• Journal of Information Processing Systems
• /
• v.17 no.4
• /
• pp.834-850
• /
• 2021

IT security companies have been releasing file system filter driver security solutions based on the whitelist, which are being used by several enterprises in the relevant industries. However, in February 2019, a whitelist vulnerability was discovered in Microsoft Edge browser, which allows malicious code to be executed unknown to users. If a hacker had inserted a program that executed malicious code into the whitelist, it would have resulted in considerable damage. File system filter driver security solutions based on the whitelist are discretionary access control (DAC) models. Hence, the whitelist is vulnerable because it only considers the target subject to be accessed, without taking into account the access rights of the file target object. In this study, we propose an industrial device security system for Windows to address this vulnerability, which improves the security of the security policy by determining not only the access rights of the subject but also those of the object through the application of the mandatory access control (MAC) policy in the Windows industrial operating system. The access control method does not base the security policy on the whitelist; instead, by investigating the setting of the security policy not only for the subject but also the object, we propose a method that provides improved stability, compared to the conventional whitelist method.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.38B no.8
• /
• pp.641-653
• /
• 2013

Recent cyber attacks targeting control systems are getting sophisticated and intelligent notoriously. As the existing signature based detection techniques faced with their limitations, a whitelist model with security techniques is getting attention again. However, techniques that are being developed in a whitelist model used at the application level narrowly and cannot provide specific information about anomalism of various cases. In this paper, we classify abnormal cases that can occur in control systems of enterprises and propose a new whitelist model for detecting abnormal cases.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.38B no.8
• /
• pp.632-640
• /
• 2013

In this paper, we proposed a system in a wireless LAN environment in case of security threats, the mobile terminal and the remote server-based WLAN security. The security of the wireless LAN environment in the recent technology in a variety of ways have been proposed and many products are being launched such as WIPS and DLP. However, these products are expensive and difficult to manage so very difficult to use in small businesses. Therefore, in this paper, we propose a security system, wireless LAN-based terminal and a remote server using whitelist according to development BYOD market and smartphone hardware. The proposed system that AP and personal device information to be stored on the server by an administrator and Application installed on a personal device alone, it has the advantage that can be Applicationlied to a variety of wireless network environment.

• Journal of IKEEE
• /
• v.26 no.3
• /
• pp.380-388
• /
• 2022

The traditional malware detection technologies collect known malicious programs and analyze their characteristics. Then such a detection technology makes a blacklist based on the analyzed malicious characteristics and checks programs in the user's system based on the blacklist to determine whether each program is malware. However, such an approach can detect known malicious programs, but responding to unknown or variant malware is challenging. In addition, since such detection technologies generally monitor all programs in the system in real-time, there is a disadvantage that they can degrade the system performance. In order to solve such problems, various methods have been proposed to analyze major behaviors of malicious programs and to respond to them. The main characteristic of ransomware is to access and encrypt the user's file. So, a new approach is to produce the whitelist of programs installed in the user's system and allow the only programs listed on the whitelist to access the user's files. However, although it applies such an approach, attackers can still perform malicious behavior by performing a DLL(Dynamic-Link Library) injection attack on a regular program registered on the whitelist. This paper proposes a method to respond effectively to attacks using DLL injection.

• Journal of IKEEE
• /
• v.27 no.3
• /
• pp.239-245
• /
• 2023

Whitelist-based ransomware solution is known as being vulnerable to false impersonation attack using DLL injection attack. To solve this problem, it is proposed to monitor DLL injection attack and to integrate the monitoring result to ransomware solutions. In this paper, we show that attackers can easily bypass the monitoring mechanism and then illegally access files of a target system. It means that whitelist-based ransomware solutions are still vulnerable.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2022.05a
• /
• pp.195-197
• /
• 2022

In this paper, we intend to study the fundamental blocking methodology for the use of external commercial mail systems in the corporate internal Internet network, which is a common concern of public and administrative agencies. By checking the limitations of the blacklist-based blocking method used in the past, and by analyzing packet of the mail sending web page, the delimiter used for mail transmission is extracted, and the purpose is to monitor and block the leakage of intenal information of the company using whitelist technology.

• Proceedings of the Korean Information Science Society Conference
• /
• 2012.06a
• /
• pp.42-44
• /
• 2012

최근 안드로이드 애플리케이션의 수가 폭발적으로 증가함에 따라, 개인정보 유출 등 악성 행위를 하는 애플리케이션의 수 또한 증가하고 있다. 이에 대응하기 위해 스마트폰에서 개인정보 유출을 막기 위한 연구가 진행되어 왔으나, 이를 우회하는 악성코드도 지속적으로 출현하고 있다. 본 논문에서는 안드로이드 플랫폼에서 개인정보 유출을 방지하기 위해 안전한 저장소를 적용하는 방법을 제안한다. 기존의 UID와 퍼미션(Permission)에 의한 자원 접근제어와 달리, 안전한 저장소는 자원에 접근하는 주체의 권한(Privilege)에 관계없이 오직 app_Whitelist에 명시된 애플리케이션만이 해당 자원에 접근을 할 수 있도록 허용한다. 본 제안 방법을 위해 시스템 콜 후킹, 디렉터리명 변경, app_Whitelist 구축 등을 구현하였으며, 제안 방법을 적용하여 사용자 수준 및 커널 수준의 불법 데이터 접근을 차단할 수 있다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.2
• /
• pp.397-405
• /
• 2018

Blacklist-based tools are most commonly used to effectively detect suspected malicious processes. The blacklist-based tool compares the malicious code extracted from the existing malicious code with the malicious code. Therefore, it is most effective to detect known malicious codes, but there is a limit to detecting malicious code variants. In order to solve this problem, the necessity of a white list-based tool, which is the opposite of black list, has emerged. Whitelist-based tools do not extract features of malicious code processes, but rather collect reliable processes and verify that the process that checks them is a trusted process. In other words, if malicious code is created using a new vulnerability or if variant malicious code appears, it is not in the list of trusted processes, so it can effectively detect malicious code. In this paper, we propose a method for effectively building a whitelist through research that collects reliable processes in the macOS operating system.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.36 no.11B
• /
• pp.1297-1304
• /
• 2011

SIP(Session Initiation Protocol) has some security vulnerability because it works on the Internet. Therefore, the proxy server can be affected by the flooding attack such as DoS and service interruption. However, traditional schemes to corresponding Denial of Service attacks have some limitation. These schemes have high complexity and cannot protect to the variety of Denial of Service attack. In this paper, we newly define the normal user who makes a normal session observed by verifier module. Our method provides continuous service to the normal users in the various situations of Denial of Service attack as constructing a whitelist using normal user information. Various types of attack/normal traffic are modeled by using OPNET simulator to verify our scheme. The simulation results show that our proposed scheme can prevent DoS attack and achieve a low false rate and fast searching time.

• Information Systems Review
• /
• v.15 no.1
• /
• pp.25-43
• /
• 2013

The Korean Smartphone industry has advanced rapidly. There seems to have a considerable change in Korea smartphone industry as the security policy related to wireless devices is changed from Whitelist Policy to Blacklist Policy. In regard to such a change, this paper analyzes the smartphone market in terms of the Business Ecosystem Model suggested by Moore. This study examines how Korean Smartphone Ecosystem has been formed and how any shifts in policy will have an effect on the ecosystem. In line with this policy shift, this study also suggests the ways how these ecosystem members should establish a strategy for the continuous development of this smartphone ecosystem. Furthermore, this study presents cooperation directions among ecosystem members based on the organic connections in the ecosystem as well as each individual's corresponding measures. In addition, based on this analysis, this study puts forward Korean smartphone ecosystem's current problems, improvement, and its future.