IP 주소 기반 사이버공격 실시간 및 통계적 가시화 방법 (A Real-Time and Statistical Visualization Methodology of Cyber Threats Based on IP Addresses)
-
- 정보보호학회논문지
- /
- 제30권3호
- /
- pp.465-479
- /
- 2020
국내·외 기업 및 기관들은 사이버위협으로부터 자신들의 IT 인프라를 안전하게 보호하기 위해 24시간/365일 모니터링 및 대응할 수 있는 보안관제센터를 활용하고 있다. 하지만, 현재 대부분의 보안관제센터는 전문 인력에 의한 수동분석과 텍스트 기반의 보안관제체계에 의존하는 태생적인 한계점을 안고 있다. 이러한 보안관제체계의 문제점들을 극복하기 위해 가시화 기술을 활용한 사이버위협 탐지·분석 연구가 활발하게 진행되고 있지만 이들 연구의 대부분은 보안관제 분야에 최적화되어 있지 않고, 많은 경우에 개별 기관에서만 활용할 수 있다는 제한이 따랐다. 따라서 본 논문에서는 보안관제 분야의 최종 목표인 실제 공격자 IP를 탐지할 수 있을 뿐만 아니라, 보안관제센터에서도 활용할 수 있는 새로운 가시화 방법론을 제안한다. 본 논문에서 제안하는 가시화 방법론의 핵심은 보안이벤트를 발생시킨 공격자(IP)의 행위정보를 실시간 및 추적(통계) 분석을 가능하게 하는 것이다. 제안된 가시화 방법론을 기반으로 개발된 시스템을 실제 보안관제센터에 성공적으로 적용하였으며, 실제 운영을 통해 다양한 공격자 IP를 탐지 및 분석하는데 성공함으로써 본 논문에서 제안한 가시화 방법론의 실용성 및 유효성을 검증했다.
Withe increased North Korea's security threats, the South Korean navy has been faced with deteriorating security environment. While North Korea has increased asymmetric forces in the maritime and underwater with the development of nuclear weapons, and China and Japan have made a large investment in the buildup of naval forces, the power of the Pacific fleet of the US, a key ally is expected to be weakened. The biggest threat comes from China's intervention in case of full-scale war with North Korea, but low-density conflict issues are also serious problems. North Korea has violated the Armistice Agreement 2,660 times since the end of Korean War, among which the number of marine provocations reaches 1,430 times, and the tension over the NLL issue has been intensifying. With tension mounting between Korea and Japan over the Dokdo issue and conflict escalating with China over Ieo do Islet, the US Navy has confronted situation where it cannot fully concentrate on the security of the Korean peninsula, which leads to need for strengthening of South Korea's naval forces. Let's look at naval forces of neighboring countries. North Korea is threatening South Korean navy with its increased asymmetric forces, including submarines. China has achieved the remarkable development of naval forces since the promotion of 3-step plan to strengthen naval power from 1989, and it now retains highly modernized naval forces. Japan makes an investment in the construction of stat of the art warship every year. Since Japan's warship boasts of its advanced performance, Japan's Maritime Self Defense Force is evaluated the second most powerful behind the US Navy on the assumption that submarine power is not included in the naval forces. In this situation, naval power construction of South Korean navy should be done in phases, focusing on the followings; First, military strength to repel the energy warship quickly without any damage in case of battle with North Korea needs to be secured. Second, it is necessary to develop abilities to discourage the use of nuclear weapons of North Korea and attack its nuclear facilities in case of emergency. Third, construction of military power to suppress armed provocations from China and Japan is required. Based on the above naval power construction methods, the direction of power construction is suggested as follows. The sea fleet needs to build up its war potential to defeat the naval forces of North Korea quickly and participate in anti-submarine operations in response to North Korea's provocations. The task fleet should be composed of 3 task flotilla and retain the power to support the sea fleet and suppress the occurrence of maritime disputes with neighboring countries. In addition, it is necessary to expand submarine power, a high value power asset in preparation for establishment of submarine headquarters in 2015, develop anti-submarine helicopter and load SLAM-ER missile onto P-3C patrol aircraft. In case of maine corps, division class military force should be able to conduct landing operations. It takes more than 10 years to construct a new warship. Accordingly, it is necessary to establish plans for naval power construction carefully in consideration of reality and future. For the naval forces to safeguard maritime sovereignty and contribute to national security, the acquisition of a huge budget and buildup of military power is required. In this regard, enhancement of naval power can be achieved only through national, political and military understanding and agreement. It is necessary to let the nation know that modern naval forces with improved weapon system can serve as comprehensive armed forces to secure the command of the sea, perform defense of territory and territorial sky and attack the enemy's strategic facilities and budget inputted in the naval forces is the essential source for early end of the war and minimization of damage to the people. If the naval power construction is not realized, we can be faced with a national disgrace of usurpation of national sovereignty of 100 years ago. Accordingly, the strengthening of naval forces must be realized.
Just before the Korean War, the total number of the North Korean troops was 198,380, while that of the ROK(Republic of Korea) army troops 105,752. That is, the total number of the ROK army troops at that time was 53.3% of the total number of the North Korean army. As of December 2008, the total number of the North Korean troops is estimated to be 1,190,000, while that of the ROK troops is 655,000, so the ROK army maintains 55.04% of the total number of the North Korean troops. If the ROK army continues to reduce its troops according to [Military Reform Plan 2020], the total number of its troops will be 517,000 m 2020. If North Korea maintains the current status(l,190,000 troops), the number of the ROK troops will be 43.4% of the North Korean army. In terms of units, just before the Korean War, the number of the ROK army divisions and regiments was 80% and 44.8% of North Korean army. As of December 2008, North Korea maintains 86 divisions and 69 regiments. Compared to the North Korean army, the ROK army maintains 46 Divisions (53.4% of North Korean army) and 15 regiments (21.3% of North Korean army). If the ROK army continue to reduce the military units according to [Military Reform Plan 2020], the number of ROK army divisions will be 28(13 Active Division, 4 Mobilization Divisions and 11 Local Reserve Divisions), while that of the North Korean army will be 86 in 2020. In that case, the number of divisions of the ROK army will be 32.5% of North Korean army. During the Korean war, North Korea suddenly invaded the Republic of Korea and occupied its capital 3 days after the war began. At that time, the ROK army maintained 80% of army divisions, compared to the North Korean army. The lesson to be learned from this is that, if the ROK army is forced to disperse its divisions because of the simultaneous invasion of North Korea and attack of guerrillas in home front areas, the Republic of Korea can be in a serious military danger, even though it maintains 80% of military divisions of North Korea. If the ROK army promotes the plans in [Military Reform Plan 2020], the number of military units of the ROK army will be 32.5% of that of the North Korean army. This ratio is 2.4 times lower than that of the time when the Korean war began, and in this case, 90% of total military power should be placed in the DMZ area. If 90% of military power is placed in the DMZ area, few troops will be left for the defense of home front. In addition, if the ROK army continues to reduce the troops, it can allow North Korea to have asymmetrical superiority in military force and it will eventually exert negative influence on the stability and peace of the Korean peninsular. On the other hand, it should be reminded that, during the Korean War, the Republic of Korea was attacked by North Korea, though it kept 53.3% of troops, compared to North Korea. It should also be reminded that, as of 2008, the ROK army is defending its territory with the troops 55.04% of North Korea. Moreover, the national defense is assisted by 25,120 troops of the US Forces in Korea. In case the total number of the ROK troops falls below 43.4% of the North Korean army, it may cause social unrest about the national security and may lead North Korea's misjudgement. Besides, according to Lanchester strategy, the party with weaker military power (60% compared to the party with stronger military power) has the 4.1% of winning possibility. Therefore, if we consider the fact that the total number of the ROK army troops is 55.04% of that of the North Korean army, the winning possibility of the ROK army is not higher than 4.1%. If the total number of ROK troops is reduced to 43.4% of that of North Korea, the winning possibility will be lower and the military operations will be in critically difficult situation. [Military Reform Plan 2020] rums at the reduction of troops and units of the ground forces under the policy of 'select few'. However, the problem is that the financial support to achieve this goal is not secured. Therefore, the promotion of [Military Reform Plan 2020] may cause the weakening of military defence power in 2020. Some advanced countries such as Japan, UK, Germany, and France have promoted the policy of 'select few'. However, what is to be noted is that the national security situation of those countries is much different from that of Korea. With the collapse of the Soviet Unions and European communist countries, the military threat of those European advanced countries has almost disappeared. In addition, the threats those advanced countries are facing are not wars in national level, but terrorism in international level. To cope with the threats like terrorism, large scaled army trops would not be necessary. So those advanced European countries can promote the policy of 'select few'. In line with this, those European countries put their focuses on the development of military sections that deal with non-military operations and protection from unspecified enemies. That is, those countries are promoting the policy of 'select few', because they found that the policy is suitable for their national security environment. Moreover, since they are pursuing common interest under the European Union(EU) and they can form an allied force under NATO, it is natural that they are pursing the 'select few' policy. At present, NATO maintains the larger number of troops(2,446,000) than Russia(l,027,000) to prepare for the potential threat of Russia. The situation of japan is also much different from that of Korea. As a country composed of islands, its prime military focus is put on the maritime defense. Accordingly, the development of ground force is given secondary focus. The japanese government promotes the policy to develop technology-concentrated small size navy and air-forces, instead of maintaining large-scaled ground force. In addition, because of the 'Peace Constitution' that was enacted just after the end of World War II, japan cannot maintain troops more than 240,000. With the limited number of troops (240,000), japan has no choice but to promote the policy of 'select few'. However, the situation of Korea is much different from the situations of those countries. The Republic of Korea is facing the threat of the North Korean Army that aims at keeping a large-scale military force. In addition, the countries surrounding Korea are also super powers containing strong military forces. Therefore, to cope with the actual threat of present and unspecified threat of future, the importance of maintaining a carefully calculated large-scale military force cannot be denied. Furthermore, when considering the fact that Korea is in a peninsular, the Republic of Korea must take it into consideration the tradition of continental countries' to maintain large-scale military powers. Since the Korean War, the ROK army has developed the technology-force combined military system, maintaining proper number of troops and units and pursuing 'select few' policy at the same time. This has been promoted with the consideration of military situation in the Koran peninsular and the cooperation of ROK-US combined forces. This kind of unique military system that cannot be found in other countries can be said to be an insightful one for the preparation for the actual threat of North Korea and the conflicts between continental countries and maritime countries. In addition, this kind of technology-force combined military system has enabled us to keep peace in Korea. Therefore, it would be desirable to maintain this technology-force combined military system until the reunification of the Korean peninsular. Furthermore, it is to be pointed out that blindly following the 'select few' policy of advanced countries is not a good option, because it is ignoring the military strategic situation of the Korean peninsular. If the Republic of Korea pursues the reduction of troops and units radically without consideration of the threat of North Korea and surrounding countries, it could be a significant strategic mistake. In addition, the ROK army should keep an eye on the fact the European advanced countries and Japan that are not facing direct military threats are spending more defense expenditures than Korea. If the ROK army reduces military power without proper alternatives, it would exert a negative effect on the stable economic development of Korea and peaceful reunification of the Korean peninsular. Therefore, the desirable option would be to focus on the development of quality of forces, maintaining proper size and number of troops and units under the technology-force combined military system. The tableau above shows that the advanced countries like the UK, Germany, Italy, and Austria spend more defense expenditure per person than the Republic of Korea, although they do not face actual military threats, and that they keep achieving better economic progress than the countries that spend less defense expenditure. Therefore, it would be necessary to adopt the merits of the defense systems of those advanced countries. As we have examined, it would be desirable to maintain the current size and number of troops and units, to promote 'select few' policy with increased defense expenditure, and to strengthen the technology-force combined military system. On the basis of firm national security, the Republic of Korea can develop efficient policies for reunification and prosperity, and jump into the status of advanced countries. Therefore, the plans to reduce troops and units in [Military Reform Plan 2020] should be reexamined. If it is difficult for the ROK army to maintain its size of 655,000 troops because of low birth rate, the plans to establish the prompt mobilization force or to adopt drafting system should be considered for the maintenance of proper number of troops and units. From now on, the Republic of Korean government should develop plans to keep peace as well as to prepare unexpected changes in the Korean peninsular. For the achievement of these missions, some options can be considered. The first one is to maintain the same size of military troops and units as North Korea. The second one is to maintain the same level of military power as North Korea in terms of military force index. The third one is to maintain the same level of military power as North Korea, with the combination of the prompt mobilization force and the troops in active service under the system of technology-force combined military system. At present, it would be not possible for the ROK army to maintain such a large-size military force as North Korea (1,190,000 troops and 86 units). So it would be rational to maintain almost the same level of military force as North Korea with the combination of the troops on the active list and the prompt mobilization forces. In other words, with the combination of the troops in active service (60%) and the prompt mobilization force (40%), the ROK army should develop the strategies to harmonize technology and forces. The Korean government should also be prepared for the strategic flexibility of USFK, the possibility of American policy change about the location of foreign army, radical unexpected changes in North Korea, the emergence of potential threat, surrounding countries' demand for Korean force for the maintenance of regional stability, and demand for international cooperation against terrorism. For this, it is necessary to develop new approaches toward the proper number and size of troops and units. For instance, to prepare for radical unexpected political or military changes in North Korea, the Republic of Korea should have plans to protect a large number of refugees, to control arms and people, to maintain social security, and to keep orders in North Korea. From the experiences of other countries, it is estimated that 115,000 to 230,000 troops, plus ten thousands of police are required to stabilize the North Korean society, in the case radical unexpected military or political change happens in North Korea. In addition, if the Republic of Korea should perform the release of hostages, control of mass destruction weapons, and suppress the internal wars in North Korea, it should send 460,000 troops to North Korea. Moreover, if the Republic of Korea wants to stop the attack of North Korea and flow of refugees in DMZ area, at least 600,000 troops would be required. In sum, even if the ROK army maintains 600,000 troops, it may need additional 460,000 troops to prepare for unexpected radical changes in North Korea. For this, it is necessary to establish the prompt mobilization force whose size and number are almost the same as the troops in active service. In case the ROK army keeps 650,000 troops, the proper number of the prompt mobilization force would be 460,000 to 500,000.
Recent trends show that the PRC has stepped aside its "army-centered approach" and placed greater emphasis on its Navy and Air Force for a wider range of operations, thereby reducing its ground force and harnessing its economic power and military technology into naval development. A quantitative growth of the PLA Navy itself is no surprise as this is not a recent phenomenon. Now is the time to pay closer attention to the level of PRC naval force's performance and the extent of its warfighting capacity in the maritime domain. It is also worth asking what China can do with its widening naval power foundation. In short, it is time to delve into several possible scenarios I which the PRC poses a real threat. With this in mind, in Section Two the paper seeks to observe the construction progress of PRC's naval power and its future prospects up to the year 2020, and categorize time frame according to its major force improvement trends. By analyzing qualitative improvements made over time, such as the scale of investment and the number of ships compared to increase in displacement (tonnage), this paper attempts to identify salient features in the construction of naval power. Chapter Three sets out performance evaluation on each type of PRC naval ships as well as capabilities of the Navy, Air Force, the Second Artillery (i.e., strategic missile forces) and satellites that could support maritime warfare. Finall, the concluding chapter estimates the PRC's maritime warfighting capability as anticipated in respective conflict scenarios, and considers its impact on the Korean Peninsula and proposes the directions ROK should steer in response. First of all, since the 1980s the PRC navy has undergone transitions as the focus of its military strategic outlook shifted from ground warfare to maritime warfare, and within 30 years of its effort to construct naval power while greatly reducing the size of its ground forces, the PRC has succeeded in building its naval power next to the U.S.'s in the world in terms of number, with acquisition of an aircraft carrier, Chinese-version of the Aegis, submarines and so on. The PRC also enjoys great potentials to qualitatively develop its forces such as indigenous aircraft carriers, next-generation strategic submarines, next-generation destroyers and so forth, which is possible because the PRC has accumulated its independent production capabilities in the process of its 30-year-long efforts. Secondly, one could argue that ROK still has its chances of coping with the PRC in naval power since, despite its continuous efforts, many estimate that the PRC naval force is roughly ten or more years behind that of superpowers such as the U.S., on areas including radar detection capability, EW capability, C4I and data-link systems, doctrines on force employment as well as tactics, and such gap cannot be easily overcome. The most probable scenarios involving the PRC in sea areas surrounding the Korean Peninsula are: first, upon the outbreak of war in the peninsula, the PRC may pursue military intervention through sea, thereby undermining efforts of the ROK-U.S. combined operations; second, ROK-PRC or PRC-Japan conflicts over maritime jurisdiction or ownership over the Senkaku/Diaoyu islands could inflict damage to ROK territorial sovereignty or economic gains. The PRC would likely attempt to resolve the conflict employing blitzkrieg tactics before U.S. forces arrive on the scene, while at the same time delaying and denying access of the incoming U.S. forces. If this proves unattainable, the PRC could take a course of action adopting "long-term attrition warfare," thus weakening its enemy's sustainability. All in all, thiss paper makes three proposals on how the ROK should respond. First, modern warfare as well as the emergent future warfare demonstrates that the center stage of battle is no longer the domestic territory, but rather further away into the sea and space. In this respect, the ROKN should take advantage of the distinct feature of battle space on the peninsula, which is surrounded by the seas, and obtain capabilities to intercept more than 50 percent of the enemy's ballistic missiles, including those of North Korea. In tandem with this capacity, employment of a large scale of UAV/F Carrier for Kill Chain operations should enhance effectiveness. This is because conditions are more favorable to defend from sea, on matters concerning accuracy rates against enemy targets, minimized threat of friendly damage, and cost effectiveness. Second, to maintain readiness for a North Korean crisis where timely deployment of US forces is not possible, the ROKN ought to obtain capabilities to hold the enemy attack at bay while deterring PRC naval intervention. It is also argued that ROKN should strengthen its power so as to protect national interests in the seas surrounding the peninsula without support from the USN, should ROK-PRC or ROK-Japan conflict arise concerning maritime jurisprudence. Third, the ROK should fortify infrastructures for independent construction of naval power and expand its R&D efforts, and for this purpose, the ROK should make the most of the advantages stemming from the ROK-U.S. alliance inducing active support from the United States. The rationale behind this argument is that while it is strategically effective to rely on alliance or jump on the bandwagon, the ultimate goal is always to acquire an independent response capability as much as possible.
오랜 논의와 노력 끝에 우리나라 상법 제6편 항공운송편이 신설되어 2011년 11월부터 시행되었다. 상법 항공운송편은 국내항공운송으로 인해 발생한 항공 운송인의 손해배상책임 문제와 항공기 운항으로 인해 발생한 지상 제3자에 대한 항공기운항자의 손해배상책임 문제 등을 규율하기 위해 제정되었다. 상법 항공운송편은 관련 국제 조약들과 항공선진국들의 국내입법을 충분히 비교 검토하여 우리 법으로 수용하였기 때문에 국제 기준에 부합한다는 장점도 있지만, 항공기운항자의 지상 제3자에 대한 손해배상책임 규정을 중심으로 다음과 같이 개선해야 할 내용들도 포함하고 있다. 첫째, 상법 항공운송편상 항공기운항자의 지상 제3자 손해에 대한 배상책임 한도액은 피해자에 대한 적절한 배상을 하기에는 너무 낮은 수준으로 규정되어 있어 상향될 필요성이 있다. 따라서 독일과 같이 2009년 체결된 일반위험협약 및 불법방해배상협약의 관련 내용을 수용하여 항공기의 중량에 따른 분류기준을 10단계로 세분화하고 총 책임한도액을 최대 7억 SDR까지 상향시키면서, 인적 손해에 대한 배상책임한도액은 기존의 법무부 검토안처럼 최근의 물가상승률을 반영하여 현 규정의 5배 수준인 1인당 62만5천SDR까지 상향 조정하는 방안을 생각해 볼 수 있다. 이 방안이 한 사고당 항공사에게 일반적으로 보험으로서 보장되는 단일배상책임한도액이나 다양화 된 항공기 제원을 반영하면서도 지상 제3자에게 현실에 맞는 적절한 손해배상을 할 수 있다는 점에서 가장 바람직하다고 본다. 둘째, 항공기운항자는 현 상법 항공운송편상 항공기 납치 공격이나 9 11 테러와 같은 항공기를 이용한 공격행위 등과 같은 항공기테러에 의한 지상 제3자의 손해에 대하여도 무과실책임을 부담한다. 이에 관하여는 항공기운항자에게 지나치게 가혹하고 불합리한 입법이라는 견해가 있지만, 항공기운항자에게도 일정 부분 테러를 방지할 법적 의무가 있고 피해를 입은 제3자 구제 측면에서 그것이 항공기운항자에게 지나치게 가혹하거나 불합리하다고 생각되지는 않는다. 그러나 9 11테러와 같이 조직화 된 테러단체에 의해 항공기가 테러에 이용되어 지상 제3자 피해가 발생한 경우에도 항공기운항자가 피해자들에게 무과실책임을 지도록 하는 것은 불합리하며, 이러한 경우에는 항공기운항자의 책임이 면제되는 방향으로 상법 항공운송편 규정은 개정되어야 할 것이다. 셋째, 항공기사고와 같은 항공기 운항으로 인한 피해의 엄청난 규모를 고려해 볼 때, 다수의 피해자들이 경제적 어려움에 직면할 수 있으므로 항공여객의 인적 손해에 대한 항공운송인의 배상책임 발생 시 적용되는 선급금 지급 규정을 항공기운항자의 책임 발생 사례에도 준용할 필요가 있다고 본다. 넷째, 현행 상법 항공운송편상 항공기운항자의 손해배상책임 규정은 항공기 운항으로 인한 피해가 지상 또는 수면 및 수중에서 발생된 경우에만 적용되고 공중에서 발생한 피해에는 적용되지 않는다. 하지만 다른 항공기의 운항으로 인한 공중에서 발생된 항공기 등의 손해가 지상이나 수면 및 수중에서 발생한 손해와 차이가 있다고 볼 수 없다. 그러므로 상법 항공운송편상 '지상 제3자'라는 용어에서 '지상'이란 용어를 삭제하여 다른 항공기 운항으로 인한 공중에서의 항공기 등의 손해에도 상법 항공운송편상 항공기운항자의 지상 제3자 손해 배상책임 관련 규정이 적용될 수 있게 하는 것이 바람직하다고 본다. 위에서 제시된 상법 항공운송편상 항공기운항자의 지상 제3자 손해에 대한 배상책임 관련 규정의 개선방안 검토와 동 규정의 보완을 위한 지속적인 관심과 노력을 통하여, 상법 항공운송편이 피해를 입은 지상 등의 제3자에게 현실에 맞는 적절한 배상을 할 수 있게 하면서도 항공기운항자에게 과도한 부담을 지우지 않는 상호 간의 이익 균형상 더욱 바람직한 방향으로 발전되기를 희망한다.
중층트를 어구(漁具)의 소해심도(掃海深度)를 일정(一定)한 적정어획속도(適正漁獲速度)에서 기동성(機動性)있게 변화(變化)시키기 위하여 기초적인 모형어구(模型漁具)의 수조실험(水槽實驗)과 특별(特別)히 고안한 깊이바꿈틀을 이용(利用)한 이차(二次)에 걸친 해상시험(海上試驗)을 통(通)하여 연구한 결과를 요약(要約)하면 다음과 같다. 1. 중층(中層)트롤의 그물어구의 깊이 y는 끌줄의 길이 L과 단위(單位) 길이의 끌줄, 깊이바꿈틀 및 그물의 각(各) 수중중량(水中重量)