• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2012.05a
• /
• pp.584-587
• /
• 2012

MANET, which can be constructed with only terminal devices, has structural advantages of ease installation and operation, also has environmental change of rapid supply of smart phone, it's usage can be extended to application area likes as emergency communication, leasure, exploration and investigations. But, as one characteristic of MANET, no use of communicaton infrastructure caused disadvantage of weakness for information intrusion which is frequently occurred, nowadays. In this paper, the effects of IDS(Intrusion Detection System), one of defence tools for information intrusion, is analyzed for transmission performance. Blackhole attack is assumed as a type of intrusion, MANET defence with IDS from intrusions. Computer simulation based on NS-2 used for performance measurement. In this paper, performance measurement is done for application service to analyze application level effects of IDS. VoIP service is used as application service.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.6
• /
• pp.1181-1190
• /
• 2013

The GOOSE(Generic Object Oriented Substation Event) is used as a network protocol to communicate between IEDs(Intelligent Electronic Devices) in international standard IEC 61850 of substation automation system. Nevertheless, the GOOSE protocol is facing many similar threats used in TCP/IP protocol due to ethernet-based operation. In this paper, we develop a IDS(Intrusion Detection System) for secure GOOSE Protocol using open software-based IDS Snort. In this IDS, two security functions for keyword search and DoS attack detection are implemented through improvement of decoding and preprocessing component modules. And we also implement the GOOSE IDS and verify its accuracy using GOOSE packet generation and communication experiment.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.16 no.3
• /
• pp.65-76
• /
• 2006

This paper deals with an effective algerian aimed at improving the port scan detection in an intrusion detection system (IDS). In particular, a detection correlation algerian is proposed to maximize the detection capability in the network-based IDS whereby the 'misuse' is flagged for analysis to establish intrusion profile in relation to the overall port scan detection process. In addition, we establish an appropriate system maintenance policy for port scan detection as preprocessor for improved port scan in IDS, thereby achieving minimum false positive in the misuse detection engine while enhancing the system performance.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.6
• /
• pp.1279-1290
• /
• 2021

As vehicle technology has grown, autonomous driving that does not require driver intervention has developed. Accordingly, CAN security, an network of in-vehicles, has also become important. CAN shows vulnerabilities in hacking attacks, and machine learning-based IDS is introduced to detect these attacks. However, despite its high accuracy, machine learning showed vulnerability against adversarial examples. In this paper, we propose a adversarial CAN frame generation method to avoid IDS by adding noise to feature and proceeding with feature selection and re-packet for physical attack of the vehicle. We check how well the adversarial CAN frame avoids IDS through experiments for each case that adversarial CAN frame generated by all feature modulation, modulation after feature selection, preprocessing after re-packet.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.13 no.4
• /
• pp.141-151
• /
• 2017

Nowadays, It is undeniable that the threat of network security is growing as time flows due to worldwide development of wire/wireless, various Internet platform and sophisticated hacking techniques. The amount of traffics that Network security solution has to handle is increasing and recently many occurrence of explosive traffic attacks from PulseWave are being observed which has many similar characteristics to New DDos. Medium and small sized firms abroad have developed and distributed Snort and Suricata that are based on open-source Intrusion Detection System(IDS) / Intrusion Prevention System (IPS). The goal of this study is to compare between Windows7 by applying suicata 4.0.0 32bit version and Ubuntu 16.04.3 LTS by applying suicata 4.0.0 version which is an open source Intrusion Detection System / Intrusion Protection System that uses multi threads method. This experiment's environment was set as followed C1100 server model of Dell, Intel Xeon CPU L5520 2.27GHz*2 with 8 cores and 16 threads, 72GB of RAM, Samsung SSD 250GB*4 of HDD which was set on RAID0. According to the result, Suricata in Ubuntu is superior to Suricata in Windows7 in performance and this result indicates that Ubuntu's performance is far advanced than Windows7. This meaningful result is derived because Ubuntu that applied Suricata used multi core CPU and RAM more effectively.

• Journal of the Korea Society of Computer and Information
• /
• v.11 no.2 s.40
• /
• pp.75-82
• /
• 2006

The service use management for keeping up stable and effective environment is hard little by little by according to increase of internet user and being complicated network environment of the Internet little by little. being various of the requirements of the service which is provided and the user demand. And the beginning flag security was limited in IDS, But recently the integrated civil management is coming to be considered seriously according to adventting IDS. Firewall , Security or system. The development of integrated security civil management system to analyze widely through observation and detection at Network or host base, the judgment of attack, and integrated analysis of infiltration information is necessary because of detecting the various type attack.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2007.05a
• /
• pp.1093-1095
• /
• 2007

As the networking and data communication technology is making progress, there has been an augmented concern about the security. Intrusion Detection and Prevention Systems have long being providing a reliable layer in the field of Network Security. Intrusion Detection System works on analyzing the traffic and finding a known intrusion or attack pattern in that traffic. But as the new technology provides betterment for the world of the Internet; it also provides new and efficient ways for hacker to intrude in the system. Hence, these patterns on which IDS & IPS work need to be updated. For detecting the power and knowledge of attackers we sometimes make use of Honey-pots. In this paper, we propose a Honey-pot architecture that automatically updates the Intrusion's Signature Knowledge Base of the IDS in a Network.

• Convergence Security Journal
• /
• v.10 no.3
• /
• pp.9-14
• /
• 2010

The network architecture and analysis model for evaluating the information security are presented to distribute the reliable and secure multimedia digital contents. Using the firewall and IDS, the function of the proposed model includes the security range, related data collection/analysis, level evaluation and strategy proposal. To develop efficient automatic analysis tool, the inter-distribution algorithm and network design based on the traffic analysis between web-server and user are needed. Furthermore, the efficient algorithm and design of DRM/PKI also should be presented before the development of the automatic information security model.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2002.11a
• /
• pp.391-395
• /
• 2002

Computer security is considered important due to the side effect generated from the expansion of computer network and rapid increase of use of computers. A attach of intruders using a vulnerability of operating system, protocol and application programs. And so, The attack methods is to be high technology and professional. Thus It must be necessity that we necessary a solution to structure, management for framework of information technology. This paper develope intrusion detecting system for separating intruders form critical system and design IDS model and implementation of it.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2002.04b
• /
• pp.967-970
• /
• 2002

광역 네트워크상에서 침입탐지는 백본망에서의 기가비트를 처리할 수 능력이 시스템에 필요로 하고 있다. 하지만 많은 loss 와 시스템 미치는 부하로 시스템 자체에 큰 영향을 미친다. 따라서 본 논문에서는 이러한 단점을 보완하기 위하여 백본망에 있는 각 local network 에 분산 에이전트를 설치하고, 여기에서 발생한 데이터를 다중회귀분석의 회귀계수를 메인 시스템에서 보내 처리함으로써 전체 및 각 Local 네트워크에 대한 밸런스를 조절하고, 감시하는 기능을 제공하는 시스템의 설계방법을 제시한다.