• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.33 no.3B
• /
• pp.152-158
• /
• 2008

Recently, DDoS (Distributed Denial of Service) attack has emerged as one of the major threats and it's main characteristic is to send flood of data packets toward a specific victim. Thus, several attack detection schemes which monitor the destination IP address of packets have been suggested. The existing Bloom Filter based attack detection scheme is simple and can support real-time monitoring. However, since this scheme monitors the separate fields of destination IP address independently, wrong detection is comparatively high. In this paper, in order to solve this drawback, an efficient Bloom Filter based destination address monitoring scheme is proposed, which monitors not only separate fields but also relationship among separate fields. In the results of simulation, the proposed monitoring scheme outperforms the existing Bloom Filter based detection scheme. Also, to improve the correctness of detection, multi-layerd structure is proposed and the correctness of result is improved according to the number of layers and extra tables.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.2
• /
• pp.119-129
• /
• 2011

TCP-related Flooding attacks still dominate Distributed Denial of Service Attack. It is a great challenge to accurately detect the TCP flood attack in hish speed network. In this paper, we propose the NIC_Cookie logic implementation, which is a kind of security offload engine against TCP-related DDoS attacks, on network interface card. NIC_Cookie has robustness against DDoS attack itself and it is independent on server OS and external network configuration. It supports not IP-based response method but packet-level response, therefore it can handle attacks of NAT-based user group. We evaluate that the latency time of NIC_Cookie logics is $7{\times}10^{-6}$ seconds and we show 2Gbps wire-speed performance through a benchmark test.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2021.05a
• /
• pp.108-110
• /
• 2021

Since 2015, attacks using the IoT protocol have been continuously reported. Among various IoT protocols, attackers attempt DDoS attacks using SSDP(Simple Service Discovery Protocol), and as statistics of cyber shelters, Korea has about 1 million open SSDP servers. Vulnerable SSDP servers connected to the Internet can generate more than 50Gb of traffic and the risk of attack increases gradually. Until recently, distributed denial of service attacks and distributed reflective denial of service attacks have been a security issue. Accordingly, the purpose of this study is to analyze the request packet of the existing SSDP protocol to identify an amplification attack and to avoid a response when an amplification attack is suspected, thereby preventing network load due to the occurrence of a large number of response packets due to the role of traffic reflection amplification.

• Journal of Digital Convergence
• /
• v.12 no.11
• /
• pp.233-239
• /
• 2014

Ultra high-resolution content, the file size is very large, therefore existing encoding techniques, it is not possible to transmit via the network. Efficient use of the network encoder HEVC corporation can be transferred. Compression requires a lot of time because it requires a distributed transcoding system. Distributed transcoding system is a distributed data store, and then encoded using a large number of nodes. The disadvantage of distributed transcoding system for distributed information is exposed or vulnerable to attack by internal managers. In this paper, when the super high definition content transcoding, distributed transcoding system does not guarantee the confidentiality of the problem to solve. We are using SNA, HEVC encoded content data encrypted using the secret distributing scheme was. Consequently, secure shared transcoding is possible, the internal administrator could prevent the attack.

• Proceedings of the Korea Contents Association Conference
• /
• 2003.05a
• /
• pp.223-226
• /
• 2003

The best way in order to protect the system resource front Distributed Denial of Service(DDoS) attack is cut off the source of DDoS attack with path retracing the packet which transferred by attacker. Packet marking method can not use ICMP cause by using IP identifier field as marking field. And in case of increasing the number of router, retracing method using router ID has the size of marking field's increasing problem. In this paper, we propose that retracing method can be available the ICMP using marking field for option field in IP header and the size of making Held do not change even though the number of router is increased using the mark information which value obtained through XOR operation on IP address.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.14 no.1
• /
• pp.35-43
• /
• 2018

MANET composed of only wireless nodes is increasingly utilized in various fields. However, it is exposed to many security vulnerabilities because it doesn't have any infrastructure and transmits data by using multi-hop method. Therefore, MANET should be applied the intrusion detection technique that can detect efficiently malicious nodes and decrease impacts of various attacks. In this paper, we propose a distributed intrusion detection technique that can detect the various attacks while improving the efficiency of attack detection and reducing the false positive rate. The proposed technique uses the cluster structure to manage the information in the center and monitor the traffic of their neighbor nodes directly in all nodes. We use three parameters for attack detection. We also applied an efficient authentication technique using only key exchange without the help of CA in order to provide integrity when exchanging information between cluster heads. This makes it possible to free the forgery of information about trust information of the nodes and attack nodes. The superiority of the proposed technique can be confirmed through comparative experiments with existing intrusion detection techniques.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.32 no.2B
• /
• pp.90-99
• /
• 2007

It might be more efficient that detections of distributed denial of service (DDoS) attacks are done in backbone domain than in individual local networks or links. However, because existing schemes for detecting DDoS attack symptoms have been focused on individual packets or flows, they require much higher computational complexities. In this paper, we propose an efficient method to detect DDoS attack symptoms in backbone networks. Unlike conventional schemes focused on individual packets or flows, the proposed method is carried at aggregate traffic level. So, our proposed schemes can be operated with very lower computational complexity, and can be run in very high-speed backbone networks.

• Proceedings of the Korea Contents Association Conference
• /
• 2005.11a
• /
• pp.189-194
• /
• 2005

Present hacking technology is undergone a change on the distributed DoS Attack which cause a lot of traffic to the network or single host. In this paper, with giving mobility to the mean deviation per protocol and it's field, and with adapting pattern matching approach to DDoS attack detection technique, we propose a method to detect the DDoS attack, to have less misdetection and to detect these attacks correctly.

• Journal of Korea Multimedia Society
• /
• v.17 no.8
• /
• pp.988-994
• /
• 2014

Software Defined Network (SDN) is a new technology in computer network area which enables user to centralize control plane. The security issue is important in computer network to protect system from attackers. SYN flooding attack is one of Distributed Denial of Service attack methods which are popular to degrade availability of targeted service on Internet. There are many methods to protect system from attackers, i.e. firewall and IDS. Even though firewall is designed to protect network system, but it cannot mitigate DDoS attack well because it is not designed to do so. To improve performance of DDOS mitigation we utilize another mechanism by using SDN technology such as OpenFlow and sFlow. The methodology of sFlow to detect attacker is by capturing and sum cumulative traffic from each agent to send to sFlow collector to analyze. When sFlow collector detect some traffics as attacker, OpenFlow controller will modify the rule in OpenFlow table to mitigate attacks by blocking attack traffic. Hence, by combining sum cumulative traffic use sFlow and blocking traffic use OpenFlow we can detect and mitigate SYN flooding attack quickly and cheaply.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2012.05a
• /
• pp.467-470
• /
• 2012

This paper proposes a technique of sybil attack detection using an ID-based certificate on sensor network. First, it can solve the broadcast storm problem happening when keys are distributed to sensor nodes. Second, it prevents the replay attack by periodically generating and changing the keys of sensor nodes with Key-chain technique. Third, it authenticates sensor node's ID using hash function. So, it maximizes sensor node's memory usage, reduces communication overhead. Finally it detects Sybil attack through ID-based certificate. Therefore, the proposed technique of Sybil attack detection using ID-based certificate consider simultaneously energy efficiency and stability on sensor network environment, and can trust the provided information through sensor network.