• Journal of Internet of Things and Convergence
• /
• v.2 no.1
• /
• pp.17-21
• /
• 2016

The rapid development of IoT leads new kinds of services which does not existed. And, it requires several changes on existing network. Software Defined Network is one of the future network technology which can deal with problems from these kinds of changes. The strong point of Software Defined Network is flexibility and scalability. However, In some cases, these factors could be the security vulnerabilities. In this paper, we present adaptation of F(I)MEA technique for the security analysis on Software Defined Network Technology for IoT services.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.17 no.4
• /
• pp.77-83
• /
• 2021

As Open Source Software(OSS) recently invigorates, many companies actively use the OSSes in their business software. With such OSS invigoration, our web application is developed in order to provide the safety in using the OSSes, and update the information on the new vulnerabilities and the patches at all times by crawling the web pages of the relevant OSS home pages and the managing organizations of the vulnerabilities. By providing the updated information, our application helps the OSS users and developers to be aware of such security issues, and gives them to work in the safer environment from security risks. In addition, our application can be used as a security platform to greatly contribute to preventing potential security incidents not only for companies but also for individual developers.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.17 no.2
• /
• pp.51-59
• /
• 2007

Software testing is the process of analyzing a software item to detect the differences between existing and required conditions and to evaluate the features of the software item. A traditional testing focuses on proper functionality, not security testing. Fuzzing is a one of many software testing techniques and security testing. Fuzzing methodology has advantage that low-cost, efficiency and so on. But fuzzing has defects such as intervening experts. Also, if there is no specification, fuzzing is impossible. ROAD Tool is automated testing tool for RPC(Remote Procedure Call) based protocol and software without specification. Existing tools are semi-automated. Therefore we must modify these tools. In this paper, we design and implement ROAD tool. Also we verify utility in testing results.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.15 no.2
• /
• pp.580-599
• /
• 2021

Software-Defined Networking (SDN) has three key features: separation of control and forwarding, centralized control, and network programmability. While improving network management flexibility, SDN has many security issues. This paper systemizes the security threats of SDN using spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege (STRIDE) model to understand the current security status of SDN. First, we introduce the network architecture and data flow of SDN. Second, we analyze security threats of the six types given in the STRIDE model, aiming to reveal the vulnerability mechanisms and assess the attack surface. Then, we briefly describe the corresponding defense technologies. Finally, we summarize the work of this paper and discuss the trends of SDN security research.

• International Journal of Computer Science & Network Security
• /
• v.22 no.9
• /
• pp.376-388
• /
• 2022

The expansion of new applications and business models is being significantly fueled by the development of Fifth Generation (5G) networks, which are becoming more widely accessible. The creation of the newest intelligent vehicular networks and applications is made possible by the use of Vehicular Ad hoc Networks (VANETs) and Software Defined Networking (SDN). Researchers have been concentrating on the integration of SDN and VANET in recent years, and they have examined a variety of issues connected to the architecture, the advantages of software-defined VANET services, and the new features that can be added to them. However, the overall architecture's security and robustness are still in doubt and have received little attention. Furthermore, new security threats and vulnerabilities are brought about by the deployment and integration of novel entities and a number of architectural components. In this study, we comprehensively examine the good and negative effects of the most recent SDN-enabled vehicular network topologies, focusing on security and privacy. We examine various security flaws and attacks based on the existing SDVN architecture. Finally, a thorough discussion of the unresolved concerns and potential future study directions is provided.

• International Journal of Computer Science & Network Security
• /
• v.22 no.9
• /
• pp.231-243
• /
• 2022

The expansion of new applications and business models is being significantly fueled by the development of Fifth Generation (5G) networks, which are becoming more widely accessible. The creation of the newest intelligent vehicular net- works and applications is made possible by the use of Vehicular Ad hoc Networks (VANETs) and Software Defined Networking (SDN). Researchers have been concentrating on the integration of SDN and VANET in recent years, and they have examined a variety of issues connected to the architecture, the advantages of software defined VANET services, and the new features that can be added to them. However, the overall architecture's security and robustness are still in doubt and have received little attention. Furthermore, new security threats and vulnerabilities are brought about by the deployment and integration of novel entities and several architectural components. In this study, we comprehensively examine the good and negative effects of the most recent SDN-enabled vehicular network topologies, focusing on security and privacy. We examine various security flaws and attacks based on the existing SDVN architecture. Finally, a thorough discussion of the unresolved concerns and potential future study directions is provided.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.5
• /
• pp.1169-1178
• /
• 2012

Recently, since the most software intensive systems are using internet environment for data exchange, the software security is being treated as a big issue. And, to minimize vulnerability of software system, security ensuring steps which are applying secure coding rules, are introduced in the software development process. But, since actual attacks are using a variety of software vulnerabilities, it is hard to analyze software weakness by monotonic analysis. In this paper, it is tried to against the complex attack on the variety of software vulnerability using the coupling which is one of the important characteristic of software. Furthermore, pre-analysis of the complex attack patterns using a combination of various attack methods, is carried out to predict possible attack patterns in the relationship between software modules. And the complex attack pattern analysis method is proposed based on this result.

• Journal of Internet Computing and Services
• /
• v.17 no.5
• /
• pp.25-32
• /
• 2016

There has been a rapid growth in the development of mobile application resulting from its wide usage for online transaction, data storage and exchange of information. However, an important issue that has been overlooked is the lack of emphasis on the security issues at the early stage of the development. In fact, security issues have been kept until the later stage of the implementation of mobile apps. Requirements engineers frequently ignore and incorrectly elicit security related requirements at the early stage of mobile application development. This scenario has led to the failure of developing secure and safe mobile application based on the needs of the users. As such, this paper intends to provide further understanding of the real challenges in extracting security attributes for mobile application faced by novice requirements engineers. For this purpose, two experiments on eliciting security attributes requirements of textual requirements scenario were conducted. The performance related to the correctness and time taken to elicit the security attributes were measured and recorded. It was found that the process of eliciting correct security attributes for mobile application requires effort, knowledge and skills. The findings indicate that an automated tool for correct elicitation security attributes requirement could help to overcome the challenges in eliciting security attributes requirements, especially among novice requirements engineers.

• Journal of the Korea Society of Computer and Information
• /
• v.19 no.10
• /
• pp.117-124
• /
• 2014

Software Development Security is defined as a sequential procedure such as deleting potential security vulnerability for secure software development, designing or implementing various functions with considering security, and so on. In this paper, we research on domestic or international hacking cases that could damage us mentally or financially. Seventy five percent of Web-site attacks abuses weak points of application programs, or software. We also research on major issues related to software development security with these demerits. And then, we propose public and private laws, regulations, or systems and give some examples with detailed descriptions.

• Convergence Security Journal
• /
• v.19 no.4
• /
• pp.67-75
• /
• 2019

Recently, the Ministry of National Defense has included embedded software for weapon systems as targets for the Defense cyber security. The Concept has been extended and evolved from the cyber security area that was previously limited to the information domain. The software is becoming increasingly important in weapon systems, and it is clear that they are subject to cyber threats. Therefore, We would like to suggest a improvement direction by diagnosing problems in terms of cyber security of the weapon systems for the life cycle. In order to improve cyber security of weapon systems, comprehensive policy including the weapon embedded software management should be established and the involved stakeholder should be participated in the activities.