• Journal of Digital Convergence
• /
• v.13 no.2
• /
• pp.177-183
• /
• 2015

Cross Site Scripting enables hackers to steal other user's information (such as cookie, session etc.) or to do abnormal functions automatically using vulnerability of web application. This attack patterns of Cross Site Scripting(XSS) can be divided into two types. One is Reflect XSS which can be executed in one request for HTTP and its reply, and the other is Stored XSS which attacks those many victim users whoever access to the page which accepted the payload transmitted. To correspond to these XSS attacks, some measures have been suggested. They are data validation for user input, output validation during HTML encoding procedures, and removal of possible risk injection point to prevent from trying to insert malicious code into web application. In this paper, the methods and procedures for these two types are explained and a penetration testing is done. With these suggestions, the attack by XSS could be understood and prepared by its countermeasures.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.38B no.5
• /
• pp.394-400
• /
• 2013

WoT (Web of Things) was proposed to realize intelligent thing to thing communications using WEB standard technology. It is difficult to adapt security protocols suited for existing Internet communications into WoT directly because WoT includes LLN(Low-power, Lossy Network) and resource constrained sensor devices. Recently, IETF standard group propose to use DTLS protocol for supporting security services in WoT environments. However, DTLS protocol is not an efficient solution for supporting end to end security in WoT since it introduces complex handshaking procedures and high communication overheads. We, therefore, divide WoT environment into two areas- one is DTLS enabled area and the other is an area using lightweight security scheme in order to improve them. Then we propose a mutual authentication scheme and a session key distribution scheme for the second area. The proposed system utilizes a smart device as a mobile gateway and WoT proxy. In the proposed authentication scheme, we modify the ISO 9798 standard to reduce both communication overhead and computing time of cryptographic primitives. In addition, our scheme is able to defend against replay attacks, spoofing attacks, select plaintext/ciphertext attacks, and DoS attacks, etc.

• Journal of Convergence Society for SMB
• /
• v.4 no.3
• /
• pp.15-20
• /
• 2014

Wireless network is convenient as compared to the wire, and it is also easy. Therefore, SMEs in the country is the trend that many SMEs prefer the radio using a lot of radio as an extension of the wired network modification felt the burden of fixed installations. Wireless networks are vulnerable to security together than a wired network, since it passes the packet through the broadcasting. Therefore, analyzing the vulnerability of wireless networks, and proposes countermeasures about wireless network security in small and medium-sized businesses.

• Journal of the Institute of Electronics Engineers of Korea TC
• /
• v.44 no.3 s.357
• /
• pp.33-40
• /
• 2007

In this paper, low-rate TCP attack as one of shrew attacks is considered and the scaling based dynamic time warping (S-DTW) algorithm is introduced. The low-rate TCP attack can not be detected by the detection method for the previous flooding DoS/DDoS (Denial of Service/Distirbuted Denial of Service) attacks due to its low average traffic rate. It, however, is a periodic short burst that exploits the homogeneity of the minimum retransmission timeout (RTO) of TCP flows and then some pattern matching mechanisms have been proposed to detect it among legitimate input flows. A DTW mechanism as one of detection approaches has proposed to detect attack input stream consisting of many legitimate or attack flows, and shown a depending method as well. This approach, however, has a problem that legitimate input stream may be caught as an attack one. In addition, it is difficult to decide a threshold for separation between the legitimate and the malicious. Thus, the causes of this problem are analyzed through simulation and the scaling by maximum auto-correlation value is executed before computing the DTW. We also discuss the results on applying various scaling approaches and using standard deviation of input streams monitored.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.12 no.6
• /
• pp.91-98
• /
• 2012

Password-based authentication schemes have been widely adopted in order to protect resources from unauthorized access. In 2008, Liu et al. proposed a new mutual authentication scheme using smart cards which can withstand the forged attack. In this paper, author has proven that Liu et al.'s scheme is still vulnerable to the various attacks by analyzing the security of their scheme. This paper introduces an enhanced scheme to overcome these security weakness and to provide mutual authentication between the user and the server, even if the secrete information stored in the smart card is revealed by an attacker. The comparative result from the security analysis demonstrates that the proposed scheme is more secure against the possible attacks than Liu et al.'s scheme.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.18 no.3
• /
• pp.3-8
• /
• 2008

Ephemeral data are easily revealed if state specific information is stored in insecure memory or a random number generator is corrupted. In this letter, we show that Nam et al.'s group key agreement scheme, which is an improvement of Bresson et al.'s scheme, is not secure against session-state reveal attacks. We then propose an improvement to fix the security flaw.

• Journal of the Korean Institute of Intelligent Systems
• /
• v.13 no.4
• /
• pp.491-498
• /
• 2003

The advanced computer network technology enables connectivity of computers through an open network environment. There has been growing numbers of security threat to the networks. Therefore, it requires intrusion detection and prevention technologies. In this paper, we propose a network based intrusion detection model using FCM(Fuzzy Cognitive Maps) that can detect intrusion by the DoS attack detection method adopting the packet analyses. A DoS attack appears in the form of the Probe and Syn Flooding attack which is a typical example. The SPuF(Syn flooding Preventer using Fussy cognitive maps) model captures and analyzes the packet informations to detect Syn flooding attack. Using the result of analysis of decision module, which utilized FCM, the decision module measures the degree of danger of the DoS and trains the response module to deal with attacks. For the performance comparison, the "KDD′99 Competition Data Set" made by MIT Lincoln Labs was used. The result of simulating the "KDD′99 Competition Data Set" in the SPuF model shows that the probe detection rates were over 97 percentages.

• Korean Security Journal
• /
• no.7
• /
• pp.95-124
• /
• 2004

It can be said that 'the September 11th Terrorist Attacks' in 2001 were not only the indiscriminate attacks on innocent people but also the whole - political, economical and military - attacks on human life. Also, 'the September 11th Terrorist Attacks' can be regarded as the significant events in the history of world, which were on the peak of the super-terrorism or new-terrorism that had emerged from the 1980s. However, if one would have analysed the developments of terrorism from the 1970s, they could have been foreknown without difficulty. The finding from this study can be summarized as the followings, First, in spite that the USA responsive system against terrorism had been assessed as perfect before 'the September 11th Terrorist Attacks', the fragilities were found in the aspects of the response on the new-terrorism or super-terrorism. The previous responsive system before 'the September 11th Terrorist Attacks' had the following defects as the followings: (1) it was impossible to establish the integrated strategy, because the organizations related to the response against terrorism had not integrated; (2) there were some weakness to collect and diffuse the informations related to terrorism; (3) the security system for the domestic airline service in USA and the responsive system of air defense against terrors on aircraft were very fragile. For these reasons, USA government established the 'Department of Homeland Security' of which the President is the head so that the many organizations related to terrorism were integrated into a single management system. And, it legislated a new act to protect security from terrors, which legalized of the wiretapping in spite of the risk of encroachment upon personal rights, increased the jail terms upon terrorists, froze the bank related to terrorist organization, and could censor e-mails. Second, it seem that Korean responsive system against terrors more fragile than that of USA. One of the reasons is that people have some perception that Korea is a safe zone from terrors, because there were little attacks from international terrorists in Korea. This can be found from the fact that the legal arrangement against terrorism is only the President's instruction No. 47. Under this responsive system against terrorism dependent on only the President's instruction, it is expected that there would be a poor response against terrors due to the lack of unified and integrated responsive agency as like the case of USA before 'the September 11th Terrorist Attacks'. And, where there is no legal countermeasure, it is impossible to expect the binding force on the outside of administrative agencies and the performances to prevent and hinder the terrorist actions can not but be limited. That is to say, the current responsive system can not counteract effectively against the new-terrorism and super-terrorism. Third, although there were some changes in Korean government's policies against terrorism. there still are problems. One of the most important problems is that the new responsive system against terrorism in Korea, different from that of USA, is not a permanent agency but a meeting body that is organized by a commission. This commission is controled by the Prime Minister and the substantial tasks are under the National Intelligence Service. Under this configuration, there can be the lack of strong leadership and control. Additionally, because there is no statute to response against terrorism, it is impossible to prevent and counteract effectively against terrorism. The above summarized suggests that, because the contemporary super-terrorism or new-terrorism makes numerous casualties of unspecified persons and enormous nationwide damages, the thorough prevention against terrorism is the most important challenge, and that the full range of legal and institutional arrangements for the ex post counteraction should be established. In order to do so, it is necessary for the government to make legal and institutional arrangements such as the permanent agency for protection from terrorism in which the related departments cooperates with together and the development of efficient anti-terror programs, and to show its willingness and ability that it can counteract upon any type of domestic and foreign terrorism so that obtain the active supports and confidence from citizens.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.29 no.7C
• /
• pp.971-984
• /
• 2004

In the coming age of information warfare, information security patterns need to be changed such as to the active approach using offensive security mechanisms rather than traditional passive approach just protecting the intrusions. In an active security environment, it is essential that, when detecting an intrusion, the immediate confrontation such as analysing the intrusion situation in realtime, protecting information from the attacks, and even tracing the intruder. This paper presents an active intrusion-confronting system using a fake session and a honeypot. Through the fake session, the attacks like Dos(Denial of Service) and port scan can be intercepted. By monitoring honeypot system, in which the intruders are migrated from the protected system and an intrusion rule manager is being activated, new intrusion rules are created and activated for confronting the next intrusions.

• The KIPS Transactions:PartA
• /
• v.10A no.1
• /
• pp.7-14
• /
• 2003

In order to cope with DoS (Denial of Service) attacks disturbing delivery of intended services by exhausting resources of computing nodes, we need a solution to recognize important resources for the essential services which have to be maintained under any circumstances and to adapt the system to the urgent situation and reconfigure itself properly. In this paper, we present a two-phase scheme to handle the problem. In the first phase, by means of dynamic resource reallocation within a computing node, we try to make the selected essential services survive even after the occurrence of an attack. For the second phase when it becomes impossible to continue the service in spite of the actions taken in the first phase, we apply server replication in order to continue the transparent provision of the essential services with the end users by utilizing redundant computing nodes previously arranged. Experimental result obtained on a testbed reveals the validity of the proposed scheme. A comparison with other proposed schemes has been conducted by analyzing the performance and the cost.