• Proceedings of the Korea Information Processing Society Conference
• /
• 2004.05a
• /
• pp.1287-1290
• /
• 2004

인터넷의 급속한 발전은 지난 수년간 데이터 전송 속도의 고속화, 대용량의 데이터 전송 등을 가져오는 긍정적인 효과를 거두었지만 컴퓨터 시스템의 보안 침해 사고와 같은 역기능 또한 날로 증대되어 그 피해 규모가 점점 심각해지고 있다. 본 논문에서는 IDS의 제어 아래 통계적인 탐지 알고리즘을 이용하여 분산 서비스 거부(DDoS) 공격에 대응할 수 있는 패킷 필터링 구조를 제안한다. 이 구조는 탐지 알고리즘에 의해 DDoS 공격으로 인식된 패킷을 IDS가 탐지하여 필터링 모듈에서 효과적으로 공격을 막을 수 있다.

• The KIPS Transactions:PartC
• /
• v.12C no.6 s.102
• /
• pp.827-838
• /
• 2005

DDoS (Distributed Denial of Service) attack is a critical threat to current Internet. To solve the detection and response of DDoS attack on BcN, we have investigated detection algorithms of DDoS and Implemented anomaly detection modules. Recently too many technologies of the detection and prevention have developed, but it is difficult that the IDS distinguishes normal traffic from the DDoS attack Therefore, when the DDoS attack is detected by the IDS, the firewall just discards all over-bounded traffic for a victim or absolutely decreases the threshold of the router. That is just only a method for preventing the DDoS attack. This paper proposed the mechanism of response for the legitimated clients to be protected Then, we have designed and implemented the statistic based system that has the automated detection and response functionality against DDoS on Linux Zebra router environment.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2010.11a
• /
• pp.1285-1288
• /
• 2010

SIP 프로토콜은 멀티미디어 통신 세션을 생성, 삭제, 변경할 수 있는 프로토콜로 높은 간결성, 확장성 등 장점을 가지고 있다. 최근 인터넷전화의 대부분이 SIP 프로토콜을 사용하는 등 SIP 프로토콜의 사용이 많이 보편화 되었으나 그만큼 보안에 대한 위협 또한 중요한 문제가 되고있다. SIP는 응용계층 프로토콜로, 기존의 IP기반 보안 기술로는 공격 탐지/차단에 한계가 있을 수 있어 SIP 전용의 보안 기술 및 장비의 개발이 필요하다. 본 논문에서는 SIP 트래픽의 응용계층 정보 통계를 통하여 DDoS 공격트래픽 행위 특성을 분석하고 이를 정상 트래픽과 구분, 탐지하는 탐지 기법을 제안한다. 제안된 기법은 자체 테스트 망 구축과 SIP DDoS 공격 에뮬레이션을 통해 검증한다.

• Journal of the Korea Society for Simulation
• /
• v.18 no.4
• /
• pp.39-47
• /
• 2009

Recently, the threat of DDoS attacks is increasing and many companies are planned to deploy the DDoS defense solutions in their networks. The DDoS attack usually transmits heavy traffic data to networks or servers and they cannot handle the normal service requests because of running out of resources. Since it is very hard to prevent the DDoS attack beforehand, the strategic plan is very important. In this work, we have conducted modeling and simulation of the DDoS attack by changing the number of servers and estimated the duration that services are available. In this work, the modeling and simulation is conducted using OPNET Modeler. The simulation result can be used as a parameter of trade-off analysis of DDoS defense cost and the service's value. In addition, we have presented a way of estimating the cost effectiveness in deployment of the DDoS defense system.

• KIPS Transactions on Computer and Communication Systems
• /
• v.4 no.4
• /
• pp.135-140
• /
• 2015

The WDSS improves defensive capacity against web application layer DDoS attack by using web cache server and L7 switch which are added on the DDoS shelter system. When web DDoS attack occurs, security agents divert traffic from backbone network to sub-network of the WDSS and then DDoS protection device and L7 switch block abnormal packets. In the meantime, web cache server responds only to requests of normal clients and maintains stable web service. In this way, the WDSS can counteract the web DDoS attack which generates small traffic and depletes server-client session resource. Furthermore, the WDSS does not require IP tunneling because it is not necessary to retransfer the normal requests to original web server. In this paper, we validate operation of the WDSS and verify defensive capability against web application layer DDoS attacks. In order to do this, we built the WDSS on backbone network of an ISP. And we performed web DDoS tests by using a testing system that consists of zombie PCs. The tests were performed by three types and various amounts of web DDoS attacks. Test results suggest that the WDSS can detect small traffic of the web DDoS attacks which do not have repeat flow whereas the formal DDoS shelter system cannot.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.33 no.3B
• /
• pp.152-158
• /
• 2008

Recently, DDoS (Distributed Denial of Service) attack has emerged as one of the major threats and it's main characteristic is to send flood of data packets toward a specific victim. Thus, several attack detection schemes which monitor the destination IP address of packets have been suggested. The existing Bloom Filter based attack detection scheme is simple and can support real-time monitoring. However, since this scheme monitors the separate fields of destination IP address independently, wrong detection is comparatively high. In this paper, in order to solve this drawback, an efficient Bloom Filter based destination address monitoring scheme is proposed, which monitors not only separate fields but also relationship among separate fields. In the results of simulation, the proposed monitoring scheme outperforms the existing Bloom Filter based detection scheme. Also, to improve the correctness of detection, multi-layerd structure is proposed and the correctness of result is improved according to the number of layers and extra tables.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2009.10a
• /
• pp.375-378
• /
• 2009

DDoS attacks make people can't using normal internet service, because DDoS attacks cause exhaustion of network bandwidth or exhaustion of computer system resources by using many personal computers or servers which already infected computer virus from hackers. Recent DDoS attacks attack government brach, financial institution, even IT security company. IT security companies make Anti-DDoS product for defense from DDoS attack. But, There is no standard for BMT of Anti-DDoS product. In this dissertation, Anti-DDoS product quality characteristics of the survey analysis to evaluate them by comparing the assessment items were derived.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2017.11a
• /
• pp.302-305
• /
• 2017

사이버 공격은 점차 다양해지고, 그 위험성은 날로 심각해지고 있다. 가장 강력한 공격 중 하나는 DDoS (Distributed Denial of Service) 공격이다. 본 논문에서는 다양한 사이버 공격을 분류하고 이에 따른 방법 기법을 서술하겠다. 특히, 최신 DDoS 공격 탐지 방법을 소개하고 딥러닝 (Deep Learning)을 활용한 최신 방어 기법 연구에 대해 살펴보도록 하겠다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.10c
• /
• pp.637-639
• /
• 2003

인터넷이 널리 보급되면서 이용자들간에는 편리하고 빠른 정보교환이 가능하게 되었지만 이를 방해하는 해커들의 활동 또한 크게 증가하고 있다. 그 중 DDoS(Distributed Denial of Service) 공격은 인터넷 서비스를 하고 있는 서버에 심각한 해를 주며 탐지와 대응이 어려운 해킹방법중의 하나이다. 본 연구에서는 DDoS 공격 대응을 위해 액티브 네트워크를 이용해 개발한 DDoS 보안시스템[1][2]을 이용할 때 얼마나 효과적인 성능을 낼 수 있는지에 대한 분석 결과를 제공한다.

• The Korean Journal of Applied Statistics
• /
• v.26 no.2
• /
• pp.291-305
• /
• 2013

Collective traffic data (BPS, PPS etc.) for detection against the distributed denial of service attack on network is the time sequencing big data. The algorithm to detect the change point in the big data should be accurate and exceed in detection time and detection capability. In this work, the sliding window and discretization method is used to detect the change point in the big data, and propose five nonparametric test statistics using empirical distribution functions and ranks. With various distribution functions and their parameters, the detection time and capability including the detection delay time and the detection ratio for five test methods are explored and discussed via monte carlo simulation and illustrative examples.