• Journal of Communications and Networks
• /
• v.16 no.4
• /
• pp.397-406
• /
• 2014

Radio frequency (RF) jamming is a denial of service attack targeted at wireless networks. In resource-hungry scenarios with constant traffic demand, jamming can create connectivity problems and seriously affect communication. Therefore, the vulnerabilities of wireless networks must be studied. In this study, we investigate a particular type of RF jamming that exploits the semantics of physical (PHY) and medium access control (MAC) layer protocols. This can be extended to any wireless communication network whose protocol characteristics and operating frequencies are known to the attacker. We propose two efficient jamming techniques: A low-data-rate random jamming and a shot-noise based protocol-aware RF jamming. Both techniques use shot-noise pulses to disrupt ongoing transmission ensuring they are energy efficient, and they significantly reduce the detection probability of the jammer. Further, we derived the tight upper bound on the duration and the number of shot-noise pulses for Wi-Fi, GSM, and WiMax networks. The proposed model takes consider the channel access mechanism employed at the MAC layer, data transmission rate, PHY/MAC layer modulation and channel coding schemes. Moreover, we analyze the effect of different packet sizes on the proposed jamming methodologies. The proposed jamming attack models have been experimentally evaluated for 802.11b networks on an actual testbed environment by transmitting data packets of varying sizes. The achieved results clearly demonstrate a considerable increase in the overall jamming efficiency of the proposed protocol-aware jammer in terms of packet delivery ratio, energy expenditure and detection probabilities over contemporary jamming methods provided in the literature.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.10 no.4
• /
• pp.811-817
• /
• 2009

The rapid growth of network based IT systems has resulted in continuous research of security issues. Probe intrusion detection is an area of increasing concerns in the internet community. Recently, a number of probe intrusion detection schemes have been proposed based on various technologies. However, the techniques, which have been applied in many systems, are useful only for the existing patterns of probe intrusion. They can not detect new patterns of probe intrusion. Therefore, it is necessary to develop a new Probe Intrusion Detection technology that can find new patterns of probe intrusion. In this paper, we proposed a new network based probe intrusion detector(NePID) using anomaly traffic analysis and fuzzy cognitive maps that can detect intrusion by the denial of services attack detection method utilizing the packet analyses. The probe intrusion detection using fuzzy cognitive maps capture and analyze the packet information to detect syn flooding attack. Using the result of the analysis of decision module, which adopts the fuzzy cognitive maps, the decision module measures the degree of risk of denial of service attack and trains the response module to deal with attacks. For the performance evaluation, the "IDS Evaluation Data Set" created by MIT was used. From the simulation we obtained the max-average true positive rate of 97.094% and the max-average false negative rate of 2.936%. The true positive error rate of the NePID is similar to that of Bernhard's true positive error rate.

• Journal of Internet Computing and Services
• /
• v.9 no.4
• /
• pp.85-96
• /
• 2008

An authentication procedure on wired and wireless network will be done based on the registration and management process storing both the user's IP address and client device's MAC address information. However, existent MAC address registration/administration mechanisms were weak in MAC Spoofing attack as the attacker can change his/her own MAC address to client's MAC address. Therefore, an advanced mechanism should be proposed to protect the MAC address spoofing attack. But, existing techniques sequentially compare a sequence number on packet with previous one to distinguish the alteration and modification of MAC address. However, they are not sufficient to actively detect and protect the wireless MAC spoofing attack. In this paper, both AirSensor and AP are used in wireless network for collecting the MAC address on wireless packets. And then proposed module is used for detecting and protecting MAC spoofing attack in real time based on MAC Address Lookup table. The proposed mechanism provides enhanced detection/protection performance and it also provides a real time correspondence mechanism on wireless MAC spoofing attack with minimum delay.

• The Journal of the Korea Contents Association
• /
• v.10 no.3
• /
• pp.101-112
• /
• 2010

The recent trend of the hacking deals with all the IT infrastructure related to the profit of the companies. Presently, they attack the service itself, the source of the profit, while they tried to access to the service infrastructure through the non-service port in the past. Although they affect the service directly, it is difficult to block them with the old security solution or the old system and they threaten more and more companies with the demand of money menacing the protection of customers and the sustainable management. This paper aims to design and implement multi-platform network packet scanner targeting the exception handling network intrusion detection system which determines normal, abnormal by traffic. Linux and unix have the various network intrusion detection and packet management tools like ngrep, snort, TCPdump, but most of them are based on CUI (Character based User Interface) giving users discomfort who are not used to it. The proposed system is implemented based on GUI(Graphical User Interface) to support the intuitive and easy-to-use interface to users, and using Qt(c++) language that supports multi-platform to run on any operating system.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2003.05c
• /
• pp.2257-2260
• /
• 2003

기존의 네트워크 기반의 IDS 는 쉘코드를 단순 매칭 함으로써 침입여부를 판별한다 이러한 방식은 알려진 공격에 대해서만 탐지할 수 있으며, 다형 쉘코드 및 IDS 우회 방법을 사용할 경우 탐지하지 못하는 문제점을 가진다. 따라서 본 논문에서는 Hidden Markov Model을 이용하여 자동화되고 효율적인 패킷 내용 기반의 침입 탐지기법을 제안한다.

• Proceedings of the KAIS Fall Conference
• /
• 2004.06a
• /
• pp.155-157
• /
• 2004

본 논문에서는 최근의 가장 대표적인 해킹 방법인 DDoS 공격도구들을 분석하고, DDoS 공격에 대한 기존에 제시된 대응방안들을 검토하여 보다 적절한 대응을 할 수 있는 DDoS 공격 탐지 및 대응 시스템을 설계한다. 제안된 시스템은 탐지 모듈에서 탐지된 공격에 대해 관리자에게 보고하여 적절한 대응을 하고 침입으로 판정되는 패킷들에 대해서는 필터링을 실시하여 네트워크 레벨에서 필터링하고 차단할 수 있는 장점을 살릴 수 있다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.12 no.3
• /
• pp.129-139
• /
• 2002

As internet expands, the possibility of attack through the network is increasing. So we need the technology which can detect the attack to the system or the network spontaneously. The purpose of this paper proposes the system to detect intrusion automatically using the Adaptive Resonance Theory2(ART2) which is one of artificial neural network The parameters of the system was tunned by ART2 algorithm using a lot of normal packets and various attack packets which were intentionally generated by attack tools. The results were compared and analyzed with conventional methods.

• Proceedings of the IEEK Conference
• /
• 2007.07a
• /
• pp.59-60
• /
• 2007

Entropy, one of leading metrics on anomalous traffic, attracts researcher's attention since a packet sampling and a traffic volume impact little on entropy value. In this paper, we apply the entropy metric to a domestic network traffic trace which has real anomalous traffics. We used source IP address/port and destination IP address/port that are important attributes of a packet as entropy variable We found that entropy value of multiple-port DoS attack shows something related to a staircase fashion. Also, we show a Possibility of detection of anomalous traffic on small time scale.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.6 no.6
• /
• pp.833-842
• /
• 2002

Computer security is considered important due to the side effect generated from the expansion of computer network and rapid increase of use of computers. A attack of intruders using a vulnerability of operating system, protocol and application programs. And so, The attack methods is to be high technology and professional. Thus It must be necessity that we necessary a solution to structure, management for framework of information technology. This paper develope intrusion detecting system for separating intruders form critical system and design IDS model and implementation of it.

• Journal of KIISE:Information Networking
• /
• v.31 no.4
• /
• pp.363-374
• /
• 2004

In this paper, we propose an in-line mode NIDS using network processors(NPs) that achieve performance comparable to ASIC and flexibility comparable to general-purpose processors. Even if many networking applications using NPs have been proposed, we cannot find any NP applications to NIDS in the literature. The proposed NIDS supports packet payload inspection detecting attacks, as well as packet filtering and traffic metering. In particular, we separate the filtering and metering functions from the complicated and time-consuming operations of the deep packet inspection function using two-level searching scheme, thus we can improve the performance, stability, and scalability of In-line mode system. We also implement a proto-type based on a PC platform and the Agere PayloadPlus (APP) 2.5G NP solution, and present a payload inspection algorithm to apply APP NP.