• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2021.10a
• /
• pp.449-451
• /
• 2021

Cyber-attacks targeting endpoints have developed sophisticatedly into targeted and intelligent attacks, Advanced Persistent Threat (APT) targeting the Industrial Internet of Things (IIoT) has increased accordingly. Machine learning-based Endpoint Detection and Response (EDR) solutions combine and complement rule-based conventional security tools to effectively defend against APT attacks are gaining attention. However, universal EDR solutions have a high false positive rate, and needs high-level analysts to monitor and analyze a tremendous amount of alerts. Therefore, the process of optimizing machine learning-based EDR solutions that consider the characteristics and vulnerabilities of IIoT environment is essential. In this study, we analyze the flow and impact of IIoT targeted APT cases and compare the method of machine learning-based APT detection EDR solutions.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.6
• /
• pp.1087-1098
• /
• 2023

The rapid advancement of artificial intelligence (AI) technology has led to its proactive utilization across various fields. However, this widespread adoption of AI-based systems has raised concerns about the increasing threat of attacks on these systems. In particular, deep neural networks, commonly used in deep learning, have been found vulnerable to adversarial attacks that intentionally manipulate input data to induce model errors. In this study, we propose a method to protect image classification models from visually imperceptible One-Pixel attacks, where only a single pixel is altered in an image. The proposed defense technique utilizes an autoencoder model to remove potential threat elements from input images before forwarding them to the classification model. Experimental results, using the CIFAR-10 dataset, demonstrate that the autoencoder-based defense approach significantly improves the robustness of pretrained image classification models against One-Pixel attacks, with an average defense rate enhancement of 81.2%, all without the need for modifications to the existing models.

• Korean Security Journal
• /
• no.39
• /
• pp.295-317
• /
• 2014

In advanced country, private investigation system is made up of private security and in domestic, there is growing need constantly to introduce private investigation but it is not passed until now in assembly so a messenger office which is run illegally is growing because of demand by subdividing business areas. That is a proof that both the police and private security don't meet demand of public peace to the public. that's why the police has own businesses like a investigation, traffic, intelligence, crime prevention and private security's business areas are limited like a facilities security, escort security, protection of a person, machine security, special security as the Private Security Act. This study attempts to know structural difference between private security system and private investigation system in case private investigation system becomes one of the private security. on some question, respondents reply like that private security and private investigation is very different(71.2%), different(22.4%), average(6.3%), similar(0.0%), very similar(0.0%). the result seems like respondents recognize private security and private investigation as different businesses. In the result of non-quantity analysis, the differences seem like a business character, expense, business scope, public power, scale of organization, object of threat, legislation. In domestic, effort to legislate private investigation system has undergone difficulty since congressman Ha Soon Bong's motion in 1999 and today, congressman Yoon Jae Ok's All Amendments Private Security Act and congressman Song Young Geun's Private Inveswtigation Act are pending in assembly. This study's result is intended for examining difference in exploration between private security and private investigation and then there is going to propose to the policy in case private investigation system is passed in assembly by amending Private Security Act like congressman Yoon Jea Ok's All Amendment Private Security Act.

• Journal of Digital Convergence
• /
• v.16 no.2
• /
• pp.117-126
• /
• 2018

The threat to information security is growing globally. To this, organizations are increasing the weight of adapting and operating the more specialized information security policy and system. Information security requires participation from the employees who execute the security system and policy, and to increase the level of organization's internal security, requires organization's systematic support to improve employees' information security compliance intention. This research finds the mechanism for improving employee's information security compliance intention by applying justice theory and goal setting theory in information security. We use structural equation modeling to verify the research hypothesis, and conducted a survey on the employees of organization with information security policy. In other words, this research performs verification of the research model based hypothesis which claims that security policy goal setting has positive influence on employee's level of security related justice recognition, and claims that justice has positive influence on compliance intention. The object of study is the employees of the organization that adapts information security policy, and 383 valid samples were collected via survey. Structural equation modeling was performed to verify the research hypothesis. The result shows that security policy goal factor (goal difficulty, goal specificity) improves employee's security related justice recognition, and that security related justice (distribution, process, and information justice) has positive influence on compliance intention. The result suggests the strategic approach directions for improving employees' compliance intention on organization's security policy.

• Korean Security Journal
• /
• no.24
• /
• pp.91-123
• /
• 2010

The threat factors available for occurrence given G20 Summit Meeting are expected leader terrorism, hostage terrorism, bomb terrorism, public facilities terrorism, and aircraft terrorism. As for the threat groups, which are expected in Korea, the North Korea, Islam extremist group, and the group such as NGO organization of being opposed to international meeting are regarded as having possibility of causing hazard. Thus, the purpose of this study is to suggest VIP Security-measure plans in the main site in preparation for G20 Summit Meeting. Accordingly, each country in the world is adopting 'the principle of Triple Ring' in common. Thus, it elicited a coping plan by 1st line(inner ring) 2nd line(middle ring) 3rd line(outer ring) based on this principle, and proposed even an opinion together that will need to be reflected in light of policy for the VIP security measures. In conclusion, as for the VIP Security-measure plans in the main site in preparation for G20 Summit Meeting, In the inner ring(safety sector), first, an intercepting measure needs to be devised for a spot of getting into and out of vehicles given the Straight Street. Second, the Walking Formation needs to be reinforced boldly in the exposed area. In the middle ring(security sector), first, the control plan needs to be devised by considering particularity of the main site. Second, there is necessity for adopting the efficient security badge operation plan that is included RFID function within security badge. In the outer ring(aid protective sector), first, there is necessity of preparing for several VIP terrorisms, of collecting information and intelligence, and of reinforcing the information collection system against terrorism under the cooperation with the overseas information agency. Second, the urgent measure training in time of emergency needs to be carried out toward security agent event manpower. Third, to maintain the certain pace in VIP motorcade, the efficient traffic control system needs to be operated. Finally, as for what will need to be reflected in light of policy for VIP security measures, first, there is necessity for allowing VIP residence to be efficiently dispersed to be distributed and controlled. Second, there is necessity for allowing impure element to misjudge or attack to be failed by utilizing diverse deception operations. Third, according to the reorganization in North Korea's Organization of the South Directed Operations, the powerful 'military-support measure' needs to be driven from this G20 Summit Meeting. For this, the necessity was proposed for further reinforcing the front back defense posture under the supervision of the Ministry of National Defense and for positively coping even with detecting and removing poison in preparation for CBR (chemical, biological, and radio-logical) terrorism.

• Korean Security Journal
• /
• no.39
• /
• pp.319-353
• /
• 2014

Cyber-based technologies are now ubiquitous around the glob and are emerging as an "instrument of power" in societies, and are becoming more available to a country's opponents, who may use it to attack, degrade, and disrupt communications and the flow of information. The globe-spanning range of cyberspace and no national borders will challenge legal systems and complicate a nation's ability to deter threats and respond to contingencies. Through cyberspace, competitive powers will target industry, academia, government, as well as the military in the air, land, maritime, and space domains of our nations. Enemies in cyberspace will include both states and non-states and will range from the unsophisticated amateur to highly trained professional hackers. In much the same way that airpower transformed the battlefield of World War II, cyberspace has fractured the physical barriers that shield a nation from attacks on its commerce and communication. Cyberthreats to the infrastructure and other assets are a growing concern to policymakers. In 2013 Cyberwarfare was, for the first time, considered a larger threat than Al Qaeda or terrorism, by many U.S. intelligence officials. The new United States military strategy makes explicit that a cyberattack is casus belli just as a traditional act of war. The Economist describes cyberspace as "the fifth domain of warfare and writes that China, Russia, Israel and North Korea. Iran are boasting of having the world's second-largest cyber-army. Entities posing a significant threat to the cybersecurity of critical infrastructure assets include cyberterrorists, cyberspies, cyberthieves, cyberwarriors, and cyberhacktivists. These malefactors may access cyber-based technologies in order to deny service, steal or manipulate data, or use a device to launch an attack against itself or another piece of equipment. However because the Internet offers near-total anonymity, it is difficult to discern the identity, the motives, and the location of an intruder. The scope and enormity of the threats are not just focused to private industry but also to the country's heavily networked critical infrastructure. There are many ongoing efforts in government and industry that focus on making computers, the Internet, and related technologies more secure. As the national intelligence institution's effort, cyber counter-intelligence is measures to identify, penetrate, or neutralize foreign operations that use cyber means as the primary tradecraft methodology, as well as foreign intelligence service collection efforts that use traditional methods to gauge cyber capabilities and intentions. However one of the hardest issues in cyber counterintelligence is the problem of "Attribution". Unlike conventional warfare, figuring out who is behind an attack can be very difficult, even though the Defense Secretary Leon Panetta has claimed that the United States has the capability to trace attacks back to their sources and hold the attackers "accountable". Considering all these cyber security problems, this paper examines closely cyber security issues through the lessons from that of U.S experience. For that purpose I review the arising cyber security issues considering changing global security environments in the 21st century and their implications to the reshaping the government system. For that purpose this study mainly deals with and emphasis the cyber security issues as one of the growing national security threats. This article also reviews what our intelligence and security Agencies should do among the transforming cyber space. At any rate, despite of all hot debates about the various legality and human rights issues derived from the cyber space and intelligence service activity, the national security should be secured. Therefore, this paper suggests that one of the most important and immediate step is to understanding the legal ideology of national security and national intelligence.

• Journal of National Security and Military Science
• /
• s.1
• /
• pp.113-154
• /
• 2003

We can feel the fear through the reports of outbreaking centers of terror. Also, we noticed through "the 9.11 terror" that there exists no safety zone from terrorism. However, we should question ourselves whether we are relaxing attention or ceasing anxiety too much in the perimeter, as in the peninsula of Korea. Through "the 9.11 terror", the vulnerability of the United State's homeland security has been exposed, giving a serious damage to the national pride. President Bush started the war against terror to strengthen global joints of anti-terrorism, identify terrorists and contribute to the global peace, adopting offensive realism including preemptive attack concept which means to remove the threat preemptively. In today's reality of international politics, where the inhuman, indiscriminate, and anti-civilizational international terror became greater, extending to the stage of war, the international societies' agony and focus lies on how to banish it. The 9.11 terrorism, which is a new form of terrorism, is being distinguished from conventional terrorism into new terrorism. New terrorism is a new form of terrorism meaning that you do not know the enemy, the goal does not exist and they conscientiously use the weapons of mass destruction. This paper is a work meant to help understanding new terrorism, the new form, by a comparative analysis with the conventional terrorism. Therefore the origin, concept and general characteristics new terrorism is picked out and the representative forms of it, which are suicide bombing, cyber, biochemical and nuclear terrorism, are analyzed in detail in theoretical manner.

• Journal of the Korea Safety Management & Science
• /
• v.15 no.4
• /
• pp.17-24
• /
• 2013

On this study, we extracted pending problem and controversial point from management of disaster such as terror for domestic massive performance and then, investigated countermeasure plan against disaster for massive performance through comparison and analysis between anti-disaster strategy of Korea and U.S. U.S are conducting security system actively for passenger of major facilities such as public institution. Nonetheless, In U.S that has the world's best security system, serious affair such as 911 terror and Boston marathon terror are continued to happen. When considering domestic situation that North Korea and South Korea are antagonistic to each other, it is judged when it is high time to prepare for threat of terrorism. Accordingly, On this study, through analyzing of latest terror attacks in U.S and disaster risk in the nation, we analyzed in detail countermeasure plan classified as legislation, operation of security system, instilling a sense. As the result of this analyzing, using by flow-chart, we suggested domestic optimized disaster management system for massive performance. Consequently, we propose to establish systematized disaster management system such as preliminary survey of disaster influence for massive performance.

• Journal of Internet of Things and Convergence
• /
• v.6 no.1
• /
• pp.9-15
• /
• 2020

Recently, interest in blockchain technology has increased. The data industry is increasingly growing around the world. In addition, databases which obtain important information such as personal data are targeted by hackers. Data exposed by attackers happen frequently. In 2017, OWASP announced SQL injection is a top 1 threat to web applications. However, the proportion of data security is the smallest in the data industry. To prevent data exposure, this paper proposes a method that can protect databases by using hybrid blockchain.

• Journal of Internet Computing and Services
• /
• v.16 no.6
• /
• pp.47-55
• /
• 2015

The conventional dynamic routing methods in Software Defined Networks (SDN) set the optimal routing path based on the minimum link cost, and thereby transmits the incoming or outgoing flows to the terminal. However, in this case, flows can bypass the middlebox that is responsible for security service and thus, thus the network can face a threat. That is, while determining the best route for each flow, it is necessary to consider a dynamic service chaining, which routes a flow via a security middlebox. Therefore, int this paper, we propose a new dynamic routing method that considers the dynamic flow routing method combined with the security service functions over the SDN.