• Journal of Digital Convergence
• /
• v.20 no.4
• /
• pp.377-388
• /
• 2022

Metaverse, realistic virtual space technology has become a hot topic. However, due to the lack of an institutional system to the metaverse environment, concerns are rising over the leakage of industrial confidentiality, including digital assets produced, stored, processed, and transferred within the metaverse. Digital forensics, a technology to defend against hacking attacks in cyberspace, cannot be used in metaverse space, and there is no basis for calculating the extent of damage and tracking responsibility, making it difficult to respond to human resources leakage and cyberhacking effectively. In this paper, we define the scope of industrial confidentiality information and leakage scenario and propose policy and institutional measures based on problems in each metaverse scenario. As a result of the study, it was necessary to prepare a standardized law on Extra-territorial search and seizure issues and a system for collecting cryptocurrency evidence to respond to industrial confidentiality leaks in the metaverse. The study expects to contribute to industrial technology development by preparing in advance for problems that may arise in metaverse technology.

• Journal of Internet Computing and Services
• /
• v.23 no.6
• /
• pp.1-13
• /
• 2022

As the information and communication environment develops, the environment of military facilities is also development remarkably. In proportion to this, cyber threats are also increasing, and in particular, APT attacks, which are difficult to prevent with existing signature-based cyber defense systems, are frequently targeting military and national infrastructure. It is important to identify attack groups for appropriate response, but it is very difficult to identify them due to the nature of cyber attacks conducted in secret using methods such as anti-forensics. In the past, after an attack was detected, a security expert had to perform high-level analysis for a long time based on the large amount of evidence collected to get a clue about the attack group. To solve this problem, in this paper, we proposed an automation technique that can classify an attack group within a short time after detection. In case of APT attacks, compared to general cyber attacks, the number of attacks is small, there is not much known data, and it is designed to bypass signature-based cyber defense techniques. As an attack model, we used MITRE ATT&CK® which modeled many parts of cyber attacks. We design an impact score considering the versatility of the attack techniques and proposed a group similarity score based on this. Experimental results show that the proposed method classified the attack group with a 72.62% probability based on Top-5 accuracy.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.4
• /
• pp.671-685
• /
• 2023

By applying artificial intelligence to image editing technology, it has become possible to generate high-quality images with minimal traces of manipulation. However, since these technologies can be misused for criminal activities such as dissemination of false information, destruction of evidence, and denial of facts, it is crucial to implement strong countermeasures. In this study, image file and mobile forensic artifacts analysis were conducted for detecting image manipulation. Image file analysis involves parsing the metadata of manipulated images and comparing them with a Reference DB to detect manipulation. The Reference DB is a database that collects manipulation-related traces left in image metadata, which serves as a criterion for detecting image manipulation. In the mobile forensic artifacts analysis, packages related to image editing tools were extracted and analyzed to aid the detection of image manipulation. The proposed methodology overcomes the limitations of existing graphic feature-based analysis and combines with image processing techniques, providing the advantage of reducing false positives. The research results demonstrate the significant role of such methodology in digital forensic investigation and analysis. Additionally, We provide the code for parsing image metadata and the Reference DB along with the dataset of manipulated images, aiming to contribute to related research.

• Journal of Arbitration Studies
• /
• v.32 no.4
• /
• pp.53-85
• /
• 2022

Small and medium-sized enterprises ("SMEs") are vulnerable to trade secret misappropriation. Korea's legislation for the protection of SMEs' trade secrets and provision of civil, criminal, and administrative remedies includes the SME Technology Protection Act, the Unfair Competition Prevention Act, the Industrial Technology Protection Act, the Mutually Beneficial Cooperation Act, and the Subcontracting Act. Among these acts, the revised SME Technology Protection Act of 2018 introduced the "administrative technology misappropriation investigation system" to facilitate a rapid resolution of SMEs' technology misappropriation disputes. On September 27, 2021, Korea's Ministry of SMEs announced that it had reached an agreement to resolve the dispute between Hyundai Heavy Industries and Samyeong Machinery through the administrative technology misappropriation investigation system. However, not until 3 years and a few months passed since the introduction of the system could it be used to resolve an SME's technology misappropriation dispute with a large corporation. So there arose a question on the usefulness of the system. Therefore, we conducted a comparative legal analysis of Korea's laws enacted to protect trade secrets of SMEs and to address technology misappropriation, focusing on their legislative purpose, protected subject matter, types of misappropriation, and legal remedies. Then we analyzed the administrative technology misappropriation investigation system and the cases where this system was applied. We developed a proposal to enhance the usefulness of the system. The expert interviews of 4 attorneys who are experienced in the management of the system to check the practical value of the proposal. Our analysis shows that the lack of compulsory investigation and criminal sanctions is the fundamental limitation of the system. We propose revising the SME Technology Protection Act to provide correction orders, criminal sanctions, and compulsory investigation. We also propose training professional workforces to conduct digital forensics, enabling terminated SMEs to utilize the system, and assuring independence and fairness of the mediation and arbitration of the technology misappropriation disputes.

• Asia-pacific Journal of Multimedia Services Convergent with Art, Humanities, and Sociology
• /
• v.8 no.5
• /
• pp.303-314
• /
• 2018

In the past few years, government agencies and corporations have succumbed to stealthy, tailored cyberattacks designed to exploit vulnerabilities, disrupt operations and steal valuable information. Security Information and Event Management (SIEM) is useful tool for cyberattacks. SIEM solutions are available in the market but they are too expensive and difficult to use. Then we implemented basic SIEM functions to research and development for future security solutions. We focus on collection, aggregation and analysis of real-time logs from host. This tool allows parsing and search of log data for forensics. Beyond just log management it uses intrusion detection and prioritize of security events inform and support alerting to user. We select Elastic Stack to process and visualization of these security informations. Elastic Stack is a very useful tool for finding information from large data, identifying correlations and creating rich visualizations for monitoring. We suggested using vulnerability check results on our SIEM. We have attacked to the host and got real time user activity for monitoring, alerting and security auditing based this security information management.

• Analytical Science and Technology
• /
• v.33 no.3
• /
• pp.151-158
• /
• 2020

Alcohol, which can easily be obtained in the same way as ordinary beverages, is harmful enough to cause death due to excessive drinking and chronic alcohol intake, so it is important to maintain a proper amount of drinking and healthy drinking habits. In addition, the incidence of behavioral disturbances and impaired judgments that can be caused by chronic alcohol drinking of more than adequate amounts of alcohol is also significant. Accordingly it is very useful for forensic science to check whether the person involved is drunken or is alcoholism state in various accidents. Currently, in Korea, alcohol consumption is determined by detecting the level of alcohol or alcohol metabolism 'ethyl glucuronide (EtG)' in blood or urine samples. However, analysis of alcohol or EtG in blood or urine can only provide information about the current state of alcohol consumption because of a narrow window of detection time. Therefore, it is important to analyze the EtG as a long-term direct alcohol metabolite bio-marker in human hair and to investigate relationship between alcohol consumption and EtG concentration for the evaluation of chronic ethanol consumption. In this study, we established an analytical method for the detection of EtG in Korean hair efficiently and validated selectivity, linearity, limits of detection (LOD), limits of quantification (LOQ), matrix effect, recovery, process efficiency, accuracy and precision using liquid chromatography tandem mass spectrometry (LC-MS/MS). In addition, the assay performance was evaluated in Korean social drinker's hair and the postmortem hair of a chronic alcoholism. The results of this study can be useful in monitoring the alcohol abuse of Korean in clinical cases and legal procedures related to custody and provide a useful tool to evaluate postmortem diagnosis of alcoholic ketoacidosis in forensics.