• The Journal of the Korea institute of electronic communication sciences
• /
• v.8 no.12
• /
• pp.1849-1856
• /
• 2013

DOS attack, the short of Denial of Service attack is an internet intrusion technique which harasses service availability of legitimate users. To respond the DDoS attack, a lot of methods focusing attack source, target and intermediate network, have been proposed, but there have not been a clear solution. In this paper, we purpose the prevention of malicious activity and early detection of DDoS attack by detecting and removing the activity of botnets, or other malicious codes. For the purpose, the proposed method monitors the network traffic, especially DSN traffic, which is originated from botnets or malicious codes.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.1
• /
• pp.147-153
• /
• 2015

Since the DoS(Denial of Service) attack is still an important vulnerable element in many web service sites, sites including public institution should try their best in constructing defensive systems. Recently, DDoS(Distributed Denial of Service) has been raised by prompting mass network traffic that uses NTP's monlist function or DoS attack has been made related to the DNS infrastructure which is impossible for direct defense. For instance, in June 2013, there has been an outbreak of an infringement accident where Computing and Information Agency was the target. There was a DNS application DoS attack which made the public institution's Information System impossible to run its normal services. Like this, since there is a high possibility in having an extensive damage due to the characteristics of DDoS in attacking unspecific information service and not being limited to a particular information system, efforts have to be made in order to minimize cyber threats. This thesis proposes a method for using TTL (Time To Live) value in IP header to detect DDoS attack with IP spoofing, which occurs when data is transmitted under the agreed regulation between the international and domestic information system.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.6 no.4
• /
• pp.95-105
• /
• 2010

DNS(Domain Name System) is a huge distributed database that converts host name to IP address. We are expecting the importance of DNS is more increased because many Internet application services appear according to the continuous increase of Internet users and nearly all the Internet application services use DNS. To prevent the interruption of DNS service, DNS server is configured with primary DNS server and a secondary DNS server which takes the place of primary DNS server in case of the service interruption. But this scheme is difficult for providing DNS service constantly in case of DDoS attack, which brings about much network load or network problems in DNS server group. Therefore, This paper proposed the scheme to locally distribute load of DNS server, and the use of address system to group the distributed DNS servers. Also, it proposed the authentication scheme of the correspondent server in case the server is changed in DNS server group having grouping address. In this paper, it is shown that the prosed scheme guarantees the improved service reliability with maintaining the present service performance through the evaluation. Through this, we can expect the high improved DNS service can be provided in the Internet environment in the future.

• Journal of Convergence for Information Technology
• /
• v.10 no.12
• /
• pp.22-30
• /
• 2020

With the development of information and communication technology, DDoS and DRDoS continue to become security issues, and gradually develop into advanced techniques. Recently, IT companies have been threatened with DRDoS technology, which uses protocols from normal servers to exploit as reflective servers. Reflective traffic is traffic from normal servers, making it difficult to distinguish from security equipment and amplified to a maximum of Tbps in real-life cases. In this paper, after comparing and analyzing the DNS amplification and Memcached amplification used in DRDoS attacks, a countermeasure that can reduce the effectiveness of the attack is proposed. Protocols used as reflective traffic include TCP and UDP, and NTP, DNS, and Memcached. Comparing and analyzing DNS protocols and Memcached protocols with higher response sizes of reflective traffic among the protocols used as reflective traffic, Memcached protocols amplify ±21% more than DNS protocols. The countermeasure can reduce the effectiveness of an attack by using the Memcached Protocol's memory initialization command. In future studies, various security-prone servers can be shared over security networks to predict the fundamental blocking effect.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2013.05a
• /
• pp.683-686
• /
• 2013

최근 인터넷을 이용한 금융거래가 활발해지면서 피싱이나 파밍과 같은 공격을 통한 개인정보 유출 사고가 빈번히 발생하고 있다. 특히 파밍의 경우, 공격자가 DNS 정보를 변조하여 사용자가 올바른 URL을 입력하더라도 악의적 사이트로 컴퓨터가 접속을 하기 때문에 위험성이 매우 높다. 이러한 공격들을 방지하기위하여 여러 연구가 진행되었지만, DNS 정보의 검증을 위한 추가적인 절차를 필요로 하거나 과도한 네트워크 트래픽을 유발할 수 있는 문제점을 가지고 있다. 따라서 본 논문에서는 이러한 문제점을 극복하고자 DNS 리소스 레코드(Resource Record)의 부분 암호화를 이용하여 DNS 변조 공격을 탐지 하는 프로토콜을 제안한다.

• Convergence Security Journal
• /
• v.12 no.6
• /
• pp.101-106
• /
• 2012

As the existing strategy of preventing DDoS(Distributed Denial of Service) attacks has limitations, this study is intended to suggest the more effective method of preventing DDoS attacks which reduces attack power and distributes attack targets. Currently, DDoS attacks have a wide range of targets such as individuals, businesses, labs, universities, major portal sites and financial institutions. In addition, types of attacks change from exhausting layer 3, network band to primarily targeting layer 7. In response to DDoS attacks, this study suggests how to distribute and decrease DDoS threats effectively and efficiently using Proxy Server Group and Dynamic DNS.

• The KIPS Transactions:PartD
• /
• v.16D no.6
• /
• pp.921-926
• /
• 2009

Vulnerabilities in software can result in many social and economic problems once it has already been deployed and put to use. Thus, the vulnerabilities should be seriously taken into consideration from the beginning step of software development. A modeling and simulation method for software can be adopted as a testing tool for establishing vulnerability inspection strategies. For verification of usability of this strategy, in this paper, we modeled the behavior of a DNS system using Ptolemy and the simulation was performed. The result shows that a well-known vulnerability of DNS server could be effectively found, which confirms that the modeling and simulation can be used for vulnerability testing.

• KNOM Review
• /
• v.23 no.1
• /
• pp.10-17
• /
• 2020

As the threat of Distributed Denial-of-Service attacks that exploit weakly secure IoT devices has spread, research on source-side Denial-of-Service attack detection is being activated to quickly detect the attack and the location of attacker. In addition, a collaborative source-side attack detection technique that shares detection results of source-side networks located at individual sites is also being activated to overcome regional limitations of source-side detection. In this paper, we evaluate the performance of a collaborative source-side DDoS attack detection using statistical weights. The statistical weight is calculated based on the detection rate and false positive rate corresponding to the time zone of the individual source-side network. By calculating weighted sum of the source-side DoS attack detection results from various sites, the proposed method determines whether a DDoS attack happens. As a result of the experiment based on actual DNS request to traffic, it was confirmed that the proposed technique reduces false positive rate 2% while maintaining a high attack detection rate.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2013.05a
• /
• pp.655-658
• /
• 2013

최근 피싱의 한 유형으로 등장한 파밍은 웹 사이트를 위조하여 개인정보를 탈취하는 공격이다. 신뢰받는 기관(금융, 정부 등)의 사이트로 위장하여 개인정보를 탈취하는 방식은 같으나 차이점은 피싱의 경우 유사 도메인을 이용하는 경우가 많아 사용자가 주의를 기울이면 공격을 피할 수 있다. 하지만, 파밍의 경우 DNS 스푸핑을 이용하여 사용자가 정확한 도메인주소(URL)를 입력 하더라도 공격자가 미리 만들어둔 위장 웹 서버로 접속이 되기 때문에 사용자가 주의 깊게 살펴보아도 공격을 인지하기 어렵다. 본 논문에서는 파밍 공격에 사용되는 DNS 스푸핑에 대해 논의하고 파밍 탐지기법에 대해 소개한다. 궁극적으로는 파밍 탐지기법들을 비교 및 분석한 후 실제 구현을 위해서 극복해야 할 한계점을 알아본다.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2015.10a
• /
• pp.262-265
• /
• 2015

In modern society, the spread of computers and smart phones, the Internet has become part of life. Therefore, the most places, wired/wireless router is installed. Crackers can attack the user to use the router by exploiting network vulnerabilities. therefore, the administrator is able to try cracker variety of attacks sloppy router, vaccine is installed also computer and smartphone users, appearance and address of the usual Internet is not deer medium and similar. In this paper, we look at a method for preventing in each attack seen for typical network attacks.