• Journal of Korea Society of Digital Industry and Information Management
• /
• v.8 no.4
• /
• pp.107-113
• /
• 2012

Cloud computing has brought changes to the IT environment. Due to the spread of LTE, users of cloud services are growing more. This which provides IT resources to meet the needs of users of cloud services are noted as a core industry. But it is not activated because of the security of personal data and the safety of the service. In order to solve this, intrusion detection system is constructed as follows. This protects individual data safely which exists in the cloud and also protects information exhaustively from malicious attack. The cause of most attack risk which exists to cloud computing can find in distributed environment. In this study, we analyzed about necessary property of network-based intrusion detection system that process and analyze large amount of data which occur in cloud computing environment. Also, we studied functions which detect and correspond attack occurred in interior of virtualization.

• International journal of advanced smart convergence
• /
• v.5 no.4
• /
• pp.54-56
• /
• 2016

Code-reuse attacks are very dangerous in various systems. This is because they do not inject malicious codes into target systems, but reuse the instruction sequences in executable files or libraries of target systems. Moreover, code-reuse attacks could be more harmful to IoT systems in the sense that it may not be easy to devise efficient and effective mechanism for code-reuse attack detection in resource-restricted IoT devices. In this paper, we propose a detection scheme with using Kullback-Leibler (KL) divergence to combat against code-reuse attacks in IoT. Specifically, we detect code-reuse attacks by calculating KL divergence between the probability distributions of the packets that generate from IoT devices and contain code region addresses in memory system and the probability distributions of the packets that come to IoT devices and contain code region addresses in memory system, checking if the computed KL divergence is abnormal.

• Convergence Security Journal
• /
• v.22 no.4
• /
• pp.17-24
• /
• 2022

Recently, machine learning-based cyber attack detection and classification research has been actively conducted, achieving a high level of detection accuracy. However, low-spec IoT devices and large-scale network traffic make it difficult to apply machine learning-based detection models in IoT environment. Therefore, In this paper, we propose an efficient IoT attack detection and classification method through PCA(Principal Component Analysis) and LightGBM(Light Gradient Boosting Model) using datasets collected in a MQTT(Message Queuing Telementry Transport) IoT protocol environment that is also used in the defense field. As a result of the experiment, even though the original dataset was reduced to about 15%, the performance was almost similar to that of the original. It also showed the best performance in comparative evaluation with the four dimensional reduction techniques selected in this paper.

• Journal of Internet Computing and Services
• /
• v.11 no.5
• /
• pp.119-126
• /
• 2010

In this paper, we analyze the robustness of transformed-key asymmetric watermarking system and show its improvement by proposing a new detection method. Based on the assumption that the transformed-key asymmetric watermarking system is under the threat of subtraction attack, we first propose the criterion for the detection performance of the watermarking system and analyze the optimum condition on the system. Next, a new detection method is proposed to improve the detection performance of the system based on the criterion. The proposed improvement makes the system robust to not only subtraction attack but also Wu's attack.

• The Journal of the Korea institute of electronic communication sciences
• /
• v.8 no.9
• /
• pp.1313-1318
• /
• 2013

In order to actively respond to cyber attacks, not only the security systems such as IDS, IPS, and Firewalls, but also ESM, a system that detects cyber attacks by analyzing various log data, are preferably deployed. However, as the attacks be come more elaborate and advanced, existing signature-based detection methods start to face their limitations. In response to that, researches upon symptom detection technology based on attack modeling by employing big-data analysis technology are actively on-going. This symptom detection technology is effective when it can accurately extract features of attacks and manipulate them to successfully execute the attack modeling. We propose the ways to extract attack features which can play a role as the basis of the modeling and detect intelligent threats by carrying out scenario-based modeling.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2022.05a
• /
• pp.198-201
• /
• 2022

Recently, new cyber threats targeting new technologies are increasing, and hackers' attack targets are becoming broader and more intelligent. To counter these attacks, major security companies are using traditional EDR (Endpoint Detection and Response) solutions. However, the conventional method does not consider the context, so there is a limit to the accuracy and efficiency of responding to an advanced attack. In order to improve this problem, the need for a security solution centered on XDR (Extended Detection and Response) has recently emerged. In this study, we present effective threat detection and countermeasures in a changing environment through XDR trends and development roadmaps using machine learning-based context analysis.

• Journal of Digital Convergence
• /
• v.12 no.1
• /
• pp.423-429
• /
• 2014

DDoS attacks is upgrade of DoS attacks. Botnet is being used by DDoS attack, so it is able to attack a millions of PCs at one time. DDoS attacks find the root the cause of the attack because it is hard to find sources for it, even after the treatment wavelength serious social problem in this study, the analysis and countermeasures for DDoS attack is presented.

• Journal of KIISE:Information Networking
• /
• v.30 no.1
• /
• pp.97-116
• /
• 2003

Frequency of attacks on web services and the resulting damage continue to grow as web services become popular. Techniques used in web service attacks are usually different from traditional network intrusion techniques, and techniques to protect web services are badly needed. Unfortunately, conventional intrusion detection systems (IDS), especially those based on known attack signatures, are inadequate in providing reasonable degree of security to web services. An application-level IDS, tailored to web services, is needed to overcome such limitations. The first step in developing web application IDS is to analyze known attacks on web services and characterize them so that anomaly-based intrusion defection becomes possible. In this paper, we classified known attack techniques to web services by analyzing causes, locations where such attack can be easily detected, and the potential risks.

• Journal of Korea Multimedia Society
• /
• v.23 no.1
• /
• pp.24-30
• /
• 2020

As the number of internet-connected appliances and the variety of IoT services are rapidly increasing, it is hard to protect IT assets with traditional network security techniques. Most traditional network log analysis systems use rule based mechanisms to reduce the raw logs. But using predefined rules can't detect new attack patterns. So, there is a need for a mechanism to reduce congested raw logs and detect new attack patterns. This paper suggests enterprise security management for IoT services using graph and network measures. We model an event network based on a graph of interconnected logs between network devices and IoT gateways. And we suggest a network clustering algorithm that estimates the attack probability of log clusters and detects new attack patterns.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.5 no.5
• /
• pp.1085-1100
• /
• 2011

The Random Early Detection algorithm is widely used in the queue management mechanism of the router. We find that the parameters of the RED algorithm have a significant influence on the defense performance of the random early detection algorithm and discuss the robust of the algorithm in mitigating Low-rate Denial-of-Service attack in details. Simulation results show that the defense performance can be effectively improved by adjusting the parameters of $Q_{min}$ and $Q_{max}$. Some suggestions are given for mitigating the LDoS attack at the end of this paper.