• Proceedings of the Korea Information Processing Society Conference
• /
• 2005.11a
• /
• pp.1055-1058
• /
• 2005

최근 웹(World Wide WEb)은 전자상거래, e-commerce의 눈부신 성장과 더불어 그 이용률이 급격히 증가하였고, 이와 더불어 웹 취약점을 이용한 해킹사례도 증가하고 있다. 이 해킹 사례의 대부분은 웹 어플리케이션의 취약점을 이용한 것이다. 기존의 네트워크 침입탐지 시스템에서는 침입을 탐지하기 위해 시그너쳐 방법이 주로 사용되었다. 시그너쳐 방식은 시그너쳐를 기반으로 우수한 탐지율을 보인다. 그러나 웹 어플리케이션 공격은 다양한 원인과, 변형된 특성들을 가지고 있기 때문에 기존의 시그너쳐 기반의 방법으로는 특정한 패턴을 찾아내기가 곤란하다. 본 논문에서는 이를 보완할 수 있는 방법으로 프로파일 기반의 탐지방법을 제시한다.

• Journal of KIISE:Computing Practices and Letters
• /
• v.14 no.6
• /
• pp.589-593
• /
• 2008

These days, as a side effect of the growth of the mobile devices, malwares for the mobile devices also tend to increase and become more dangerous. Because embedded Linux is one of the advanced OSes on mobile devices, a solution to preventing malwares from infecting and destroying embedded Linux will be needed. We present a scheme using signature verification for embedded Linux that prevents executallle-Infecting malwares. The proposed scheme works under collaboration between mobile devices and a server. Malware detection is delegated to the server. In a mobile device, only integrity of all executables and dynamic libraries is checked at kernel level every time by kernel modules using LSM hooks just prior to loading of executables and dynamic libraries. All procedures in the mobile devices are performed only at kernel level. In experiments with a mobile embedded device, we confirmed that the scheme is able to prevent all executable-Infecting malwares while minimizing damage caused by execution of malwares or infected files, power consumption and performance overheads caused by malware check routines.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2001.04b
• /
• pp.1081-1084
• /
• 2001

리눅스 시스템의 급격한 사용증가에 비해 리눅스 보안에 대한 인식은 취약한 상태이며, 응용수준에서 제공되는 로깅시스템은 위.변조의 가능성이 높다. 특히 서버 데몬에서의 감시나 추적은 전적으로 응용수준에 의존하고 있는 상태이므로 현재의 특정한 자료나 연결 요청이 공격인지 아닌지를 판단하기에는 어려움이 많다. 본 논문에서는 리눅스의 시스템 호출 로깅 모듈인 리눅스 보안 모듈(LSM:Linux Security Module)을 이용하여 서버 데몬이나 유틸리티 등에 대해 선택적으로 응용프로그램에 대한 동작상태를 감사 및 추적하여 침입여부를 판단할 수 있도록 지원하는 응용 프로그램 로깅 시스템(ALOGS: Application Program Logging System)을 설계 및 구현하고자 한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2004.05a
• /
• pp.1165-1168
• /
• 2004

본 논문은 임베디드 장비에 사용되는 코어중 시장의 약 70% 이상을 점유하고 있는 ARM(Advanced RISC Machine) 코어에서의 BOF(Buffer OverFlow)에 대해서 논하고자 한다. 먼저, ARM 아키텍처에서 함수 호출시 스택의 변화에 대해서 기술하고 이 환경에서 시스템 공격 기법 중 가장 빈번한 BOF가 어떻게 이루어지는가에 대해서 설명한다. 그리고 ARM 아키텍처만이 가지는 특징을 이용하여 이에 대처하는 방법을 제안 한다.

• Proceedings of the KAIS Fall Conference
• /
• 2011.12b
• /
• pp.565-568
• /
• 2011

Google Android framework consists of an operating system and software platform for mobile devices. Using a general-purpose Linux operating system in mobile device has some advantages but also security risks. Security-Enhanced Linux (SELinux) is a kernel-based protection approach which can help to reduce potential damage from successful attacks. However, there are some challenges to integrate SELinux in Android. In this research, we do a study on how to do the integration and find out four challenges. The first one is that the Android file system (yaff2) does not support security namespace for extended attribute (xattr) which is required by SELinux. The second one is that it's difficult to apply SELinux policy to Dalvik process on which an Android application runs on. The third one is that Android lacks methods, tools and libraries to interact with SELinux. The last one is how to update the SELinux policy automatically when installing or removing an application. In this paper, we propose solutions for the above limitations that make the SELinux more adaptive and suitable for Android framework.

• Journal of Software Assessment and Valuation
• /
• v.17 no.1
• /
• pp.67-73
• /
• 2021

In this paper, a system configuration method that can practice Linux-based programming language online is presented. The proposed system utilizes the web-server function, which is the biggest feature of the Linux operating system, and simulates the telnet and FTP functions without firewalls or other security restrictions, so that it is possible to practice similar to the actual Linux console. To do this, we analyzed the functional elements that a programming tool should have on the web and established an algorithm to implement it. In particular, a method was implemented in which an error message caused by a user's mistake can appear in the same form as the actual telnet screen. As a result of using the implemented learning system in the class for students, it is possible to practice the Linux programming language online, as well as the instructor can directly check and guide all the learners, so the learner's satisfaction is similar to that of the offline class was confirmed.

• The Journal of the Korea Contents Association
• /
• v.5 no.5
• /
• pp.182-190
• /
• 2005

As computers and Internet become popular, many corporations and countries are using information protection system and security network to protect their informations and resources in internet. But the Intrusional possibilities are increases in open network environments such as the Internet. Even though many security systems were developed, the implementation of these systems are mostly application level not kernel level. Also many file protection systems were developed, but they aren't used widely because of their inconvenience in usage. In this paper, we implement a kernel module to support a file protection function using Loadable Kernel Module (LKM) on Linux. When a system is damaged due to intrusion, the file system are easily recovered through periodical file system image backup.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2001.11a
• /
• pp.33-38
• /
• 2001

역할기반 접근제어(RBAC : Role Based Access Control)는 임의적 접근제어와 강제적 접근제어에 비해 견고함과 유연성을 제공한다. 따라서 RBAC은 최근 금융시스템 및 병원시스템 등에서 많은 관심의 대상이 되고 있다. 본 논문에서는 안전성이 인증된 다중등급보안(MLS : Multi-Level Security) 리눅스를 이용하여 인터넷상에서 가상은행의 금융업무를 안전하게 처리할 수 있는 다중등급기반의 RBAC 시스템을 구현함을 보인다.

• Convergence Security Journal
• /
• v.4 no.2
• /
• pp.1-7
• /
• 2004

The growth of incidents on the Internet has reflected growth of the internet itself and growth of the computing Power. while in Previous years, external attacks tended to originate from those interested trend in exploring the Internet for its own sake and testing their skills, there is an increasing trend towards intrusions motivated by financial, Political, and military objectives. so, attacks on the nation's computer infrastructures are becoming an increasingly serious problem. Even though the problem is ubiquitious, government agencies are particularly appealing targets and they tend to be more willing to reveal such events than commercial organizations. The threat of damage made necessity of security's recognition, as a result, many researches have been carried out into security of system actively. Intrusion Detection technology is detection of intrusion using audit data differently from using traditional simple filtering and informs manager of it. It has security manager of system deal with the intrusion more quickly. but, cause current environment of Internet manager can't doing response Intrusion alert immediately That's why IPS needed. IPS can response automatically the intrusion alert. so, manager is more comfortable and can response quickly.

• 제어로봇시스템학회:학술대회논문집
• /
• 2003.10a
• /
• pp.622-627
• /
• 2003

The existing remote control system have some inherent disadvantage of direct control in the limit range. In some special cases, for example, a power apparatus, an unmanned factory, a nuclear factory, a security management system, the tele-operation is needed to control remote robot without limit space. This field is based on the Internet communication. Because the Internet is constructed all over the world. And it is possible that we control remote mobile robot in the long distance. In this paper, we developed a remote control system. This system is divided into two primary parts. These are local site and remote site. There are the moving robot and web server in the remote site and there is the robot control device in local site. The moving robot is moved by two stepper motors and the robot control device consists of SA-1100 micro controller and embedded Linux. And this controller is an embedded system. Public personal computer which is connected the Internet is used for the web server. The web server provides the mobile robot control interface program to the remote controller and captures the image for feedback information. In the whole system, a robot control device is connected with moving robot and web server through the Internet. So the operator can control the moving robot in the distance through the Internet.