defense core technology research & development business has not only pertained to the weapons systems development but also to the improvement of the national science & technology capability via the acquisition of cutting-edge technologies. Furthermore, it has been closely related to the promotion of the defense industry and the mutual improvements of defense and civil technologies. The cyber warfare weapon system, a newly added national defense weapon system field since 2015, has become a promising weapon system branch for improving the national defense power as well as the national defense industry as shown in the case of Israel. By utilizing the existing result of the national defense core technology level, in order to establish the direction of technology planning of the cyber warfare weapon system, this paper analyzes the technology level and features of the cyber warfare weapon system in various aspects via comparisons with other weapons systems. The result of these analyses shows that the cyber warfare weapon system possesses a relatively high technology level due to the technology accumulation in the civilian sector while the relatively slow inclusion to the national weapons systems and the lack of the correspondence case regarding aggressive cyber responses in the defense sector yields a relatively low national rank. However, the technological gap between South Korea and the most advanced country in the field of cyber warfare technology is analyzed to be among the lowest, which indicates that with efficient and effective pursuits in terms of pthe weapons systems acquisitions as well as the core technologies research & development business, an outstanding cyber warfare capacity can be obtained in a short time.