• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.37C no.10
• /
• pp.986-992
• /
• 2012

As the utilization of smart mobile devices such as smartphones increases, the desire to utilize such devices to control and monitor combat situations also arises. As smart mobile devices with various ICT get integrated with various weaponry system, a new phase of future warfare can be introduced. Moreover, smartphone-based real-time information technology for joint battle command system will be converged with surveillance control to become a leading example of convergence of cyber defense and information technology. Furthermore, mobile device security technology ideal for mobile wireless network environments can be applied to military robots. The following paper will give an overview of smart mobile device usage used for military purposes in battle command system, various security threats and the mobile device security technology to correspond to such security threats.

• Journal of Korea Game Society
• /
• v.5 no.1
• /
• pp.41-44
• /
• 2005

This paper is model can be useful and capable of automatically collecting and classifying the various information about a wide range of security incidents such as hackings, worms, spyware, cyber-terror, network espionage and information warfare from firewall, IDS, VPN and so on. According to them Internet game and an automated/integrated computer emergency response system can perform an attack assessment and an early warning for any incidents based on Enterprise Security Management environment.

• Information and Communications Magazine
• /
• v.23 no.2
• /
• pp.23-40
• /
• 2006

재난은 다양한 원인에 의하여 예측 불가능하게 발생되고 있다. 정보화의 진전에 따라 네트워크는 모든 경제활동의 근간이 되어 있으며, 재난이 발생하면 재난복구 및 구난 활동 등에 통신기능의 활용도가 더욱 높아진다. 특히 통신 장애를 일으키는 통신재난이 발생하면 그 파급효과는 빠르고, 넓게 확산되는 경향을 보인다. 국내.외적으로 국가 주요 활동의 정보통신의 의존도가 증가하고, 정보통신 기반의 복잡도와 개방성이 증가하여 위협 및 취약성이 증대하며, 정보전(cyber warfare)의 공격 위협이 증대하는데 비교하여, 통신 부문의 민영화에 따라 공공 부문 보호 영역이던 통신 부문이 민간 부문으로 확대되어 다양한 위협에 노출되어 있는 실정이다. 따라서 최근에는 통신 네트워크와 서비스를 정보통신 시스템과 서비스에 대한 독립적인 보호와 보안이라는 차원에서 한걸음 더 나아가 " 국가주요 기반 구조에 대한 보호와 위협에 대한 종합적인 대응 " 이라는 차원에서 접근하고 있다. 미국은 지난 및 비상대비 통신 전담기구인 NCS(National Communication System)와 대통령자문위원회인 NSTAC(National Security Telecommunication Advisory)등 종전부터 있던 통신 재난 및 비상 통신 관련 기구에서 진행해오던 통신 재난 및 비상 통신 관련 기구에서 진행해오던 통신 재난 및 비상 통신 관련 업무를 9-11 사태를 경험하면서 신설된 Department of Homeland Security에서 총괄하도록 하고 있다. 캐나다의 경우는 MSAT(Mobile Satellite Services) Emergency Telecommunication Network을 통한 긴급통신 시스템을 구축하였다. 일본의 경우 우정성(현재는 총무성에 통합) 산하 비상통신협의회를 구성하여 비상통신에 관련한 협의와 점검을 추진하며 방재용 무선 시스템을 구축 운용하고 있다. 본 고에서는 이와 같은 비상통신과 관련하여 수행하고 있는 국외 비상통신 관련표준화 현황 및 해외 주요국가 별 구축 동향에 대해서 기술한다.

• Journal of Advanced Navigation Technology
• /
• v.14 no.6
• /
• pp.838-844
• /
• 2010

This paper introduces Stuxnet, a malicious ware that presently stimulates severity of the cyber warfare worldwide, analyses how it propagates and what it affects if infected and proposes a process to cure infected systems according to its organization. Malicious wares such as Stuxnet secretes themselves within the system during propagation and it is required to analyze file hiding techniques they use to detect and remove them. According to the result of the analysis in this paper, Stuxnet uses the library hooking technique and the file system filter driver technique on both user level and kernel level, respectively, to hide its files. Therefore, this paper shows the results of the Stuxnet's file hiding approach and proposes an idea for countermeasure to neutralize it. A pilot implementation of the idea afterward shows that the stealthing techniques of Stuxnet are removed by the implementation.

• KIPS Transactions on Computer and Communication Systems
• /
• v.5 no.12
• /
• pp.471-480
• /
• 2016

Recently, the damage of cyber attack toward infra-system, national defence and security system is gradually increasing. In this situation, military recognizes the importance of cyber warfare, and they establish a cyber system in preparation, regardless of the existence of threaten. Thus, the study of Intrusion Detection System(IDS) that plays an important role in network defence system is required. IDS is divided into misuse and anomaly detection methods. Recent studies attempt to combine those two methods to maximize advantagesand to minimize disadvantages both of misuse and anomaly. The combination is called Hybrid IDS. Previous studies would not be inappropriate for near real-time network environments because they have computational complexity problems. It leads to the need of the study considering the structure of IDS that have high detection rate and low computational cost. In this paper, we proposed a Hybrid IDS which combines C4.5 decision tree(misuse detection method) and Weighted K-means algorithm (anomaly detection method) hierarchically. It can detect malicious network packets effectively with low complexity by applying mutual information and genetic algorithm based efficient feature selection technique. Also we construct upgraded the the hierarchical structure of IDS reusing feature weights in anomaly detection section. It is validated that proposed Hybrid IDS ensures high detection accuracy (98.68%) and performance at experiment section.

• Convergence Security Journal
• /
• v.22 no.4
• /
• pp.11-16
• /
• 2022

Development of science technology make integrated CPS(Cyber-Physical System) appear. In CPS era, cyberspace and physical-space are hard to separate anymore, that is developing toward integrated CPS. The reality is not stopping, that is consistently changing and the concept of space is developing too. But several articles are considering for cyberspace and physical-space separately, and they are developing tailed alternative each case. The theorical approaching that is not considering reality is dwelled on past, and is dangerous from dropping down to floating cloud that is not considering progressed reality. This article is suggested to consider rimland theory to control measures in cyberspace. That is dedicated to integrated approaching from physical-space to cyberspace. And that is developing concreted controling measures in cyberspace. Especially, this article is suggested to policy alternative by analyzing north korea cyber warfare from rimland theory including human sources. Simplicity is the ultimate sophistication. This article make integrated approaching effects about cyberspace and physical-space to preparing in the CPS era.

• Transactions of the Korean Society of Mechanical Engineers A
• /
• v.38 no.3
• /
• pp.323-328
• /
• 2014

Recently, there has been demand for the convergence of IT (Information and communication Technologies, ICT) with defense, as has already been achieved in civilian fields such as healthcare and construction. It is expected that completely new and common requirements would emerge from the civilian and military domains and that the shape of war field would change rapidly. Many military scientists forecast that future wars would be network-centric and be based on C4I(Command, Control, Communication & Computer, Intelligence), ISR(Intelligence, Surveillance & Reconnaissance), and PGM(Precision Guided Munitions). For realizing the smart defense concept, IT should act as a baseline technology even for simulating a real combat field using virtual reality. In this paper, we propose the concept of IT-based smart defense with a focus on accurate detection in real and cyber wars, effective data communication, automated and unmanned operation, and modeling and simulation.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.42 no.1
• /
• pp.193-204
• /
• 2017

The security of Internet systems critically depends on the capability to keep anti-virus (AV) software up-to-date and maintain high detection accuracy against new malware. However, malware variants evolve so quickly they cannot be detected by conventional signature-based detection. In this paper, we proposed a malware classification method based on sequence patterns generated from the network flow of malware samples. We evaluated our method with 766 malware samples and obtained a classification accuracy of approximately 40.4%. In this study, malicious codes were classified only by network behavior of malicious codes, excluding codes and other characteristics. Therefore, this study is expected to be further developed in the future. Also, we can predict the attack groups and additional attacks can be prevented.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.6
• /
• pp.1317-1330
• /
• 2017

To collect server information and construct network map enable us to prevent security breach, prepare for national cyber warfare and make effective policies. In this paper, we analyze well-known network scanners, Nmap and ZMap, and construct network map using banner grabbing. We use multiple threads in order to increase scanning speed and arrange IP lists by specific order to reduce the load on information gathering targets. Also, we applied performance tests to compare the real-time banner grabbing tool with the existing network scanners. As a result, we gathered server information from domestic and overseas servers and derived a risk index based on the collected database. Although there are slight differences among countries, we can identify the risky situation that many users in every country are exposed to several security breaches.

• Journal of Internet Computing and Services
• /
• v.23 no.1
• /
• pp.87-93
• /
• 2022

Since 99% of PCs operating in the defense domain use the Windows operating system, detection and response of Window-based malware is very important to keep the defense cyberspace safe. This paper proposes a model capable of detecting malware in a Windows PE (Portable Executable) format. The detection model was designed with an emphasis on rapid update of the training model to efficiently cope with rapidly increasing malware rather than the detection accuracy. Therefore, in order to improve the training speed, the detection model was designed based on a Bidirectional LSTM (Long Short Term Memory) network that can detect malware with minimal sequence data without complicated pre-processing. The experiment was conducted using the EMBER2018 dataset, As a result of training the model with feature sets consisting of three type of sequence data(Byte-Entropy Histogram, Byte Histogram, and String Distribution), accuracy of 90.79% was achieved. Meanwhile, it was confirmed that the training time was shortened to 1/4 compared to the existing detection model, enabling rapid update of the detection model to respond to new types of malware on the surge.