• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2010.05a
• /
• pp.299-302
• /
• 2010

Recently, the malicious code is not easily detectable in the vaccine for the virus, malicious code as a compressed file by modulation pattern is the tendency to delay. Among the many antivirus engines on the market a compressed file that can be modulated by malicious code, and test whether the pattern will need to know. We cover a multi-compressed files, malicious code modulated secreted by examining patterns of test engine is being detected is through a computer simulation. Analysis of secreted activities of malicious code and infect the host file tampering with the system driver files and registry, it gets registered is analyzed. this study will contribute hidden malicious code inspection and enhance vaccine efficacy in reducing the damage caused by malicious code.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.14 no.1
• /
• pp.97-108
• /
• 2010

The data security of free-roaming mobile agent is a problem which hasn't been resolved to the mobility and inter-host mapping. totally, especially in theaspect of keeping away truncation attacks. Therefore, when the agent is utilized for user oriented applied technique, the secure execution guarantee of agent is essential. In this paper, it guarantees safe execution from security threats generated by malicious host during the agent's execution. And the secure execution guarantee mechanism of agent is proposed from favorable host is maliciously abused by attacker. Thus, the execution trace protocol mechanism proposed as secure mobile agents execution guarantee. As security analysis of the safety analysis.

• Journal of Korea Multimedia Society
• /
• v.14 no.1
• /
• pp.144-152
• /
• 2011

As IPv4 addresses are exhausting, the use of IPv6 addresses is increasing. IPv6 environment provides address auto-configuration function. If addresses are allocated to each host automatically, network management system has difficulty in inspecting every IP of all devices and keeping the relevant informations. Also, as IP addresses are configured automatically, problems such as malicious users accessing network devices with no restriction can occur. To solve these problems, managing and blocking of malicious user is necessary. In this paper, we suggest agent system for searching of host computer and blocking network access which manages and protects the major network resources efficiently by searching host and blocking unauthorized host access to network in IPv6 environment. According to the test results of function of this agent system in IPv6 environment, we have checked that this system performs searching and blocking function normally.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.28 no.7C
• /
• pp.743-750
• /
• 2003

With the expansion of computer technology the mobility of a mobile agent code having the flexibility in the dispersive computer situation is used to set up the applications distributed on the Internet. As it also has the ability to transmit the mobile code of a mobile agent and to receive it from a far-off host, the executive circumstances of the host system in which an agent is executed have to access to an agent code and the executive state capable of executing an agent code. Therefore, it is difficult to prevent the forgery, the alteration and the wrong execution of an agent from a malicious host. This dissertation suggests the mechanism which can protect an agent from the malicious action through the executive pursuit of a code-named mobile agent. The security of this mechanism is verified through the protective process of a mobile agent in this mechanism.

• IEMEK Journal of Embedded Systems and Applications
• /
• v.12 no.6
• /
• pp.359-368
• /
• 2017

As the BadUSB is a vulnerability, in which a hacker tampers the firmware area of a USB flash drive. When the BadUSB device is plugged into the USB port of a host system, a malicious code acts automatically. The host system misunderstands the act of the malicious behavior as an normal behaviour for booting the USB device, so it is hard to detect the malicious code. Also, an antivirus software can't detect the tampered firmware because it inspects not the firmware area but the storage area. Because a lot of computer peripherals (such as USB flash drive, keyboard) are connected to host system with the USB protocols, the vulnerability has a negative ripple effect. However, the countermeasure against the vulnerability is not known now. In this paper, we analyze the tampered area of the firmware when a normal USB device is changed to the BadUSB device and propose the countermeasure to verify the integrity of the area when the USB boots. The proposed method consists of two procedures. The first procedure is to verify the integrity of the area which should be fixed even if the firmware is updated. The verification method use hashes, and the target area includes descriptors. The second procedure is to verify the integrity of the changeable area when the firmware is updated. The verification method use code signing, and the target area includes the function area of the firmware. We also propose the update protocol for the proposed structure and verify it to be true through simulation.

• Journal of the Korea Society of Computer and Information
• /
• v.19 no.4
• /
• pp.81-90
• /
• 2014

As mobile devices have become widely used and developed, PC based malwares can be moving towards mobile-based units. In particular, mobile Botnet reuses powerful malicious behavior of PC-based Botnet or add new malicious techniques. Different from existing PC-based Botnet detection schemes, mobile Botnet detection schemes are generally host-based. It is because mobile Botnet has various attack vectors and it is difficult to inspect all the attack vector at the same time. In this paper, to overcome limitations of host-based scheme, we compare two network-based schemes which detect mobile Botnet by applying HMM and SVM techniques. Through the verification analysis under real Botnet attacks, we present detection rates and detection properties of two schemes.

• The KIPS Transactions:PartC
• /
• v.14C no.5
• /
• pp.411-416
• /
• 2007

The General security method of wireless network provides a confidentiality of communication contents based on the cryptographic stability against a malicious host. However, this method exposes the logical and physical addresses of both sender and receiver, so transmission volume and identification of both may be exposed although concealing that content. Covered address scheme that this paper proposes generates an address to which knapsack problem using super increasing sequence is applied, and replaces the addresses of sender and receiver with addresses from super increasing sequence. Also, proposed method changes frequently secret addresses, so a malicious user cannot watch a target system or try to attack the specific host. Proposed method also changes continuously a host address that attacker takes aim at. Accordingly, an attacker who tries to use DDoS attack cannot decide the specific target system.

• Journal of Broadcast Engineering
• /
• v.25 no.2
• /
• pp.166-175
• /
• 2020

Recently, application fields for processing and using digital image contents in various forms and types are rapidly increasing. Since image content is high value-added content, the intellectual property rights of this content must be protected in order to activate the production and use of the digital image content. In this paper, we propose a deep learning based watermark embedding and extraction network. The proposed method is to maximize the robustness of the watermark against malicious/non-malicious attacks while preserving the invisibility of the host image. This network consists of a preprocessing network that changes the watermark to have the same resolution as the host image, a watermark embedding network that embeds watermark data while maintaining the resolution of the host image by three-dimensionally concatenating the changed host image and the watermark information, and a watermark extraction network that reduces the resolution and extracts watermarks. This network verifies the invisibility and robustness of the proposed method by experimenting with various pixel value change attacks and geometric attacks against various watermark data and host images with various resolutions, and shows that this method is universal and practical.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.14 no.9
• /
• pp.3870-3884
• /
• 2020

The proposed framework of Four Layer Robust Storage in Cloud (FLRSC) architecture involves host server, local host and edge devices in addition to Virtual Machine Monitoring (VMM). The goal is to protect the privacy of stored data at edge devices. The computational intelligence (CI) part of our algorithm distributes blocks of data to three different layers by partially encoded and forwarded for decoding to the next layer using hash and greed Solomon algorithms. VMM monitoring uses snapshot algorithm to detect intrusion. The proposed system is compared with Tiang Wang method to validate efficiency of data transfer with security. Hence, security is proven against the indexed efficiency. It is an important study to integrate communication between local host software and nearer edge devices through different channels by verifying snapshot using lamport mechanism to ensure integrity and security at software level thereby reducing the latency. It also provides thorough knowledge and understanding about data communication at software level with VMM. The performance evaluation and feasibility study of security in FLRSC against three-layered approach is proven over 2³² blocks of data with 98% accuracy. Practical implications and contributions to the growing knowledge base are highlighted along with directions for further research.

• Proceedings of the IEEK Conference
• /
• 2006.06a
• /
• pp.33-34
• /
• 2006

Computer Forensics is a research area which finds the malicious users by collecting and analyzing the intrusion or infringement evidence of the computer crime. Many research about Computer Forensics has been done. But those research have focussed on how to collect the evidence after receiving the damage reports from computer users or network administrators. This paper describes about collecting the evidence of good quality at the time of infringement occurrence by the malicious user. By calculating Infringement severity of observable and protective hosts and referring to this value, we collect the evidence at the time of infringement occurrence to minimize the information modification of the evidence. We can reduce also the amount of logs that we use to analyze the infringement and can minimize the loss of the evidence.