• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.19 no.1
• /
• pp.71-79
• /
• 2009

Currently much research is being done on host based intrusion detection using system calls which is a portion of kernel based data. Sequence based and frequency based preprocessing methods are mostly used in research for intrusion detection using system calls. Due to the large amount of data and system call types, it requires a significant amount of preprocessing time. Therefore, it is difficult to implement real-time intrusion detection systems. Despite this disadvantage, the frequency based method which requires a relatively small amount of preprocessing time is usually used. This paper proposes an effective method for detecting denial of service attacks using the frequency based method. Principal Component Analysis(PCA) will be used to select the principle system calls and a bayesian network will be composed and the bayesian classifier will be used for the classification.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2002.11a
• /
• pp.330-333
• /
• 2002

일반적으로 시스템들은 관리자를 위한 많은 로깅 기능을 제공한다. 이러한 로깅 기능에는 사용자 행위를 파악하는 부분도 제공하고 있으나 정작 사용자들이 입력하는 명령어를 직접 로깅하는 기능은 없거나 매우 미약하다. 시스템 사용자들이 입력한 명령어는 시스템 자체에서 사용자가 어떤 행위를 하였는가를 가장 확실히 보여주는 중요한 단서이다. 본 논문에서는 리눅스 커널을 기반으로 하여 사용자 키스트로크를 로그로 남길 수 있는 방법을 제안하고 구현한다.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2002.11a
• /
• pp.317-321
• /
• 2002

최근 Firewall, IDS와 같은 응용프로그램 수준의 보안 제품은 내부서버 자체의 취약성을 방어하지 못한다. 본 논문에서는 TCSEC C2급에 해당하는 보안성을 가지는 리눅스를 LKM(Loadable Kernel Module) 방법으로 B1급 수준의 다중등급 보안을 구현하였다, 따라서 구현된 다중등급 보안 리눅스 커널의 주요 기능을 기술하고, 시험 평가로서 강제적 접근제어, 성능 및 해킹 시험을 실시하였다. 구현된 보안 커널 기반의 리눅스 운영체제는 B1급의 요구사항을 만족하며, root의 권한 제한, DB를 이용한 실시간 감사추적, 해킹차단, 통합보안관리등의 추가적 기능을 제공한다.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2001.11a
• /
• pp.111-114
• /
• 2001

시스템 침입을 위해서 사용할 수 있는 공격 기법은 그 종류가 매우 다양하다. 그러나 최종적인 시스템 침입의 목표는 버퍼오버플로우 공격을 통한 관리자 권한의 획득이다. 버퍼오버플로우 현상은 메모리 공간의 경계 영역에 대한 프로그래밍 언어 수준의 검사 도구를 제공하지 않는 C/C++ 의 언어적 특성으로 인해 발생한다. 본 논문에서는 리눅스 커널 수준에서 시스템 보안을 위한 참조 모니터를 제안하고 이를 이용하여 버퍼오버플로우 공격에 대응할 수 있는 보안 기법을 제시한다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.10a
• /
• pp.832-834
• /
• 2003

오늘날과 같은 컴퓨터와 통신 기반의 네트워크 환경에서 서버들에 대한‘개방성’은 중요한 특징이다. 그러나, 이러한 특성은 서버에 대한 불법적인 접근이나 해킹 등과 같은 침입을 시도할 수 있는 가능성을 내포하고 있다. 침입의 목표는 서버의 모든 시스템정보로서 방화벽이나 침입탐지시스템 등과 같은 네트워크기반의 보안솔루션에 의해 서버의 모든 정보를 보호하기에는 한계가 있다. 본 논문에서는 서버들이 가지고 있는 정보를 보호하기 위하여 기존의 보안커널보다 더 유연하고 안전성이 강화된 보안커널의 설계에 필요한 필수적인 보안요소들을 제안하였다.

• The KIPS Transactions:PartC
• /
• v.18C no.3
• /
• pp.157-166
• /
• 2011

The virtualization layer is executed in higher authority layer than kernel layer and suitable for monitoring operating systems. However, existing virtualization monitoring systems provide simple information about the usage rate of CPU or memory. In this paper, the monitoring system using full virtualization technique is proposed, which can monitor virtual machine's dynamic kernel object as memory, register, GDT, IDT and system call table. To verify the monitoring system, the proposed system was implemented based on KVM(Kernel-based Virtual Machine) with full virtualization that is directly applied to linux kernel without any modification. The proposed system consists of KvmAccess module to access KVM's internal object and API to provide other external modules with monitoring result. In experiments, the CPU utilization for monitoring operations in the proposed monitering system is 0.35% when the system is monitored with 1-second period. The proposed monitoring system has a little performance degradation.

• 제어로봇시스템학회:학술대회논문집
• /
• 2003.10a
• /
• pp.2174-2177
• /
• 2003

Internet is exposed to network attacks as Internet has a security weakness. Network attacks which are virus, system intrusion, and deny of service, put Internet in the risk of hacking, so the damage of public organization and banking facilities are more increased. So, it is necessary that the security technologies about intrusion detection and controlling attacks minimize the damage of hacking. Router is the network device of managing traffic between Internets or Intranets. The damage of router attack causes the problem of the entire network. The security technology about router is necessary to defend Internet against network attacks. Router has the need of access control and security skills that prevent from illegal attacks. We developed integrated security management framework for secure networking and kernel-level security engine that filters the network packets, detects the network intrusion, and reports the network intrusion. The security engine on the router protects router or gateway from the network attacks and provides secure networking environments. It manages the network with security policy and handles the network attacks dynamically.

• 제어로봇시스템학회:학술대회논문집
• /
• 2005.06a
• /
• pp.1594-1597
• /
• 2005

A rapid development and a wide use of the Internet have expanded a network environment. Further, the network environment has become more complex due to a simple and convenient network connection and various services of the Internet. However, the Internet has been constantly exposed to the danger of various network attacks such as a virus, a hacking, a system intrusion, a system manager authority acquisition, an intrusion cover-up and the like. As a result, a network security technology such as a virus vaccine, a firewall, an integrated security management, an intrusion detection system, and the like are required in order to handle the security problems of Internet. Accordingly, a router, which is a key component of the Internet, controls a data packet flow in a network and determines an optimal path thereof so as to reach an appropriate destination. An error of the router or an attack against the router can damage an entire network. This paper relates to a method for RSMS (router security management system) for secure networking based on a security policy. Security router provides functions of a packet filtering, an authentication, an access control, an intrusion analysis and an audit trail in a kernel region. Security policy has the definition of security function against a network intrusion.

• Korean Journal of Computational Design and Engineering
• /
• v.11 no.5
• /
• pp.327-334
• /
• 2006

Recently, security incidents are growing rapidly in which internal employees let the drawing leak out to competitors or other countries. This type of security incidents has a characteristic that it occurs less frequently than other types of security incidents such as network or server security incident, but the damage is a lot more serious. The existing information security technologies to prevent internal information from being leaked out are only applicable to general documents(office documents, web pages and image files in which data are encrypted one by one). However, architectural drawings made up of collection of files with various formats(extensions) have problems with the process speed of en(de) cryption and accuracy, so the developments of security technologies by new methods are required. In this study, we design and develop a security technology based on work area with which users can protect the leakage of critical information in the kernel level while maintaining their work environment when they have to use sharing information that cannot be managed by the unit of file. As a result, we developed the "Virtual Secure Disk" which allows only authorized users and applications to have an access to drawings, and have verified its security by applying it to the actual company.

• Journal of Institute of Control, Robotics and Systems
• /
• v.13 no.8
• /
• pp.810-816
• /
• 2007

A security robot system named EGIS-SR is a mobile security robot through one of the new growth engine project in robotic industries. It allows home surveillance through an autonomous mobile platform using onboard cameras and wireless security sensors. EGIS-SR has many sensors to allow autonomous navigation, hierarchical control architecture to handle lots of situations in monitoring home surveillance and mighty networks to achieve unmanned security services. EGIS-SR is tightly coupled with a networked security environment, where the information of the robot is remotely connected with the remote cockpit and patrol man. It achieved an intelligent unmanned security service. The robot is a two-wheeled mobile robot and has casters and suspension to overcome a doorsill. The dynamic motion is verified through $ADAMS^{TM}$ simulation. For the main controller, PXA270 based hardware platform based on linux kernel 2.6 is developed. In the linux platform, data handling for various sensors and the localization algorithm are performed. Also, a local path planning algorithm for object avoidance with ultrasonic sensors and localization using $StarGazer^{TM}$ is developed. Finally, for the automatic charging, a docking algorithm with infrared ray system is implemented.