• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제15권10호
• /
• pp.3771-3792
• /
• 2021

With the rapid development of science and technology, several high-performance networks have emerged with various new applications. Consequently, financially or socially motivated attacks on specific networks have also steadily become more complicated and sophisticated. To reduce the damage caused by such attacks, administration of network traffic flow in real-time and precise analysis of past attack traffic have become imperative. Although various traffic analysis methods have been studied recently, they continue to suffer from performance limitations and are generally too complicated to apply in existing systems. To address this problem, we propose a method to calculate the correlation between the malicious and normal flows and classify attack traffics based on the corresponding correlation values. In order to evaluate the performance of the proposed method, we conducted several experiments using examples of real malicious traffic and normal traffic. The evaluation was performed with respect to three metrics: recall, precision, and f-measure. The experimental results verified high performance of the proposed method with respect to first two metrics.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제16권3호
• /
• pp.1063-1075
• /
• 2022

In recent years, container techniques have been broadly applied to cloud computing systems to maximize their efficiency, flexibility, and economic feasibility. Concurrently, studies have also been conducted to ensure the security of cloud computing. Among these studies, moving-target defense techniques using the high agility and flexibility of cloud-computing systems are gaining attention. Moving-target defense (MTD) is a technique that prevents various security threats in advance by proactively changing the main attributes of the protected target to confuse the attacker. However, an analysis of existing MTD techniques revealed that, although they are capable of deceiving attackers, MTD techniques have practical limitations when applied to an actual cloud-computing system. These limitations include resource wastage, management complexity caused by additional function implementation and system introduction, and a potential increase in attack complexity. Accordingly, this paper proposes a software-defined MTD system that can flexibly apply and manage existing and future MTD techniques. The proposed software-defined MTD system is designed to correctly define a valid mutation range and cycle for each moving-target technique and monitor system-resource status in a software-defined manner. Consequently, the proposed method can flexibly reflect the requirements of each MTD technique without any additional hardware by using a software-defined approach. Moreover, the increased attack complexity can be resolved by applying multiple MTD techniques.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제15권12호
• /
• pp.4508-4530
• /
• 2021

Today distributed data storage service are being widely used. However lack of proper means of security makes the user data vulnerable. In this work, we propose a Randomized Block Size (RBS) model for secure data storage in distributed environments. The model work with multifold block sizes encrypted with the Chinese Remainder Theorem-based RSA (C-RSA) technique for end-to-end security of multimedia data. The proposed RBS model has a key generation phase (KGP) for constructing asymmetric keys, and a rand generation phase (RGP) for applying optimal asymmetric encryption padding (OAEP) to the original message. The experimental results obtained with text and image files show that the post encryption file size is not much affected, and data is efficiently encrypted while storing at the distributed storage server (DSS). The parameters such as ciphertext size, encryption time, and throughput have been considered for performance evaluation, whereas statistical analysis like similarity measurement, correlation coefficient, histogram, and entropy analysis uses to check image pixels deviation. The number of pixels change rate (NPCR) and unified averaged changed intensity (UACI) were used to check the strength of the proposed encryption technique. The proposed model is robust with high resilience against eavesdropping, insider attack, and chosen-plaintext attack.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제17권2호
• /
• pp.295-311
• /
• 2023

Cloud computing has evolved significantly, intending to provide users with fast, dependable, and low-cost services. With its development, malicious users have become increasingly capable of attacking both its internal and external security. To ensure the security of cloud services, encryption, authorization, firewalls, and intrusion detection systems have been employed. However, these single monitoring agents, are complex, time-consuming, and they do not detect ransomware and zero-day vulnerabilities on their own. An innovative Record and Replay-based hybrid Honeynet (R2NET) system has been developed to address this issue. Combining honeynet with Record and Replay (RR) technology, the system allows fine-grained analysis by delaying time-consuming analysis to the replay step. In addition, a machine learning algorithm is utilized to cluster the logs of attackers and store them in a database. So, the accessing time for analyzing the attack may be reduced which in turn increases the efficiency of the proposed framework. The R2NET framework is compared with existing methods such as EEHH net, HoneyDoc, Honeynet system, and AHDS. The proposed system achieves 7.60%, 9.78%%, 18.47%, and 31.52% more accuracy than EEHH net, HoneyDoc, Honeynet system, and AHDS methods.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제17권6호
• /
• pp.1689-1705
• /
• 2023

To deal with the potential XSS vulnerabilities in the source code of the power communication network, an XSS vulnerability detection method combining the static analysis method with the dynamic testing method is proposed. The static analysis method aims to analyze the structure and content of the source code. We construct a set of feature expressions to match malignant content and set a "variable conversion" method to analyze the data flow of the code that implements interactive functions. The static analysis method explores the vulnerabilities existing in the source code structure and code content. Dynamic testing aims to simulate network attacks to reflect whether there are vulnerabilities in web pages. We construct many attack vectors and implemented the test in the Selenium tool. Due to the combination of the two analysis methods, XSS vulnerability discovery research could be conducted from two aspects: "white-box testing" and "black-box testing". Tests show that this method can effectively detect XSS vulnerabilities in the source code of the power communication network.

• 한국정보통신학회:학술대회논문집
• /
• 한국정보통신학회 2022년도 추계학술대회
• /
• pp.143-145
• /
• 2022

전 세계적인 인터넷의 보급으로 인터넷과 연결된 기기들이 점차 늘어나고 있다. 이에 더불어 DNS, NTP, CLDAP 와 같이 응용 프로토콜의 취약점을 이용하여, 공격자가 피해자인 것처럼 아이피를 속여, 다량의 응답을 악의적으로 요청하는 공격인 분산 반사 서비스 거부 공격(DRDoS)이 급격하게 늘어나는 추세이다. ISP 들이 IP Spoofing에 대한 적절한 대비책을 수립하지 않으면 분산 반사 서비스 공격의 보안 위협은 사라지기 어려울 것으로 사료된다. 따라서 본 논문에서는 IP Spoofing에 기반한 분산 반사 서비스 공격의 보안 위협과 대응 실태에 관해 기술한다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제18권3호
• /
• pp.779-800
• /
• 2024

Unmanned Aerial Vehicle (UAV) networks, also known as drone networks, have gained significant attention for their potential in various applications, including communication. UAV networks for communication involve using a fleet of drones to establish wireless connectivity and provide communication services in areas where traditional infrastructure is lacking or disrupted. UAV communication networks need to be highly secured to ensure the technology's security and the users' safety. The proposed survey provides a comprehensive overview of the current state-of-the-art UAV network security solutions. In this paper, we analyze the existing literature on UAV security and identify the various types of attacks and the underlying vulnerabilities they exploit. Detailed mitigation techniques and countermeasures for the protection of UAVs are described in this paper. The survey focuses on the implementation of novel technologies like Q-learning, blockchain, IRS, and mmWave. This paper discusses network simulation tools that range in complexity, features, and programming capabilities. Finally, future research directions and challenges are highlighted.

• 한국산학기술학회논문지
• /
• 제13권11호
• /
• pp.5496-5505
• /
• 2012

IT 산업이 발달하면서 활발히 연구되어 지고 있는 스마트폰의 기술과 기능들은 생활 전반에 걸쳐 많은 영향을 주고 있다. 이러한 스마트폰을 이용하여 시간과 장소에 구애받지 않고 인터넷을 이용할 수 있는 무선랜에 대한 관심이 날로 증가하고 있지만, 무선 전파의 특성으로 인해 개인적이면서 중요한 정보들이 악의적인 공격자의 스푸핑, 서비스 거부 공격, 중간자 공격에 쉽게 노출되어 보안성 요구가 더욱 증가 하고 있다. 본 논문에서는 스마트폰 환경에서 사용자가 이동 통신사 AP 접속을 통하여 무선 인터넷을 이용할 때 USIM에 있는 사용자 고유정보와 AP 정보, 통신사 정보를 사용하여 사용자 인증, AP 인증, 통신사 인증을 함으로써 스푸핑, 세션 하이재킹 및 중간자 공격에 대한 취약성을 보완하여 안전한 무선 네트워크 서비스 환경을 제공한다.

• 한국인터넷방송통신학회논문지
• /
• 제15권4호
• /
• pp.63-70
• /
• 2015

유비쿼터스 시대의 도래와 함께 센서를 기반으로 하는 무선 센서 네트워크의 응용 분야는 광범위하게 확산되고 있다. 따라서 무선 센서 네트워크에서 센서들로부터 수집되는 기밀 데이터를 허가 받지 않은 사용자로부터 보호하기 위해, 널리 사용되어지는 스마트카드와 패스워드 기반의 사용자 인증도 견고한 보안을 요구한다. 최근 무선 센서 네트워크는 클러스터 헤드와 센서 노드 이원화를 통해 운용상 보다 효과적인 계층적 무선 센서 네트워크로 전개 발전되고 있다. 2012년 Das 등은 계층적 무선 센서 네트워크에 실제 적용 가능한 동적 패스워드 기반 사용자 인증 스킴을 제안하였다. 본 논문은 안정성 분석을 통해 Das 등의 스킴이 그들의 주장과 달리 여전히 중간자 공격, 패스워드 추측 공격, 패스워드 변경 공격을 막을 수 없을 뿐 아니라, 필수적인 보안 요구사항인 사용자와 클러스터 헤드 간의 상호인증을 투명하게 제공하지 못함을 입증한다.

• 인터넷정보학회논문지
• /
• 제9권5호
• /
• pp.23-34
• /
• 2008

웹 기반 서비스가 다양한 형태로 제공되면서 웹 서비스 사용자 수는 꾸준히 증가하고 있다. 그러나 웹 서버에 대한 SQL Injection, Parameter Injection 및 DoS 등의 공격 등의 취약점이 발견되고 있다. 이와 같은 형태의 웹 공격에 능동적으로 대응하기 위해 현재 웹 IDS 시스템을 구축하여 룰 기반 대응 시스템을 구축하고 있으나, 웹 서버에서 생성되는 로그 정보에 대한 전처리 과정 없이 룰 기반 IDS 시스템이 구동되기 때문에 효율적인 웹 공격 대응체계가 구축되지 못하고 있다. 이에 본 연구에서는 웹 로그 정보를 웹 IDS 기반 공격 탐지 시스템의 룰 비교 특성에 적합한 형태로 전처리하는 알고리즘을 제시하고 이를 구현하였다. 제안한 알고리즘은 웹 로그 정보에 대한 필드 단위 파싱 및 중복 문자열 처리 과정을 고속으로 수행하여 대용량의 로그 처리시 성능을 향상시켜 개선된 웹 IDS 시스템 구축이 가능하다.