• Journal of KIISE:Computing Practices and Letters
• /
• v.12 no.6
• /
• pp.339-348
• /
• 2006

Recently, many researches on detecting and responding worms due to the fatal infrastructural damages explosively damaged by automated attack tools, particularly worms. Network service vulnerability exploiting worms have high propagation velocity, exhaust network bandwidth and even disrupt the Internet. Previous worm researches focused on signature-based approaches however these days, approaches based on behavioral features of worms are more highlighted because of their low false positive rate and the attainability of early detection. In this paper, we propose a Distributed Worm Detection Model based on packet marking. The proposed model detects Worm Cycle and Infection Chain among which the behavior features of worms. Moreover, it supports high scalability and feasibility because of its distributed reacting mechanism and low processing overhead. We virtually implement worm propagation environment and evaluate the effectiveness of detecting and responding worm propagation.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.17 no.8
• /
• pp.2140-2156
• /
• 2023

The Wireless Sensor Network (WSN), is constructed out of teeny-tiny sensor nodes that are very low-cost, have a low impact on the environment in terms of the amount of power they consume, and are able to successfully transmit data to the base station. The primary challenges that are presented by WSN are those that are posed by the distance between nodes, the amount of energy that is consumed, and the delay in time. The sensor node's source of power supply is a battery, and this particular battery is not capable of being recharged. In this scenario, the amount of energy that is consumed rises in direct proportion to the distance that separates the nodes. Here, we present a Hybrid Firefly Glow-Worm Swarm Optimization (HF-GSO) guided routing strategy for preserving WSNs' low power footprint. An efficient fitness function based on firefly optimization is used to select the Cluster Head (CH) in this procedure. It aids in minimising power consumption and the occurrence of dead sensor nodes. After a cluster head (CH) has been chosen, the Glow-Worm Swarm Optimization (GSO) algorithm is used to figure out the best path for sending data to the sink node. Power consumption, throughput, packet delivery ratio, and network lifetime are just some of the metrics measured and compared between the proposed method and methods that are conceptually similar to those already in use. Simulation results showed that the proposed method significantly reduced energy consumption compared to the state-of-the-art methods, while simultaneously increasing the number of functioning sensor nodes by 2.4%. Proposed method produces superior outcomes compared to alternative optimization-based methods.

• Journal of KIISE:Information Networking
• /
• v.35 no.6
• /
• pp.474-481
• /
• 2008

Scanning worm increases network traffic load and result in severe network congestion because it is a self-replicating worm and send copies of itself to a number of hosts through the Internet. So an early detection system which can automatically detect scanning worms is needed to protect network from those attacks. Although many studies are conducted to detect scanning worms, most of them are focusing on the method using packet header information. The method using packet header information has long detection delay since it must examine the header information of all packets entering or leaving the network. Therefore we propose an algorithm to detect scanning worms using network traffic characteristics such as variance of traffic volume, differentiated traffic volume, mean of differentiated traffic volume, and product of mean traffic volume and mean of differentiated traffic volume. We verified the proposed algorithm by analyzing the normal traffic captured in the real network and the worm traffic generated by simulator. The proposed algorithm can detect CodeRed and Slammer which are not detected by existing algorithm. In addition, all worms were detected in early stage: Slammer was detected in 4 seconds and CodeRed and Witty were detected in 11 seconds.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.32 no.5B
• /
• pp.277-285
• /
• 2007

In this paper, we present a simulation model of Slammer worm propagation process which caused serious disruptions on Internet in the you of 2003 and analyze the process of Slammer by using NS-2. Recently introduced NS-2 modeling called "Detailed Network-Abstract Network Model" had enabled packet level analysis. However, it had deficiency of accommodating only small sized network. By extending the NS-2 DN-AN model to AN-AN model (Abstract Network-Abstract Network model), it is effectively simulated that the whole process from the initial infection to the total network congestion on hourly basis not only for the Korean network but also for the rest of the world networks. Furthermore, the progress of the propagation from Korean network to the other country was also simulated through the AN-AN model. 8,848 hosts in Korean network were infected in 290 second and 66,152 overseas hosts were infected in 308 second. Moreover, the scanning traffics of the worm at the Korean international gateway saturated the total bandwidth in 154 seconds for the inbound traffic and in 135 seconds for the outbound one.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.32 no.1C
• /
• pp.67-77
• /
• 2007

Virus throttling technique, one of many early worm detection techniques, detects Internet worm propagation by limiting connect requests within a certain ratio. The typical virus throttling controls the period of rate limiter autonomically by utilizing weighted average delay queue length to reduce connection delay time without hanving a large effect on worm detection time. In the existing virus throttling research, a minimum period of variable rate limiter is fired and a turning point which is a point that the period of rate limiter has been being decreased and starts to be increased is also fixed. However, these two performance factors have different effects on worm detection time and connection delay. In this paper, we analyze the effect of minimum period and turning point of variable rate limiter, and then propose an algorithm which determines values of performance factors by referencing current traffic pattern. Through deep experiments, it is verified that the proposed technique is more efficient in respect of reducing worm detection time and connection delay than the existing virus throttling which fixed the performance factors.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.4 no.3
• /
• pp.33-43
• /
• 2008

As internet is spreaded widely, the number of cyber terror using hacking and virus is increased. Also the hacking to the internet shopping mall go on increasing. If the large shopping mall is attacked by the hacker, a number of user's information are exposed to the hacker. The private information as like a resident registration number, user's real name, the date of user's birth, the mobile phone number, the office phone number / address, the home phone number / address and so on include the information. These information are used in the phishing e-mails / call and spam. And them are selling and buying maliciously. The large internet shopping mall 'auction' was hacked in April, 2008. After the incident, this paper suggested a countermeasures on the hacking for the internet shopping mall. The technical item and political item are included among the countermeasures. The countermeasures can protect the hacking not only the internet shopping mall but also the web sites basically.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.15 no.6
• /
• pp.37-47
• /
• 2005

Recently, the malicious e-mail worm-viruses have been widely spreaded over the Internet. If the recipient opens the e-mail attachment or an e-mail itself that contains the worm-virus, the worm-virus can be activated and then cause a tremendous damage to the system by propagating itself to everyone on the mailing list in the user's e-mail package. In this paper, we have designed and implemented two methods blocking e-mail worm-viruses. In the fist method, each e-mail is transmitted only by sender activity such as the click of button on a mail client application. In the second one, we insert the two modules into the sender side, where the one module transforms a recipient's address depending on a predefined rule only in time of pushing button and the other converts the address reversely with the former module whenever an e-mail is sent. The lader method also supports a polymorphism model in order to cope with the new types of e-mail worm-virus attacks. The two methods are designed not to work for the e-mail viruses. There is no additional fraction on the receiver's side of the e-mail system. Experimental results show that the proposed methods can screen the e-mail worm-viruses efficiently with a low overhead.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.18 no.1
• /
• pp.233-262
• /
• 2024

Due to the rapid evolution of vehicular ad hoc networks (VANETs), effective communication and security are now essential components in providing secure and reliable vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communication. However, due to their dynamic nature and potential threats, VANETs need to have strong security mechanisms. This paper presents a novel approach to improve VANET security by combining the Vehicular Delay-Tolerant Network (VDTN) protocol with the Deep Reinforcement Learning (DRL) technique known as the Twin Delayed Deep Deterministic Policy Gradient (TD3) algorithm. A store-carry-forward method is used by the VDTN protocol to resolve the problems caused by inconsistent connectivity and disturbances in VANETs. The TD3 algorithm is employed for capturing and detecting Worm Hole Attack (WHA) behaviors in VANETs, thereby enhancing security measures. By combining these components, it is possible to create trustworthy and effective communication channels as well as successfully detect and stop rushing attacks inside the VANET. Extensive evaluations and simulations demonstrate the effectiveness of the proposed approach, enhancing both security and communication efficiency.

• ETRI Journal
• /
• v.28 no.5
• /
• pp.692-695
• /
• 2006

Recently, there has been a constant barrage of worms over the Internet. Besides threatening network security, these worms create an enormous economic burden in terms of loss of productivity not only for the victim hosts, but also for other hosts, as these worms create unnecessary network traffic. Further, measures taken to filter these worms at the router level incur additional network delays because of the extra burden placed on the routers. To develop appropriate tools for thwarting the quick spread of worms, researchers are trying to understand the behavior of worm propagation with the aid of epidemiological models. In this study, we present an optimization model that takes into account infection and treatment costs. Using this model we can determine the level of treatment to be applied for a given rate of infection spread.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.32 no.8B
• /
• pp.529-538
• /
• 2007

In this paper, we have analyzed a simulation model of Slammer worm propagation process which caused serious disruptions on the Internet in the year of 2003 by using NS-2. Previously we had presented and analyzed Abstract Network to Abstract Network(AN-AN) model being modified from the Detailed Network to Abstract Network(DN-AN) of NS-2. However, packet analysis in AN-AN model had a problem of taking 240 hours to simulate the initial 300 seconds of infection. We have reduced the AN-AN model to save the simulation time and analyzed total 3.5 hours of the network congestions within 107 hours. Moreover, we have derived optimal quarantine rate of 0.0022 considering service outage of network devices caused by the heavy infected traffics, which was not taken into consideration in previous works. As the result of simulation, Although the inbound traffic at the Korean international gateway was back in normal conditions at 4,787 second, due to the revese direction saturation was maintained until 12,600 seconds, the service outage was persisted for 3.5 hours.