• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2003.12a
• /
• pp.591-596
• /
• 2003

현재의 네트워크 공격 중 대부분은 특정시스템의 서비스를 거부하도록 하여 서비스에 대한 가용성을 제공하지 못하도록 하는 공격이다. 이러한 공격의 유형은 DoS로부터 시작해서 현재에는 DDoS, DRDoS등의 보다 지능화된 새로운 공격으로 발전하고 있다. 이러한 공격은 탐지 자체도 어려울 뿐만 아니라 탐지하더라도 이에 대응하기 위한 방법 또한 어려운 것이 현실이다. 본 논문에서는 시뮬레이션 도구를 이용해서 보호하고자 하는 네트워크를 가상으로 구성하고 서비스공격 행위의 패턴들을 분석, 적용함으로써 통합보안관제 시스템에서 최적의 서비스 거부 공격 완화 방법을 설계하는 시스템을 제안한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2011.04a
• /
• pp.713-716
• /
• 2011

인터넷 유저가 증가하면서 DDoS 공격은 인터넷 안정성에 매우 중요한 위협을 가하고 있다. 서비스 거부 공격이란 서비스를 제공하는데 있어 필요한 컴퓨팅 및 통신 자원을 고갈시키는 공격으로 원천적으로 해결하기가 매우 힘든 것으로 알려져 있다. 인터넷과 같은 대규모 망을 대상으로 한 네트워크 공격은 효과적인 탐지 방법이 요구된다. 그러므로 대규모 망에서 침입 탐지 시스템은 효율적인 실시간 탐지가 필요하다. 본 논문에서는 DDoS 공격에 따른 비정상적인 트래픽 범람을 방지하고 합법적인 트래픽 전송을 보장하기 위하여 엔트로피기반의 DDoS 공격 대응 기법을 제안한다. OPNET을 이용해 구현한 결과 DDoS 공격중에 원활한 서비스를 제공할 수 있는 것을 확인하였다.

• Journal of Advanced Navigation Technology
• /
• v.19 no.3
• /
• pp.257-263
• /
• 2015

Although a variety of preparation methods for DoS attacks and DDoS attacks are presented, it is still being exploited, the vulnerability with networks and protocols. In particular, When was built environment that can be used anywhere in the Internet, Internet of Things is entering era. Thus, the conventional computer, as well as household appliances, etc. DoS attack targets or are likely to do the attacker role is increasing. In this paper, we first find out about the type and characteristics of DoS attacks. Open source operating system, Linux has iptables that packet filtering tool and firewall programs. Using iptables to set the policy ruleset against DoS attacks.

• Proceedings of the Korea Contents Association Conference
• /
• 2003.05a
• /
• pp.223-226
• /
• 2003

The best way in order to protect the system resource front Distributed Denial of Service(DDoS) attack is cut off the source of DDoS attack with path retracing the packet which transferred by attacker. Packet marking method can not use ICMP cause by using IP identifier field as marking field. And in case of increasing the number of router, retracing method using router ID has the size of marking field's increasing problem. In this paper, we propose that retracing method can be available the ICMP using marking field for option field in IP header and the size of making Held do not change even though the number of router is increased using the mark information which value obtained through XOR operation on IP address.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.8 no.7
• /
• pp.2512-2531
• /
• 2014

We propose a new Distributed Denial of Service (DDoS) defense mechanism that protects http web servers from application-level DDoS attacks based on the two methodologies: whitelist-based admission control and busy period-based attack flow detection. The attack flow detection mechanism detects attach flows based on the symptom or stress at the server, since it is getting more difficult to identify bad flows only based on the incoming traffic patterns. The stress is measured by the time interval during which a given client makes the server busy, referred to as a client-induced server busy period (CSBP). We also need to protect the servers from a sudden surge of attack flows even before the malicious flows are identified by the attack flow detection mechanism. Thus, we use whitelist-based admission control mechanism additionally to control the load on the servers. We evaluate the performance of the proposed scheme via simulation and experiment. The simulation results show that our defense system can mitigate DDoS attacks effectively even under a large number of attack flows, on the order of thousands, and the experiment results show that our defense system deployed on a linux machine is sufficiently lightweight to handle packets arriving at a rate close to the link rate.

• The Transactions of The Korean Institute of Electrical Engineers
• /
• v.66 no.12
• /
• pp.1913-1920
• /
• 2017

Software Defined Networking creates totally new concept of networking and its applications which is based on separating the application and control layer from the networking infrastructure as a result it yields new opportunities in improving the network security and making it more automated in robust way, one of these applications is Denial of Service attack mitigation but due to the dynamic nature of Denial of Service attack it would require dynamic response which can mitigate the attack with the minimum false positive. In this paper we will propose a new mitigation Framework for DDoS attacks using Software Defined Networking technology to protect online services e.g. websites, DNS and email services against DoS and DDoS attacks.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2011.11a
• /
• pp.996-998
• /
• 2011

인터넷의 발전과 더불어 네트워크 상에서의 침입 시도가 갈수록 증가되고 다변화되고 있으며, 특히, 네트워크나 서버의 가용성을 위협하는 형태의 서비스 거부(DoS: Denial of Servie) 공격이 최근 급증하고 있다. 따라서, 본 논문에서는 인터넷 서버의 정상적인 서비스 제공을 방해하는 형태의 분산 서비스 거부(DDoS: Distributed Denial of Service) 공격으로부터 서버를 보호하고 원활한 서비스를 제공하기 위한 Secure-NIC 시스템의 설계 및 구현에 대해서 설명한다. 이는 "CISGDP : CPU-Independent Service Guaranteed DDoS Protection" 이라는 설계 개념하에서, 각종 인터넷 서버에 장착되어 DDoS 공격 등의 네트워크 공격에 대하여 서버의 고유 서비스가 지속적으로 보장될 수 있도록 자체 보안 기능을 NIC(Network Interface Card) 형태로 제공한다.

• Journal of Korea Multimedia Society
• /
• v.13 no.4
• /
• pp.594-600
• /
• 2010

Many studies are DDoS in Internet network, but the study is the fact that is not enough in a voice network. Therefore, we designed the extended TRW algorithm that was a DDoS attack traffic detection algorithm for the voice network which used an IP data network to solve upper problems in this article and evaluated it. The algorithm that is proposed in this paper analyzes TRW algorithm to detect existing DDoS attack in Internet network and, design connection and end connection to apply to a voice network, define probability function to count this. For inspect the algorithm, Set a threshold and using NS-2 Simulator. We measured detection rate by an attack traffic type and detection time by attack speed. At the result of evaluation 4.3 seconds for detection when transmitted INVITE attack packets per 0.1 seconds and 89.6% performance because detected 13,453 packet with attack at 15,000 time when transmitted attack packet.

• Journal of Internet Computing and Services
• /
• v.6 no.1
• /
• pp.1-12
• /
• 2005

Recently, the patterns of cyber attack through internet have been various and have become more complicated and thus it is difficult to detect a network intruder effectively and to response the intrusion quickly. Therefore, It is almost not possible to chase the real location of a network intruder and to isolate the Intruder from network in UDP based DoS or DDoS attacks spoofing source IP address and in TCP based detour connection attacks. In this paper, we propose active security architecture on active network to correspond to various cyber attacks promptly. Security management framework is designed using active technology, and security control mechanism to chase and isolate a network intruder is implemented. We also test the operation of the active security mechanism implemented on test_bed according to several attack scenarios and analyze the experiment results.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.15 no.1
• /
• pp.107-114
• /
• 2011

Today the company adopts to use information management method at the network base such as internet, intranet and so on for the speed of business. Therefore the security of information asset protection and continuity of business within company in relation to this is directly connected to the credibility of the company. This paper secures continuity to the certified users using queuing model for the business interruption issue caused by DDoS attack which is faced seriously today. To do this I have reflected overloaded traffic improvement process to the queuing model through the analysis of related traffic information and packet when there occurs DDoS attack with worm/virus. And through experiment I compared and analyzed traffic loading improvement for general network equipment.