• Convergence Security Journal
• /
• v.7 no.1
• /
• pp.19-27
• /
• 2007

Detecting unknown threats is a paradox ; how do you detect a threat if it is not known to exist? The answer is that unknown threat detection is the process of making a previously unknown threat identifiable in the shortest possible time frame. This paper examines the possibility of creating an unknown threat detection mechanism that security experts can use for developing a flexible protection system for networks. A system that allows the detection of unknown threats through monitoring system and the incorporation of dynamic and flexible logics with situational knowledge is described as well as the mechanisms used to develop such a system is illustrated. The system not only allows the detection of new threats but does so in a fast and efficient manner to increase the available time for responding to these threats.

• Journal of Information Processing Systems
• /
• v.15 no.4
• /
• pp.865-889
• /
• 2019

The need for cyber resilience is increasingly important in our technology-dependent society where computing devices and data have been, and will continue to be, the target of cyber-attackers, particularly advanced persistent threat (APT) and nation-state/sponsored actors. APT and nation-state/sponsored actors tend to be more sophisticated, having access to significantly more resources and time to facilitate their attacks, which in most cases are not financially driven (unlike typical cyber-criminals). For example, such threat actors often utilize a broad range of attack vectors, cyber and/or physical, and constantly evolve their attack tactics. Thus, having up-to-date and detailed information of APT's tactics, techniques, and procedures (TTPs) facilitates the design of effective defense strategies as the focus of this paper. Specifically, we posit the importance of taxonomies in categorizing cyber-attacks. Note, however, that existing information about APT attack campaigns is fragmented across practitioner, government (including intelligence/classified), and academic publications, and existing taxonomies generally have a narrow scope (e.g., to a limited number of APT campaigns). Therefore, in this paper, we leverage the Cyber Kill Chain (CKC) model to "decompose" any complex attack and identify the relevant characteristics of such attacks. We then comprehensively analyze more than 40 APT campaigns disclosed before 2018 to build our taxonomy. Such taxonomy can facilitate incident response and cyber threat hunting by aiding in understanding of the potential attacks to organizations as well as which attacks may surface. In addition, the taxonomy can allow national security and intelligence agencies and businesses to share their analysis of ongoing, sensitive APT campaigns without the need to disclose detailed information about the campaigns. It can also notify future security policies and mitigation strategy formulation.

• Convergence Security Journal
• /
• v.15 no.4
• /
• pp.83-90
• /
• 2015

Recent, Cyber attacks such as hacking and malicious code techniques are evolving very rapidly changing cyber a ttacks are increasing, the number of malicious code techniques vary accordingly become intelligent. In the case of m alware because of the ambiguity in the number of malware have increased rapidly by name or classified as maliciou s code may have difficulty coping with. This paper investigated the naming convention of the vaccine manufacturer s in Korea to solve this problem, the analysis and offers a naming convention for security control event detection r ule analysis to compare the pattern of the detection rule out based on this current.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.40 no.5
• /
• pp.841-850
• /
• 2015

XaaS (Everything as a Service) provides re-usable, fine-grained software components like software, platform, infra across a network. Then users usually pay a fee to get access to the software components. It is a subset of cloud computing. Since XaaS is provided by centralized service providers, it can be a target of various security attacks. Specially, if XaaS becomes the target of APT (Advanced Persistent Threat) attack, many users utilizing XaaS as well as XaaS system can be exposed to serious danger. So various solutions against APT attack are proposed. However, they do not consider all aspects of security control, synthetically. In this paper, we propose overall security checkup considering technical aspect and policy aspect to securely operate XaaS.

• Convergence Security Journal
• /
• v.11 no.3
• /
• pp.3-10
• /
• 2011

Recently, due to a series of DDoS attacks, government agencies have enhanced security measures and business-related legislation. However, service attack and large network violations or accidents are most likely to occur repeatedly in the near future. In order to prevent this problem, researches must be conducted to predict the vulnerability in advance. The existing research methods do not state the specific data used for the base of the prediction, making the method more complex and imprecise. Therefore this study was conducted using the vulnerability data used for the basis of machine learning technology prediction, which were retrieved from a reputable organization. Also, the study suggested ways to predict the future vulnerabilities based on the weaknesses found in prior methods, and certified the efficiency using experiments.

• Convergence Security Journal
• /
• v.20 no.5
• /
• pp.75-80
• /
• 2020

Damage caused by ransomware has continued to increase since last year, but cyber operations are managed without any separate classification of ransomware types in the military's guidelines for carrying out cyber operations. However, unlike other malware, ransomware is a threat that could paralyze all defense operations in one moment, and the military should reevaluate ransomware and take countermeasures. Accordingly, this paper aims to analyze the assets, vulnerabilities, and threats related to defense information service based on information security risk management, and propose alternatives to ensure continuity of defense work from ransomware threats.

• Journal of the Korean Society of Systems Engineering
• /
• v.17 no.2
• /
• pp.23-36
• /
• 2021

Recently, the rapid development of drones is increasing as a variety of threats to important facilities of the country. In order to build an anti-drone system that responds to drones with high technical characteristics, standardization is required in terms of operation, system, and technology. By applying the defense architecture framework, it contributes to the establishment of the optimal system by proposing a standardization plan for the operational and system perspectives of the anti-drone system by creating outputs equivalent to the stage of prior research on weapons systems. It is a prerequisite for building a drone system the operational concept of the anti-drone system, the definition of the drone threat, the function of each component, the interface, the definition of data flow, the system performance and effect scale, etc. Management, security officers, and equipment manufacturers of important national and public facilities on site expect that it will be used as an objective standard at the government level for the component technology of the equipment to respond to the drone threat and the performance required in the environment.

• Korean Security Journal
• /
• no.7
• /
• pp.125-154
• /
• 2004

Capitalism is based on a material desire of the human being. the social control of capital value and the management of capital ability reflects the actual condition of the capitalism well. The unconstrained growing and the expansion of capitalism, it finally lost social meaning and an importance of human being element and the safety of the civilian life, began to threat the security of citizen by forming over the material center structure of society. Improving human life quality and material richness on their life leads positive factor of capitalism whereas is causing several crimes through the society which is being threatened around a human being life for a negative factor of the capitalism. Therefore capitalistic social system has offered both a positive factor 'growing' and 'richness' and that of a negative 'structural poverty' and 'lack of security' and they have been remaining the assignment of capitalism 'poverty' and 'security' by settlement in the society for a extremely phenomenon of both sides. The objective of this research is to build its study theory and establish its causal relation by illuminating for the social environment of capitalism for a private guard or a development background of the civil security contributing for citizen security, as well as gets the clue of the development possibility of the civil guard and escort field and the development of capitalism. In Korea because their recognition of the study approach and the social safety for social security control function is still staying first step and our daily life is annoying from various threat of the society, many studies and the realistic necessity of experience related with social security is being studied. In addition, The development possibility of the civil guard and defense at the civil field which will be keep the social security has a wide position but its study approach and realistic comprehension is still in insufficient condition. Consequently, this research is started to grasp the security of civil fiend and to grope a development possibility through the research of capitalism.

• Convergence Security Journal
• /
• v.19 no.5
• /
• pp.99-105
• /
• 2019

In this study present the theoretical background and major trends in which cyber threats are securitization through the discourse process. In particular, this study explained based on the theory of Copenhagen school, which is critical of the security of cyber threats. And presented the security of non-traditional threats and the security of emerging security issues, which explained the process of security for cyber threats, based on existing research, and explained the limitations to this. And tried to provide a cautious point of view that the militarization phenomenon of cyber threats that is currently displayed is a phenomenon that is displayed through the combination of technical discourse and military discourse. Through this study, we aim to show the military the limits of universal solution presentation and the borderline perspective of militarization based on objective insights into the cyber threat security process.

• Convergence Security Journal
• /
• v.15 no.4
• /
• pp.121-126
• /
• 2015

Exposure of personal information that is held by hacking accident near the company has led to severe water level. And, it has changed security threat elements generated according to businessenterprise. Therefore, in this paper, I looked at security threat elements and proposed the way of appropriate information security consulting according type of company. First, In the financial and insurance industries, and should not have been compromised by a worm virus infection due to lack of awareness inside of members, by collectively apply in the same way the internal security standards of the organization to members, the risk of customer information. It shall be provided in advance that the security accident occurs due to a higher job group. Therefore, information security consulting method based on people and information is applied. Secondly, in industry of company, to perform consulting information security based on the attributes of the case industry groups.