• Journal of Digital Contents Society
• /
• v.19 no.2
• /
• pp.327-334
• /
• 2018

When a PC is infected with a malicious code, it communicates with the control and command (C&C) server and, by the attacker's instructions, spreads to the internal network and acquires information. The company focuses on preventing attacks from the outside in advance, but malicious codes aiming at APT attacks are infiltrated into the inside somehow. In order to prevent the spread of the damage, it is necessary to perform internal monitoring to detect a PC that is infected with malicious code and attempts to communicate with the C&C server. In this paper, a destination IP monitoring method is proposed in this paper using Bloom filter to quickly and effectively check whether the destination IP of many packets is in the blacklist.

• Convergence Security Journal
• /
• v.12 no.3
• /
• pp.59-65
• /
• 2012

Clouding computing which is developing newly as IT and network technology develops become changed to internet and service environment of company. Especially, it can lend IT resource at low costs and no need to build up infra. Clouding computing environment become popular more and more because various computing environment using virtualization is provided. The attack threat range also becomes wider in proportion to broaden various connection ways and service supply range at these clouding computing. Therefore, intrusion detection system which can protect resource from various attack having malignant attempts is necessary. In this study, we analyzed about characteristic of intrusion detection system at cloud computing environment having big damage than other computing environment when intrusion happen by sharing of resource and virtualization.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.18 no.3
• /
• pp.602-608
• /
• 2014

Smartphones have become commonplace to use smart, BYOD (Bring Your Own Device) spread the trend of domestic WLAN use is intensifying as a result, the security threat will be greatly increased. Even though WLAN vendors such as Cisco Systems Inc,. Aruba networks released WIPS, MDM, DLP etc, however, these solutions can not be easily introduced for small business due to high cost or administrative reasons. In this paper, without the introduction of expensive H/W equipment, in WLAN environments, packet analysis, AP, Station management, security vulnerabilities can be analyzed by the proposed intrusion detection system.

• ETRI Journal
• /
• v.41 no.5
• /
• pp.585-598
• /
• 2019

A cyber-physical system (CPS) is a new mechanism controlled or monitored by computer algorithms that intertwine physical and software components. Advanced persistent threats (APTs) represent stealthy, powerful, and well-funded attacks against CPSs; they integrate physical processes and have recently become an active research area. Existing offensive and defensive processes for APTs in CPSs are usually modeled by incomplete information game theory. However, honeypots, which are effective security vulnerability defense mechanisms, have not been widely adopted or modeled for defense against APT attacks in CPSs. In this study, a honeypot game-theoretical model considering both low- and high-interaction modes is used to investigate the offensive and defensive interactions, so that defensive strategies against APTs can be optimized. In this model, human analysis and honeypot allocation costs are introduced as limited resources. We prove the existence of Bayesian Nash equilibrium strategies and obtain the optimal defensive strategy under limited resources. Finally, numerical simulations demonstrate that the proposed method is effective in obtaining the optimal defensive effect.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.5
• /
• pp.1011-1020
• /
• 2021

Throughout the years, cybersecurity incidents related to the shipbuilding and maritime industries are occurring more frequently as the IT industry develops. Accordingly, expertise in the information protection industry is necessary, and effective education contents on information protection are needed for this purpose. Recently, there have been more and more cases of increasing user experience by applying Metaverse technology to the educational field. Therefore, this study analyzes the existing information protection education and training and the information protection education contents in the maritime industries and proposes four directions for content development (i.e., online education and seminars, cybersecurity threat learning of virtual ships, accident reproduction, and maritime cybersecurity exhibition operation).

• International Journal of Computer Science & Network Security
• /
• v.21 no.12
• /
• pp.213-218
• /
• 2021

This paper proposes a technique for detecting a significant threat that attempts to get sensitive and confidential information such as usernames, passwords, credit card information, and more to target an individual or organization. By definition, a phishing attack happens when malicious people pose as trusted entities to fraudulently obtain user data. Phishing is classified as a type of social engineering attack. For a phishing attack to happen, a victim must be convinced to open an email or a direct message [1]. The email or direct message will contain a link that the victim will be required to click on. The aim of the attack is usually to install malicious software or to freeze a system. In other instances, the attackers will threaten to reveal sensitive information obtained from the victim. Phishing attacks can have devastating effects on the victim. Sensitive and confidential information can find its way into the hands of malicious people. Another devastating effect of phishing attacks is identity theft [1]. Attackers may impersonate the victim to make unauthorized purchases. Victims also complain of loss of funds when attackers access their credit card information. The proposed method has two major subsystems: (1) Data collection: different websites have been collected as a big data corresponding to normal and phishing dataset, and (2) distributed detection system: different artificial algorithms are used: a neural network algorithm and machine learning. The Amazon cloud was used for running the cluster with different cores of machines. The experiment results of the proposed system achieved very good accuracy and detection rate as well.

• International Journal of Computer Science & Network Security
• /
• v.21 no.12
• /
• pp.101-109
• /
• 2021

Cybercrimes are the biggest threat that can influence the future of e-commerce, particularly in difficult times such as the COVID-19 pandemic. This pandemic has resulted in noticeable changes in e-customer behaviour represented in three types: spending rates, types of goods bought, and the number of purchasing times. Moreover, the percentage of cybercrime in many countries, including Saudi Arabia, has increased during the pandemic. The increase in the number of cybercrimes during the COVID-19 crisis and the changes in consumer behaviour shows that there is an urgent need to conduct research on the factors that have led to this. This study will explore the most significant factors that have an effect on the unexpected change of customer behaviour and cybercrime perceived risk during the COVID-19 pandemic in Saudi Arabia. The finding of the study will hopefully contribute to attempts in finding safer methods for shopping online during COVID-19 and similar crisis.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.13 no.7
• /
• pp.3671-3689
• /
• 2019

Software defined networking brings unique security risks such as control plane saturation attack while enhancing the performance of wireless sensor networks. The attack is a new type of distributed denial of service (DDoS) attack, which is easy to launch. However, it is difficult to detect and hard to defend. In response to this, the attack threat model is discussed firstly, and then a DDoS attack prevention extension, called FuzzyGuard, is proposed. In FuzzyGuard, a control network with both the protection of data flow and the convergence of attack flow is constructed in the data plane by using the idea of independent routing control flow. Then, the attack detection is implemented by fuzzy inference method to output the current security state of the network. Different probabilistic suppression modes are adopted subsequently to deal with the attack flow to cost-effectively reduce the impact of the attack on the network. The prototype is implemented on SDN-WISE and the simulation experiment is carried out. The evaluation results show that FuzzyGuard could effectively protect the normal forwarding of data flow in the attacked state and has a good defensive effect on the control plane saturation attack with lower resource requirements.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.3
• /
• pp.439-445
• /
• 2012

Since an attacker can extract secret key of cryptographic device by occurring an error during encryption operation, the fault injection attack have become a serious threat in cryptographic system. In this paper, we show that an attacker can retrieve the 128-bits secret key in AES implementation adopted iterative statement for round operations using fault injection attack. To verify the feasibility of our attack, we implement the AES algorithm on ATmega128 microcontroller and try to inject a fault using laser beam. As a result, we can extract 128-bits secret key by obtaining just two pairs of correct and faulty ciphertexts.

• International Journal of Computer Science & Network Security
• /
• v.21 no.5
• /
• pp.23-30
• /
• 2021

In recent years, hazardous flash flooding has caused deaths and damage to infrastructure in Saudi Arabia. In this paper, our aim is to assess patterns and trends in climate means and extremes affecting flash flood hazards and water resources in Saudi Arabia for the purpose to improve risk assessment for forecast capacity. We would like to examine temperature, precipitation climatology and trend magnitudes at surface stations in Saudi Arabia. Based on the assessment climate patterns maps and trends are accurately used to identify synoptic situations and tele-connections associated with flash flood risk. We also study local and regional changes in hydro-meteorological extremes over recent decades through new applications of statistical methods to weather station data and remote sensing based precipitation products; and develop remote sensing based high-resolution precipitation products that can aid to develop flash flood guidance system for the flood-prone areas. A dataset of extreme events has been developed using the multi-decadal station data, the statistical analysis has been performed to identify tele-connection indices, pressure and sea surface temperature patterns most predictive to heavy rainfall. It has been combined with time trends in extreme value occurrence to improve the potential for predicting and rapidly detecting storms. A methodology and algorithms has been developed for providing a well-calibrated precipitation product that can be used in the early warning systems for elevated risk of floods.