• 한국항행학회논문지
• /
• 제19권3호
• /
• pp.257-263
• /
• 2015

DoS 공격 및 DDoS 공격에 대한 다양한 대비 방안이 제시되고 있지만, 네트워크 및 프로토콜이 가지는 취약점으로 인해 여전히 악용되고 있다. 특히, 언제 어디서나 인터넷을 사용할 수 있는 환경이 구축되었고, 사물인터넷 시대의 진입을 앞둔 현 시점에서는 기존의 컴퓨터뿐만 아니라 가전기기 등도 DoS 공격 대상 또는 공격자 역할을 수행할 가능성이 높아지고 있다. 본 논문에서는 DoS 공격의 유형 및 특징에 대해 알아보고, 공개용 운영체제인 리눅스에 기본 탑재된 패킷필터링 도구이자 방화벽 프로그램인 iptables를 이용하여 빈번하게 발생되는 DoS 공격에 대비하는 정책 설정에 대해 기술하였다.

• Journal of information and communication convergence engineering
• /
• 제8권5호
• /
• pp.473-478
• /
• 2010

Today's engineering design is carried out in a distributed fashion geographically or physically. This places new requirements on the computational environments such as efficient integration and collaboration. With the advances of the Internet and Network environment recently, many researches have been proposed and at the same time, Web-based distributed design gives to a new paradigm in design and manufacturing fields. That is, Web-based technologies lead to reduce the product development times and to ensure a competitive product in order to exchange and interact of real-time design information that integrates the distributed design environment between departments as well as companies via Internet and Web. So, an efficient data communication for design information sharing is the foundation for collaborative systems in the distributed environment. Design data communication techniques such as CORBA, DCOM and RMI have been considered in the existing research but they have some problems that are limitations of interoperability and firewall problems in the Web. Therefore, this paper presents a Web-based distributed design application where distributed design information resources are integrated and exchanged using Web Services for supporting XML and HTTP without the interoperability and firewall problems through the 330K VLCC case.

• 한국인터넷방송통신학회논문지
• /
• 제20권2호
• /
• pp.29-37
• /
• 2020

기존에 사용되던 방화벽들은 기본적으로 정책을 수동적으로 입력해 주는 방식으로 되어 있어 공격이 오는 즉시 대응하기 쉽지 않다. 왜냐하면 전문 보안 관리자가 이를 분석하고 해당 공격에 대한 방어 정책을 입력해 주어야하기 때문이다. 또한, 기존 방화벽 정책은 공격을 막기 위해 정상 접속까지 차단하는 경우가 많다. 패킷 자체는 정상적이지만 유입량이 많아 서비스 거부를 발생시키는 공격이 많기 때문이다. 본 논문에서는 방어 정책을 입력하는 부분을 인공지능으로 대체하여 정책을 자동으로 생성하고, 정상 접속 학습을 통해 생성된 화이트리스트 정책으로 정상 접속은 가능하면서 Flooding, Spoofing, Scanning과 같은 공격만을 차단하는 방법을 제안한다.

• 한국컴퓨터산업학회논문지
• /
• 제5권2호
• /
• pp.251-260
• /
• 2004

네트워크 보안의 중요성과 필요성이 증대됨에 따라 많은 조직들이 다양한 보안 시스템을 네트워크에 적용하고 있다. 침입 차단 시스템, 침입 탐지 시스템, 취약점 스캐너와 같은 보안 시스템들이 취약성 정보를 공유하게 되면 일관된 통합 보안 환경을 구축할 수 있다. 본 논문에서는 침입탐지 에이전트와 방화벽 에이전트가 계약망 프로토콜(Contract Net Protocol)에 의해서 서로 연동할 수 있는 구조를 디자인하고 구축하려다 계약망 프로토콜은 분산 시스템과 같은 이 기종의 컴퓨터 시스템의 효과적인 연통을 위한 방법으로서 여러 에이전트들이 모여 서로 협력하며 하나의 문제를 해결하게 된다 계약망 프로토콜의 선택 알고리즘과 퍼지 제어기를 사용하였을 경우 성능을 비교함으로써 에이전트 선택에 있어서 보다 효과적인 방법을 제시할 것이다.

• 한국통신학회논문지
• /
• 제37B권12호
• /
• pp.1160-1167
• /
• 2012

네트워크 트래픽 모니터링에 있어서 트래픽을 사용하는 목적을 알아내는 것은 서비스 품질, 방화벽의 동작, 보안 측면에 있어서 중요한 이슈가 되고 있다. 트래픽을 사용하는 목적을 알게 되면 이를 방화벽에서 거부하거나 허용할 수 있고 이는 서비스 품질, 보안적 측면에서 효과적인 운용이 가능해진다. 하지만 수많은 어플리케이션은 보안이나 서비스 측면에서 트래픽을 암호화시키고 있어 효과적인 트래픽 모니터링이 어렵다. 본 논문에서는 암호화된 트래픽을 사용하는 SSH(Secure Shell) 프로토콜을 분석하고 SSH 터널링, SFTP(SSH File Transfer Protocol)와 일반 SSH 트래픽의 차이점을 분석하고 식별할 수 있는 방법을 제시하고 실험을 통해 검증했다.

• 디지털산업정보학회논문지
• /
• 제6권4호
• /
• pp.117-130
• /
• 2010

Paper is on defense for so-called internet crisis, the attack of DDoS (Distributed Denial of Service) which was targeted to the central government ministries, financial sector, and portal sites of chief counties including Korea on June 7th, 2009 as its start. By conducting attack with various DDoS attacking methods in the lab environment and dividing networks targeted by the attack by layers, this paper records and analyzes the chief information for attack, destination information of packets, defense policy setting, and the flow of packet attack with the subjects of the networks separated. This study suggests CFC system using multiple firewalls applying defense policy corresponding to the target layer for ultimate attack and tests it according to the result of analyzing the attack packet information and its amount, log analysis, access recording port, and MAC and IT information, etc. by layers. This article is meaningful in that it analyzes the attack by layers, establishes firewall policy for protecting each layer, and secures accurate mechanism for detect and defense.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제4권4호
• /
• pp.671-690
• /
• 2010

The continuous growth of attacks in the Internet causes to generate a number of rules in security devices such as Intrusion Prevention Systems, firewalls, etc. Policy anomalies in security devices create security holes and prevent the system from determining quickly whether allow or deny a packet. Policy anomalies exist among the rules in multiple security devices as well as in a single security device. The solution for policy anomalies requires complex and complicated algorithms. In this paper, we propose a new method to remove policy anomalies in a single security device and avoid policy anomalies among the rules in distributed security devices. The proposed method classifies rules according to traffic direction and checks policy anomalies in each device. It is unnecessary to compare the rules for outgoing traffic with the rules for incoming traffic. Therefore, classifying rules by in-out traffic, the proposed method can reduce the number of rules to be compared up to a half. Instead of detecting policy anomalies in distributed security devices, one adopts the rules from others for avoiding anomaly. After removing policy anomalies in each device, other firewalls can keep the policy consistency without anomalies by adopting the rules of a trusted firewall. In addition, it blocks unnecessary traffic because a source side sends as much traffic as the destination side accepts. Also we explain another policy anomaly which can be found under a connection-oriented communication protocol.

• 디지털산업정보학회논문지
• /
• 제11권4호
• /
• pp.81-87
• /
• 2015

Recently, with the development of the ICT environment, the use of the software is growing rapidly. And the number of the web server software used with a variety of users is also growing. However, There are also various damage cases increased due to a software security vulnerability as software usage is increasing. Especially web shell hacking which abuses software vulnerabilities accounts for a very high percentage. These web server environment damage can induce primary damage such like homepage modification for malware spreading and secondary damage such like privacy. Source code weaknesses checking system is needed during software development stage and operation stage in real-time to prevent software vulnerabilities. Also the system which can detect and determine web shell from checked code in real time is needed. Therefore, in this paper, we propose the system improving security for web server by detecting web shell attacks which are invisible to existing detection method such as Firewall, IDS/IPS, Web Firewall, Anti-Virus, etc. while satisfying existing secure coding guidelines from development stage to operation stage.

• 한국시뮬레이션학회논문지
• /
• 제11권2호
• /
• pp.1-16
• /
• 2002

The need for network security is being increasing due to the development of information communication and internet technology. In this paper, firewall models, operating system models and other network component models are constructed. Each model is defined by basic or compound model, referencing DEVS formalism. These models and the simulation environment are implemented with MODSIM III, a general purpose, modular, block-structured high-level programming language which provides direct support for object-oriented programming and discrete-event simulation. In this simulation environment with representative attacks, the following three attacks are generated, SYN flooding and Smurf attack as an attack type of denial of service, Mail bomb attack as an attack type of e-mail. The simulation is performed with the models that exploited various security policies against these attacks. The results of this study show that the modeling method of packet filtering system, proxy system, unix and windows NT operating system. In addition, the results of the simulation show that the analysis of security performance according to various security policies, and the analysis of correlation between availability and confidentiality according to security empowerment.

• 대한조선학회논문집
• /
• 제47권6호
• /
• pp.831-835
• /
• 2010

Currently, engineering design is carried out in a distributed manner geographically or physically. This imposes new requirements on the computational environments, such as efficient integration and collaboration in the Internet and network environments. Meanwhile, Web-based distributed design has led new paradigms in design and manufacturing fields. For example, Web-based technologies have reduced the product development time and to ensure a competitive product in order to exchange and interact of real-time design information that integrates the distributed design environment between departments as well as companies via Internet and Web. Hence, efficient data communication for design information sharing is the basis for collaborative systems in the distributed environments. Design data communication techniques such as CORBA, DCOM, and JAVA RMI have been considered in the existing research, but these techniques have some disadvantages such as limitations of interoperability and firewall problems. This paper presents the application of engineering design problems in which distributed design information resources are integrated and exchanged using Web Service for supporting XML and HTTP without interoperability and firewall problems.