• The KIPS Transactions:PartA
• /
• v.19A no.4
• /
• pp.187-194
• /
• 2012

This paper proposes a string analysis based system for classifying Android Apps that may access so called harmful sites, and shows an experiment result for real Android apps on the market. The system first transforms Android App binary codes into Java byte codes, it performs string analysis to compute a set of strings at all program points, and it classifies the Android App as bad ones if the computed set contains URLs that are classified because the sites provide inappropriate contents. In the proposed approach, the system performs such a classification in the stage of distribution before installing and executing the Apps. Furthermore, the system is suitable for the automatic management of Android Apps in the market. The proposed system can be combined with the existing methods using DNS servers or monitoring modules to identify harmful Android apps better in different stages.

• Journal of Advanced Navigation Technology
• /
• v.17 no.6
• /
• pp.816-822
• /
• 2013

In modern networks, data rate is getting faster and transferred data is extremely increased. At this point, the malicious codes are evolving to various types very fast, and the frequency of occurring new malicious code is very short. So, it is hard to collect/analyze data using general networks with the techniques like traditional intrusion detection or anormaly detection. In this paper, we collect and analyze the data more effectively with cloud environment than general simple networks. Also we analyze the malicious code which is similar to real network's malware, using botnet server/client includes DNS Spoofing attack.

• The Journal of Internal Korean Medicine
• /
• v.40 no.5
• /
• pp.957-966
• /
• 2019

Carbon monoxide intoxication leads to hypoxia, which eventually leads to tissue ischemia. Delayed neuropsychiatric syndrome (DNS) can be a consequence and appears in the form of cognitive impairment and movement disorders after a lucid interval. A 58-year-old Korean male was admitted to our hospital with delayed neuropsychiatric sequelae (DNS) after an 11-day lucid interval following recovery from acute carbon monoxide intoxication. We treated him with herbal medication, acupuncture, electroacupuncture, and moxibustion. The effects were assessed by the activity index and Mini Mental State Examination-Korea (MMSE-K) scores, and by changes in gait disturbance. In this case, the clinical symptoms, including gait disturbance, and the activity index and MMSE-K scores, improved after traditional Korean treatment. The findings of this case report suggest that traditional Korean medicine treatment can be effective for treatment of symptoms of delayed neuropsychiatric sequelae due to CO intoxication.

• The Journal of Korea Institute of Information, Electronics, and Communication Technology
• /
• v.13 no.6
• /
• pp.539-544
• /
• 2020

The research is on progressing to operate digital door lock with the method to guarantee the security and safety in the meantime to use digital door lock conveniently using Internet of Things (IoT) standardizing various service providing technology using IoT in home network currently. In this study, compose home network interconnecting Raspberry-PI and web server reflection this trend and composed the system to control the door lock after connect Arduino substituting converter function. Making Raspberry-PI using dynamic IP address using existing open source easily maintain DNS information and possible to connect internet network in home network ethernet and finally, making the smartphone can control door lock remotely entering designated address after connect the internet. The connection between home network and Arduino is executed by Raspberry-PI and bluetooth pairing as 1:1 and make random user's access to be impossible. Especially, to make open/close the door lock with smartphone not by using password on the keypad or using RFID card is judged as the method increasing the security make random user's access to be impossible and also increased the usefulness making remote control to be possible.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.19 no.1
• /
• pp.113-124
• /
• 2009

Recently, lots of anti-phishing schemes have been developed. Several products identify phishing sites and show the results on the address bar of the internet browser, but they determine only by domain names or IP addresses. Although this kind of method is effective against recent DNS pharming attacks, there is still a possibility that hidden attacks which modifies HTML codes could incapacitate those anti-phishing programs. In this paper, the cognitive approach which compares images to decide phishing or pharming is presented, using system tray and balloon tips that are hard to fake with pop-ups or flash in order for users to compare pictures from connecting sites and system tray. It differs from an old method that a program analyzes IP or domains to judge if it is phishing or pharming, but observes if there were HTML code changing between plug-ins and a server.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.15 no.5
• /
• pp.35-45
• /
• 2005

There has recently been an increase of phishing attacks, attacks which lure users into revealing their personal information to an attacker who in turn exploits this information for economic gain. The conventional methods of fooling the user with similarly modified mail or address are constantly evolving and have diversified to include the forgery of mail or domain addresses. Recently the injury incurred by these attacks has greatly increased as attackers exploit the weaknesses found on a few web browsers and used these to conduct phishing attacks based on URL spoofing. Furthermore we are now witnessing the entrance of highly advanced phishing techniques that no longer simply rely on vulnerabilities, but employ ordinary script, HTML, DNS sniffing, and the list goes on. In this paper we first discuss means of investigating and preventing the advanced URL spoofing techniques used in phishing attacks, and then propose a scheme for fundamentally restricting them altogether.

• KNOM Review
• /
• v.24 no.2
• /
• pp.13-23
• /
• 2021

Recently, as networks become more complex due to the activation of IoT devices, research on long-term traffic prediction beyond short-term traffic prediction is being activated to predict and prepare for network congestion in advance. The recursive strategy, which reuses short-term traffic prediction results as an input, has been extended to multi-step traffic prediction, but as the steps progress, errors accumulate and cause deterioration in prediction performance. In this paper, an LSTM-based multi-step traffic prediction method using a multi-output strategy is introduced and its performance is evaluated. As a result of experiments based on actual DNS request traffic, it was confirmed that the proposed LSTM-based multiple output strategy technique can reduce MAPE of traffic prediction performance for non-stationary traffic by 6% than the recursive strategy technique.

• KNOM Review
• /
• v.23 no.1
• /
• pp.10-17
• /
• 2020

As the threat of Distributed Denial-of-Service attacks that exploit weakly secure IoT devices has spread, research on source-side Denial-of-Service attack detection is being activated to quickly detect the attack and the location of attacker. In addition, a collaborative source-side attack detection technique that shares detection results of source-side networks located at individual sites is also being activated to overcome regional limitations of source-side detection. In this paper, we evaluate the performance of a collaborative source-side DDoS attack detection using statistical weights. The statistical weight is calculated based on the detection rate and false positive rate corresponding to the time zone of the individual source-side network. By calculating weighted sum of the source-side DoS attack detection results from various sites, the proposed method determines whether a DDoS attack happens. As a result of the experiment based on actual DNS request to traffic, it was confirmed that the proposed technique reduces false positive rate 2% while maintaining a high attack detection rate.

• Journal of the Korea Society for Simulation
• /
• v.19 no.1
• /
• pp.153-160
• /
• 2010

Most part of errors in software development process are included during the stage of requirements definition and design. And correction or elimination of errors from those stages requires much more efforts and costs than those from the later part of software development process. However, despite of the importance of the validation of requirement definition and design stages, several kinds of problem have made it hard to be done successfully. Therefore, in this paper, we introduce a novel validation process for the preliminary design stage. The validation process is based on simulations of model and it can be used to validate requirements and model simultaneously. Models in the validation process will take only the behavior of software and be built on Ptolemy framework. The usability of our validation process is confirmed with a case study over DNS system environment. And the result of simulation shows well-known errors or vulnerabilities can be found with simulations of model which has the behavior of software. This means our validation process can be used as a process to validate requirements and models during the early stage of software development process.

• KNOM Review
• /
• v.22 no.1
• /
• pp.42-51
• /
• 2019

Recently, the amount of internet traffic is increasing due to the increase in speed and capacity of the network environment, and protocol data is increasing due to mobile, IoT, application, and malicious behavior. Most of these private protocols are unknown in structure. For efficient network management and security, analysis of the structure of private protocols must be performed. Many protocol reverse engineering methodologies have been proposed for this purpose, but there are disadvantages to applying them. In this paper, we propose a methodology for inferring a detailed protocol structure based on network trace analysis by hierarchically combining CSP (Contiguous Sequential Pattern) and SP (Sequential Pattern) Algorithm. The proposed methodology is designed and implemented in a way that improves the preceeding study, A²PRE, We describe performance index for comparing methodologies and demonstrate the superiority of the proposed methodology through the example of HTTP, DNS protocol.