• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.3
• /
• pp.535-545
• /
• 2014

As the software industry has developed, the attacks making use of software vulnerability has become a big issue in society. In particular, because the attacks using the vulnerability of web browsers bypass Windows protection mechanism, web browsers can readily be attacked. To protect web browsers against security threat, research on fuzzing has constantly been conducted. However, most existing web browser fuzzing tools use a simple fuzzing technique which randomly mutates DOM tree. Therefore, this paper analyzed existing web browser fuzzing tools and the patterns of their already-known vulnerability to propose an event and command based fuzzing tool which can detect the latest web browser vulnerability more effectively. Three kinds of existing fuzzing tools were compared with the proposed tool. As a result, it was found that the event and command based fuzzing tool proposed was more effective.

• Korean Security Journal
• /
• no.30
• /
• pp.7-32
• /
• 2012

Korea faces The 2014 Incheon Asian Games and 2018 Pyungchang Winter Olympics. It is imperative to hold a safe event for the economic benefits, enhancing Korea's image, social integration, national harmony and unity in order to be evaluated as a successful international event. Furthermore, since the international event tends to draw many spectators, the host country must be ready to accommodate a large number of injured people in the event of an accident or terror attack. As stadiums for international events are where a large number of spectators gather in, a large refuge is essential, when dangerous situations happen. In this study, evacuation simulation was conducted using three scenarios in order to predict escape behaviors of spectators during the large escape by destruction of safety systems of stadiums and assess escape safety. As the result, the following results and proposals were extracted. Firstly, it is considered that dangerous situations during the security of stadiums should be predicted in advance and concrete plans for a large refuge of spectators have to be established to minimize damage. Secondly, it was found that the reduction in evacuation exits has an important impact on evacuation in an emergency situation. It implies that securing escape exits are quite important. Thirdly, there were areas where spectators stayed, due to blocked escape exits, while they were dispersed and concentrated at once. It demonstrates that security plans considering properties of facilities are required to solve these problems.

• Journal of Information Technology Services
• /
• v.17 no.1
• /
• pp.33-45
• /
• 2018

Recently, many South Korean firms have suffered financial losses and damaged corporate images from the data breaches. Accordingly, a firm should manage their IT assets securely through an information security investment. However, the difficulty of measuring the return on an information security investment is one of the critical obstacles for firms in making such investment decisions. There have been a number of studies on the effect of IT investment so far, but there are few researches on information security investment. In this paper, based on a sample of 76 investment announcements of firms whose stocks are publicly traded in the South Korea's stock market between 2001 and 2017, we examines the market reaction to information security investment by using event study methodology. The results of the main effects indicate that self-developed is significantly related to cumulative average abnormal returns (CAARs), while no significant effect was observed for discloser, investment characteristics and firm characteristics. In addition, we find that the market reacts more favorably to the news announced by the subject of investment than the vendor, in case of investments with commercial exploitation. One of main contributions in our study is that it has revealed the factors affecting the market reaction to announcement of information security investment. It is also expected that, in practice, corporate executives will be able to help make an information security investment decision.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.3
• /
• pp.553-564
• /
• 2012

Today's security initiatives tend to integrate the physical and information securities which have been run by completely separate departments. That is, the converged security management becomes the core in the security market trend. However, to the best of our knowledge, we cannot find any solutions how to combine these two security events for the converged security. In this paper, we propose an information security object-driven approach which utilizes the physical security events to enhance and improve the information security. For scalability, we also present a systematic method using the analytic hierarchy process finding the meaningful event combinations among the large number of physical security events. In particular, we show the whole implementation processes in detail where we consider the information security object 'illegal computing system access' combined with two physical security devices - access controller and CCTV+video analyzer system.

• Convergence Security Journal
• /
• v.21 no.3
• /
• pp.13-23
• /
• 2021

The attacker's techniques and tools are becoming intelligent and sophisticated. Existing Anti-Virus cannot prevent security accident. So the security threats on the endpoint should also be considered. Recently, EDR security solutions to protect endpoints have emerged, but they focus on visibility. There is still a lack of detection and responsiveness. In this paper, we use real-world EDR event logs to aggregate knowledge-based MITRE ATT&CK and autoencoder-based anomaly detection techniques to detect anomalies in order to screen effective analysis and analysis targets from a security manager perspective. After that, detected anomaly attack signs show the security manager an alarm along with log information and can be connected to legacy systems. The experiment detected EDR event logs for 5 days, and verified them with hybrid analysis search. Therefore, it is expected to produce results on when, which IPs and processes is suspected based on the EDR event log and create a secure endpoint environment through measures on the suspicious IP/Process.

• Convergence Security Journal
• /
• v.2 no.2
• /
• pp.109-121
• /
• 2002

As the development of information technology and thus the growth of security incidents, there has been increasing demand on developing a system for centralized security management, also known as Enterprise Security Management(ESM), uniting functions of various security systems such as firewall, intrusion detection system, virtual private network and so on. Unfortunately, however, developers have been suffering with a lack of related standard. Although ISTF recently announced firewall system and intrusion detection system log format, it still needs for truly efficient ESM further development of the related standard including event and control messaging. This paper analyses ISTF standard and further suggests an additional event and control messaging standard for firewall and intrusion detection systems. It is expected that this effort would be helpful for the development of ESM and further related standard.

• Convergence Security Journal
• /
• v.5 no.2
• /
• pp.1-8
• /
• 2005

Network event analysis gives useful information on the network status that helps protect attacks. It involves finding sets of frequently used packet information such as IP addresses and requires real-time processing by its nature. Apriori algorithm used for data mining can be applied to find frequent item sets, but is not suitable for analyzing network events on real-time due to the high usage of CPU and memory and thus low processing speed. This paper develops a network event audit module by applying association rules to network events using a new algorithm instead of Apriori algorithm. Test results show that the application of the new algorithm gives drastically low usage of both CPU and memory for network event analysis compared with existing Apriori algorithm.

• Journal of Industrial Convergence
• /
• v.1 no.1
• /
• pp.127-142
• /
• 2003

This Study examines the implications for event studies using the daily stock data. The output present the event study results. The event period is defined from 30 days before through 30 days after the event date, and is broken into four "windows" for abnormal return cumulation: the pre-event period, days -30 through -2; dajys -1 and 0, a period commonly investigated for the immediate impact of the event; and the post-event period, days +1 through +30. It shows how firm's information offerings affect the price process and consequent issues. The Patell Z test is an examples of a standardized abnormal return approach, which estimate a separate standard error for each security-event and assumes cross-sectional independence. The generalized sign test adjusts for the fraction of positive abnormal returns in the estimation period instead of assuming 0.5.

• Convergence Security Journal
• /
• v.12 no.2
• /
• pp.61-70
• /
• 2012

The objective of this study is to achieve the most optimal data mining for effective analysis of false alarm event on mechanical security system. To perform this, this study searches the cause of false alarm and suggests the data conversion and analysis methods to apply to several algorithm of WEKA, which is a data mining program, based on statistical data for the number of case on movement by false alarm, false alarm rate and cause of false alarm. Analysis methods are used to estimate false alarm and set more effective reaction for false alarm by applying several algorithm. To use the suitable data for effective analysis of false alarm event on mechanical security analysis this study uses Decision Tree, Naive Bayes, BayesNet Apriori and J48Tree algorithm, and applies the algorithm by deducting the highest value.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.38B no.7
• /
• pp.589-595
• /
• 2013

The agents for security surveillance are not enough for monitoring CCTV system, so the intelligent automatic surveillance system is needed. In this paper, object detection, tracking and abnormal event detection system is implemented for intelligent CCTV system. Each modules are tested on the real CCTV environment and promoted for commercialization. Abnormal event detection module and loitering detection and sudden running detection function and it's detection time is under 1 second which is satisfied level.