• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2009.10a
• /
• pp.363-367
• /
• 2009

From the recent, an big issue of the internet attack is DDoS(Distributed Denial of Service). Some government agencies and companies will buy Anti-DDoS SW for protect their their network system form DDoS attack. But We don't have any objective valuation standard of Anti-DDoS SW. So When you try to buy an Anti-DDoS SW, you can get only subjective Anti-DDoS SW information which from Anti-DDoS SW vender. Anti-DDoS SW market is getting bigger, so market needs objective valuation standard of Anti-DDoS SW for a fair evaluation. In this paper, we describe a part of Anti-DDoS SW performance tests in valuation standard of Anti-DDoS SW.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.34 no.5
• /
• pp.1059-1071
• /
• 2024

The 5G mobile network provides various services to numerous devices and applications, unlike LTE which focuses on smartphones. Features of 5G, such as low latency and massive connectivity, increase the overhead of the control plane(CP, signaling part) and make it difficult to detect abnormal devices due to random traffic patterns. In this paper, we propose a DBSCAN clustering-based detection method to counter signaling attacks, which are a type of 'Denial of Service(DoS)' attack targeting mobile networks. DBSCAN helps to create clusters of various shapes and can address dynamic traffic because the algorithm needs not to depend on past traffic statistics. We also use a real-time traced dataset for experiments to assess usability in real-world scenarios. According to the experiments, our method achieves 99.32% of accuracy and 0.03% of false-positive rates, demonstrating superior performance compared to previous works.

• Journal of the Korea Society of Computer and Information
• /
• v.15 no.4
• /
• pp.19-25
• /
• 2010

In this paper, the performance of the DoS information security algorithm is evaluated to provide the multimedia traffic between the nodes using the multicasting services. The essence technology for information security to distribute the multimedia contents is presented. Under the multicasting services, a node participating new group needs a new address and the node compares the collision with the existing nodes, then DoS attack can be occurred between the nodes by a malicious node. Using the NS2 simulator, the number of DoS attacks, the average number of trials to generate new address, and the average time to create address are analyzed. From simulation results, the efficient algorithm with relevant random number design according to the DRM network is needed to provide secure multimedia contents distribution.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.29 no.4C
• /
• pp.559-569
• /
• 2004

It has become more difficult to correspond an cyber attack quickly as a pattern of attack becomes various and complex. And, current security mechanisms just have passive defense functionalities. In this paper, we propose new network security architecture to respond various cyber attacks rapidly and to chase and isolate the attackers through cooperation between security zones. The proposed architecture make possible to deal effectively with cyber attacks such as IP spoofing or DDoS(Distributed Denial of Service) using active packet technology including a mobile sensor on active network. Active Security Management System based on proposed security architecture consists of active security node and active security server in a security zone, and is designed to have more active correspondent than that of existing mechanisms. We implemented these mechanisms in Linux routers and experimented on a testbed to verify realization possibility of Active Security Management System. The experimentation results are analyzed.

• The Journal of Society for e-Business Studies
• /
• v.17 no.3
• /
• pp.117-128
• /
• 2012

There was a large scale of DDoS(Distributed Denial of Service) attacks mostly targeted at Korean government web sites and cooperations's on March 4, 2010(3.4 DDoS attack) after 7.7 DDoS on July 7, 2009. In these days, anyone can create zombie PCs to attack someone's website with malware development toolkits and farther more improve their knowledge of hacking skills as well as toolkits because it has become easier to obtain these toolkits on line, For that trend, it has been difficult for computer security specialists to counteract DDoS attacks. In this paper, we will introduce an essential control list to prevent malware infection with live forensics techniques after analysis of monitoring network systems and PCs. Hopefully our suggestion of how to coordinate a security monitoring system in this paper will give a good guideline for cooperations who try to build their new systems or to secure their existing systems.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.10 no.12
• /
• pp.5572-5595
• /
• 2016

Multi-server authentication enables the subscribers to enjoy an assortment of services from various service providers based on a single registration from any registration centre. Previously, a subscriber had to register from each service provider individually to avail respective services relying on single server authentication. In the past, a number of multi-server authentication techniques can be witnessed that employed lightweight and even computationally intensive cryptographic operations. In line with this, Zhu has presented a chaotic map based multi-server authentication scheme recently, which is not only vulnerable to denial-of-service attack, stolen-verifier attack, but also lacks anonymity. This research aims at improving the Zhu's protocol in terms of cost and efficiency. Moreover, the comparative study is presented for the performance of improved model against the existing scheme, and the security of proposed model is formally proved using BAN Logic.

• Journal of the Korea Society for Simulation
• /
• v.11 no.2
• /
• pp.1-16
• /
• 2002

The need for network security is being increasing due to the development of information communication and internet technology. In this paper, firewall models, operating system models and other network component models are constructed. Each model is defined by basic or compound model, referencing DEVS formalism. These models and the simulation environment are implemented with MODSIM III, a general purpose, modular, block-structured high-level programming language which provides direct support for object-oriented programming and discrete-event simulation. In this simulation environment with representative attacks, the following three attacks are generated, SYN flooding and Smurf attack as an attack type of denial of service, Mail bomb attack as an attack type of e-mail. The simulation is performed with the models that exploited various security policies against these attacks. The results of this study show that the modeling method of packet filtering system, proxy system, unix and windows NT operating system. In addition, the results of the simulation show that the analysis of security performance according to various security policies, and the analysis of correlation between availability and confidentiality according to security empowerment.

• International Journal of Computer Science & Network Security
• /
• v.24 no.4
• /
• pp.179-191
• /
• 2024

With the advancement of modern technology, cyber-attacks are always rising. Specialized defense systems are needed to protect organizations against these threats. Malicious behavior in the network is discovered using security tools like intrusion detection systems (IDS), firewall, antimalware systems, security information and event management (SIEM). It aids in defending businesses from attacks. Delivering advance threat feeds for precise attack detection in intrusion detection systems is the role of cyber-threat intelligence (CTI) in the study is being presented. In this proposed work CTI feeds are utilized in the detection of assaults accurately in intrusion detection system. The ultimate objective is to identify the attacker behind the attack. Several data sets had been analyzed for attack detection. With the proposed study the ability to identify network attacks has improved by using machine learning algorithms. The proposed model provides 98% accuracy, 97% precision, and 96% recall respectively.

• The Transactions of the Korea Information Processing Society
• /
• v.6 no.12
• /
• pp.3606-3612
• /
• 1999

System(IDS) hasn't Protection capability for various security attacks perfectly. Because, It is probably affected by IDS's workload caused by treating all kind of the characteristics and attack patterns of system and can't probe all of the attack types being intelligently different with attack patterns. In this paper, we propose a new taxonomy criteria about DoS(denial of service attacks) to make more efficient and new real time probing system. It's started with an idea that most of the goal oriented systems make the state of system operation more unambiguous than general purpose system. A new event caused the state of the system operation to change and classifying a category of the new events may contribute to design the IDS.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.12 no.10
• /
• pp.4606-4611
• /
• 2011

In this paper, it is reviewed vulnerability of security in DS-MAC communication protocol of sensor network, and analyzed in the respect of security effectiveness, which is consumed at each stage of communication procedure in according to vulnerability of denial of service and modification attack. In this paper, we present about the respect of security effectiveness of transmission and reception in case of operation mode with or without authentication scheme between sensor node.