• The Transactions of the Korea Information Processing Society
• /
• v.13 no.4
• /
• pp.157-165
• /
• 2024

The evolution of the Distributed Denial of Service Attack(DDoS Attack) method has increased the difficulty in the detection process. One of the solutions to overcome the problems caused by the limitations of the existing victim-side detection method was the source-side detection technique. However, there was a problem of performance degradation due to network traffic irregularities. In order to solve this problem, research has been conducted to detect attacks using a collaborative network between several nodes based on artificial intelligence. Existing methods have shown limitations, especially in nonlinear traffic environments with high Burstness and jitter. To overcome this problem, this paper presents a collaborative source-side DDoS attack detection technique introduced with an attention mechanism. The proposed method aggregates detection results from multiple sources and assigns weights to each region, and through this, it is possible to effectively detect overall attacks and attacks in specific few areas. In particular, it shows a high detection rate with a low false positive of about 6% and a high detection rate of up to 4.3% in a nonlinear traffic dataset, and it can also confirm improvement in attack detection problems in a small number of regions compared to methods that showed limitations in the existing nonlinear traffic environment.

• Proceedings of the Korea Contents Association Conference
• /
• 2005.05a
• /
• pp.83-86
• /
• 2005

Recently, demage of denial of service attack and worm attack has grown larger and larger every year. But Research of harmful traffic detection is not sufficient when the IPv4 environment is replaced with the IPv6 environment in near future. The purpose of this paper is attact detection which has been detected harmful traffic monitoring on the IPv6 using the Internet management protocol SNMP.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2009.11a
• /
• pp.679-680
• /
• 2009

Radio jamming attack is the most effective and easiest Denial-of-Service (DOS) attack in wireless network. In this paper, we proposed a multi-channel MAC protocol to mitigate the jamming attacks by using cognitive radio. The Cognitive Radio (CR) technology supports real-time spectrum sensing and fast channel switching. By using CR technologies, the legitimate nodes can perform periodic spectrum sensing to identify jamming free channels and when the jamming attack is detected, it can switch to un-jammed channel with minimum channel switching delay. In our proposed protocol, these two CR technologies are exploited for thwarting the jamming attacks.

• Proceedings of the Korean Information Science Society Conference
• /
• 2004.04a
• /
• pp.310-312
• /
• 2004

분산 서비스 거부 공격(Distributed Denial of Service, DDoS attack)의 목적은 정상적인 사용자가 서비스를 이용하는 것을 거부하는 것이다. 특히 범람 서비스 거부 공격(flooding-based DDoS attack)은 아직까지 방어하기 어려운 공격 형태이다. 그 이유는 공격 시 정상적인 트래픽이 왕복하는 것처럼 보이므로 공격 트래픽과 정상 트래픽을 구별하기 어렵기 때문이다. 하지만, 범람 서비스 거부 공격의 특징을 잘 이용하면 공격을 방어할 수 있다. 범람 서비스 거부 공격의 특징은 단독의 공격 호스트로부터의 트래픽 양이 여러 개의 정상 호스트들로부터의 트래픽 양보다 훨씬 많다는 것이다. 이러한 특징을 이용하여 특정 호스트로부터의 트래픽 양이 많은지 아닌지에 따라 공격이 발생했는지 여부를 결정할 수 있다. 이 논문에서는 Pi(Path Identification) 라는 메커니즘을 이용한 분산 서비스 거부 공격의 방어 기법을 제안한다.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.16 no.4
• /
• pp.737-744
• /
• 2012

Recently VoIP has provided voice(both wired and wireless from IP-based) as well as the transmission of multimedia information. VoIP used All-IP type, Gateway type, mVoIP etc. Wired and wireless VoIP has security vulnerabilities that VoIP call control signals, illegal eavesdropping, service misuse attacks, denial of service attack, as well as wireless vulnerabilities etc. from WiFi Zone. Therefore, the analysis of security vulnerabilities in wired and wireless VoIP and hacking incidents on security measures for research and study is needed. In this paper, VoIP (All-IP type, and for Gateway type) for system and network scanning, and, IP Phone to get the information and analysis of the vulnerability. All-IP type and Gateway type discovered about the vulnerability of VoIP hacking attacks (Denial of Service attacks, VoIP spam attacks) is carried out. And that is a real VoIP system installed and operated in the field of security measures through research and analysis is proposed.

• Journal of Digital Convergence
• /
• v.12 no.1
• /
• pp.423-429
• /
• 2014

DDoS attacks is upgrade of DoS attacks. Botnet is being used by DDoS attack, so it is able to attack a millions of PCs at one time. DDoS attacks find the root the cause of the attack because it is hard to find sources for it, even after the treatment wavelength serious social problem in this study, the analysis and countermeasures for DDoS attack is presented.

• The KIPS Transactions:PartC
• /
• v.18C no.3
• /
• pp.127-134
• /
• 2011

Malicious botnet has been used for more malicious activities, such as DDoS attacks, sending spam messages, steal personal information, etc. To prevent this, many studies have been preceded. But malicious botnets have evolved and evaded detection systems. In particular, HTTP GET Request attack that exploits the vulnerability of the application layer is used. ALAB of ALADDIN proposed by ETRI is DDoS attack detection system that HTTP GET, Incomplete GET request flooding attack detection algorithm is applied. In this paper, we extend Incomplete GET detection algorithm of ALAB and derive the optimal configuration parameters to verify the validity of the algorithm ALAB by the study of the normal and attack packets.

• Journal of Internet Computing and Services
• /
• v.6 no.1
• /
• pp.13-25
• /
• 2005

Distributed Denial-of-Service(DDoS) attack prevent users from accessing services on the target network by spoofing its origin source address with a large volume of traffic. The objective of IP Traceback is to determine the real attack sources, as well as the full path taken by the attack packets. Existing IP Traceback methods can be categorized as proactive or reactive tracing. Existing PPM based tracing scheme(such as router node appending, sampling and edge sampling) insert traceback information in IP packet header for IP Traceback. But, these schemes did not provide enhanced performance in DDoS attack. In this paper, we propose a 'TTL based advanced Packet Marking' mechanism for IP Traceback. Proposed mechanism can detect and control DDoS traffic on router and can generate marked packet for reconstructing origin DDoS attack source, by which we can diminish network overload and enhance traceback performance.

• Journal of Internet Computing and Services
• /
• v.5 no.1
• /
• pp.85-97
• /
• 2004

Distributed Denial-of-Service(DDoS) attack prevent users from accessing services on the target network by spoofing its origin source address with a large volume of traffic. The objective of IP Traceback is to determine the real attack sources, as well as the full path taken by the attack packets. Existing IP Traceback methods can be categorized as proactive or reactive tracing. Proactive tracing(such as packet marking and messaging) prepares information for tracing when packets are in transit. Reactive tracing starts tracing after an attack is detected. In this paper, we propose a "advanced ICMP Traceback" mechanism. which is based on the modified push back system. Proposed mechanism can detect and control DDoS traffic on router and can generate ICMP Traceback message for reconstructing origin attack source.ck source.

• Proceedings of the IEEK Conference
• /
• 1999.11a
• /
• pp.89-92
• /
• 1999

This paper describes on the threats such as IP spoofing, denial of service, and ILMI based attack etc. for IP over ATM network. Especially we discuss on the threats due to ATM characteristics that are VC stealing, multiparty and multi-connection call. Also we investigate on the threats of ATM based MPLS network. Finally we discuss and suggest the various solutions of ATM security.