• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.3
• /
• pp.591-603
• /
• 2018

Windows Event Log is a format that records system log in Windows operating system and methodically manages information about system operation. An event can be caused by system itself or by user's specific actions, and some event logs can be used for corporate security audits, malware detection and so on. In this paper, we choose actions related to corporate security audit and malware detection (External storage connection, Application install, Shared folder usage, Printer usage, Remote connection/disconnection, File/Registry manipulation, Process creation, DNS query, Windows service, PC startup/shutdown, Log on/off, Power saving mode, Network connection/disconnection, Event log deletion and System time change), which can be detected through event log analysis and classify event IDs that occur in each situation. Also, the existing event log tools only include functions related to the EVTX file parse and it is difficult to track user's behavior when used in a forensic investigation. So we implemented new analysis tool in this study which parses EVTX files and user behaviors.

• International Journal of Computer Science & Network Security
• /
• v.23 no.2
• /
• pp.199-202
• /
• 2023

Carriage return (CR) and line feed (LF), also known as CRLF injection is a type of vulnerability that allows a hacker to enter special characters into a web application, altering its operation or confusing the administrator. Log poisoning and HTTP response splitting are two prominent harmful uses of this technique. Additionally, CRLF injection can be used by an attacker to exploit other vulnerabilities, such as cross-site scripting (XSS). Email injection, also known as email header injection, is another way that can be used to modify the behavior of emails. The Open Web Application Security Project (OWASP) is an organization that studies vulnerabilities and ranks them based on their level of risk. According to OWASP, CRLF vulnerabilities are among the top 10 vulnerabilities and are a type of injection attack. Automated testing can help to quickly identify CRLF vulnerabilities, and is particularly useful for companies to test their applications before releasing them. However, CRLF vulnerabilities can also lead to the discovery of other high-risk vulnerabilities, and it fosters a better approach to mitigate CRLF vulnerabilities in the early stage and help secure applications against known vulnerabilities. Although there has been a significant amount of research on other types of injection attacks, such as Structure Query Language Injection (SQL Injection). There has been less research on CRLF vulnerabilities and how to detect them with automated testing. There is room for further research to be done on this subject matter in order to develop creative solutions to problems. It will also help to reduce false positive alerts by checking the header response of each request. Security automation is an important issue for companies trying to protect themselves against security threats. Automated alerts from security systems can provide a quicker and more accurate understanding of potential vulnerabilities and can help to reduce false positive alerts. Despite the extensive research on various types of vulnerabilities in web applications, CRLF vulnerabilities have only recently been included in the research. Utilizing automated testing as a recurring task can assist companies in receiving consistent updates about their systems and enhance their security.

• International Journal of Computer Science & Network Security
• /
• v.22 no.1
• /
• pp.69-76
• /
• 2022

At the current stage of globalization and European integration of Ukraine, the aspects related to the effective fight against corruption in the system of economic security of our country are receiving more and more attention, as they become a prerequisite for continuing reforms based on international funding. In order to consider this issue and solve this problem, the necessary step is to develop and implement real mechanisms of the system for detecting and preventing corrupt behavior, which are based on international anti-corruption standards. The leading component of this system is the management of corruption risks in the system of economic security in order to identify them and implement measures to reduce them. This study analyzes the corruption perception index in Ukraine in recent years, which showed a positive, albeit somewhat slow dynamics of its growth, indicating a gradual increase in overcoming corruption through the introduction of a number of anti-corruption measures and changes. It is proved that the current stage of socio-economic development of the country contributes to strengthening the processes of combating corruption and preventing corruption risks, creating an effective and efficient anti-corruption system of the state. The concept of "corruption" was studied, it was found that in the field of public administration it is considered from different positions and is closely related to the concept of "corruption risks". The essence and features of corruption risks are studied, the preconditions of their occurrence are formulated, the relationship between the causes of corruption risks and economic security in the field of public authority has been established. The system of corruption risk management is considered and its components are characterized. It is proposed to increase the effectiveness of anticorruption policy through the implementation of measures aimed at investigating the causes of corruption risks, as well as developed effective and effective means of reducing corruption risks within the system of economic security

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.1
• /
• pp.25-38
• /
• 2017

Many security threats are occurring around the world due to the characteristics of industrial control systems that can cause serious damage in the event of a security incident including major national infrastructure. Therefore, the industrial control system network traffic should be analyzed so that it can identify the attack in advance or perform incident response after the accident. In this paper, we research the visualization technique as network forensics to enable reasonable suspicion of all possible attacks on DNP3 control system protocol, and define normal action based rules and derive visualization requirements. As a result, we developed a visualization tool that can detect sudden network traffic changes such as DDoS and attacks that contain anormal behavior from captured packet files on industrial control system network. The suspicious behavior in the industrial control system network can be found using visualization tool with Digital Bond packet.

• Journal of the Korean Institute of Intelligent Systems
• /
• v.23 no.5
• /
• pp.460-465
• /
• 2013

In this paper, we describe a security robot system to control human's behavior in the security area. In order to achieve these goals, we present a method for representing, tracking and human blocking by laserscanner systems in security area, with application to pedestrian tracking in a crowd. When it detects walking human who is for the security area, robot calculates his velocity vector, plans own path to forestall and interrupts him who want to head restricted area and starts to move along the estimated trajectory. While moving the robot continues these processes for adapting change of situation. After arriving at an opposite position human's walking direction, the robot advises him not to be headed more and change his course. The experimental results of estimating and tracking of the human in the wrong direction with the mobile robot are presented.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.6
• /
• pp.1493-1504
• /
• 2016

As cyber threats have been increased over the Internet, the invasions of personal information are constantly occurring. A malicious user can access the Web site as a normal user using leaked personal information and does illegal activities. This paper proposes an effective method which authenticates a genuine user with real-time. The method use the user's profile which is a record of user's behavior created by Membership Analysis(MA) and Markov Chain Model(MCM). In addition to, user's profile is augmented by a Time Weight(TW) which reflects the user's tendency. This method can detect a malicious user who camouflage normal user. Even if it is a genuine user, it can be determined as an abnomal user if the user acts beyond the record profile. The result of experiment showed a high accuracy, 96%, for the correct user.

• Steel and Composite Structures
• /
• v.42 no.1
• /
• pp.91-106
• /
• 2022

Concrete-filled square stainless steel tubes (CFSSST), which possess relatively large flexural stiffness, high corrosion resistance and require simple joint configurations and low maintenance cost, have a great potential in constructional applications. Despite that the use of stainless steel may result in high initial cost compared to their conventional carbon steel counterparts, the whole-life cost of CFSSST is however considered to be lower, which offers a competitive choice in engineering practice. In this paper, a comprehensive experimental and numerical program on 24 CFSSST stub column specimens, including 3 austenitic and 3 duplex stainless steel square hollow section (SHS) stub columns and 9 austenitic and 9 duplex CFSSST stub columns, has been carried out. Finite element (FE) models were developed to be used in parametric analysis to investigate the influence of the tube thickness and concrete strength on the ultimate capacities more accurately. Comparisons of the experimental and numerical results with the predictions made by design guides ACI 318, ANSI/AISC 360, Eurocode 4 and GB 50936 have been performed. It was found that these design methods generally give conservative predictions to the ultimate capacities of CFSSST stub columns. Improved calculation methods, developed based on the Continuous Strength Method, have been proposed to provide more accurate estimations of the ultimate resistances of CFSSST stub columns. The suitability of these proposals has been validated by comparison with the test results, where a good agreement between the predictions and the test results have been achieved.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.16 no.1
• /
• pp.98-106
• /
• 2012

CSD(Container Security Device) is a security device with sensors that can detect the abnormal behavior such as illegal opening of a container door. Since the CSD provides security and safety of the container, CSD should not only provide security services such as confidentiality and integrity but also cloning detection. If we can not detect the cloned CSD, an adversary can use the cloned CSD for many illegal purposes. In this paper, we propose a policy based cloned CSD detection mechanism. To evaluate proposed clone detection mechanism, we have implemented the proposed scheme and evaluated the results.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.20 no.1
• /
• pp.87-93
• /
• 2016

In this paper, we propose a new method to enhance an android security by exploiting a selective management of application permission. To that purpose, we analyze behavior of the current android security, via which we draw out possible vulnerabilities. After that, we develop a tool to implement the selective management of the application permission, witch has a function to give a permission selectively for the application when we install a new application. Via experiment we show validity of the developed tool in solving the drawn vulnerability in the current android security.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2012.10a
• /
• pp.804-807
• /
• 2012

Cloud service provider has to protect client's information securely since all the resources are offered by the service provider, and a large number of users share the resources. In this paper, a NoSQL-based anomaly detection system is proposed in order to enhance the security of mobile cloud services. The existing integrated security management system that uses a relational database can not be used for real-time processing of data since security log from a variety of security equipment and data from cloud node have different data format with unstructured features. The proposed system can resolve the emerging security problem because it provides real time processing and scalability in distributed processing environment.