• Journal of the Korean Institute of Intelligent Systems
• /
• v.22 no.6
• /
• pp.715-721
• /
• 2012

A threat evaluation is the technique which decides order of priority about tracks engaging with enemy by recognizing battlefield situation and making it efficient decision making. That is, in battle situation of multiple target it makes expeditious decision making and then aims at minimizing asset's damage and maximizing attack to targets. Threat value computation used in threat evaluation is calculated by sensor data which generated in battle space. Because Battle situation is unpredictable and there are various possibilities generating potential events, the damage or loss of data can make confuse decision making. Therefore, in this paper we suggest that substantial threat value calculation using learning bayesian network which makes it adapt to the varying battle situation to gain reliable results under given incomplete data and then verify this system's performance.

• The Journal of Korean Institute of Electromagnetic Engineering and Science
• /
• v.30 no.2
• /
• pp.132-140
• /
• 2019

In this paper, we propose a classification method for radar signals depending on the type of threat by applying machine learning to parameter data of radar signals. Currently, the army uses a library of mapping relations between the parameters and the types of threat to recognize threat signals. This approach has certain limitations when classifying signals and recognizing new types of threat or types of threat that do not exist in the current libraries. In this paper, we propose an automatic radar signal classification method depending on the type of threat that uses only parameter data without a library. A convolutional neural network is used as the classifier and machine learning is applied to train the classifier. The proposed method does not use a library, and hence, can classify threat signals that are new or do not exist in the current library.

• Journal of the Korea Society of Computer and Information
• /
• v.22 no.10
• /
• pp.83-92
• /
• 2017

Reconnaissance is performed gathering information from a series of scanning probes where the objective is to identify attributes of target hosts. Network reconnaissance of IP addresses and ports is prerequisite to various cyber attacks. In order to increase the attacker's workload and to break the attack kill chain, a few proactive techniques based on the network-based moving target defense (NMTD) paradigm, referred to as IP address mutation/randomization, have been presented. However, there are no commercial or trial systems deployed in real networks. In this paper, we propose a threat model and the request for requirements for developing NMTD techniques. For this purpose, we first examine the challenging problems in the NMTD mechanisms that were proposed for the legacy TCP/IP network. Secondly, we present a threat model in terms of attacker's intelligence, the intended information scope, and the attacker's location. Lastly, we provide seven basic requirements to develop an NMTD mechanism for the legacy TCP/IP network: 1) end-host address mutation, 2) post tracking, 3) address mutation unit, 4) service transparency, 5) name and address access, 6) adaptive defense, and 7) controller operation. We believe that this paper gives some insight into how to design and implement a new NMTD mechanism that would be deployable in real network.

• Convergence Security Journal
• /
• v.15 no.2
• /
• pp.43-55
• /
• 2015

Security infrastructure of Educational Network responds to threats by collecting and analyzing security events from various information protection system based on the integrated management system. Even if this system provides useful and detailed information to the administrator, there are some problems that this system does not provide effective response process and management systems for various threatening situations and the simultaneous threat processes. To solve this problem, we propose and develop security agents that enable the administrator to effectively manage integrated security for Educational Network. The proposed solution provides the administrator with efficient management techniques and process scheduling for various security events so that the administrator can response promptly to problems with the initial threat to Educational Network.

• Journal of Internet Computing and Services
• /
• v.23 no.6
• /
• pp.27-37
• /
• 2022

Virtual private network (VPN) services are used in various environments related to national security, such as defense companies and defense-related institutions where digital communication environment technologies are diversified and access to network use is increasing. However, the number of cyber attacks that target vulnerable points of the VPN has annually increased through technological advancement. Thus, this study identified security requirements by performing STRIDE threat modeling to prevent potential and new vulnerable points that can occur in the VPN. STRIDE threat modeling classifies threats into six categories to systematically identify threats. To apply the proposed security requirements, this study analyzed functions of the VPN and formed a data flow diagram in the VPN service process. Then, it collected threats that can take place in the VPN and analyzed the STRIDE threat model based on data of the collected threats. The data flow diagram in the VPN service process, which was established by this study, included 96 STRIDE threats. This study formed a threat scenario to analyze attack routes of the classified threats and derived 30 security requirements for each element of the VPN based on the formed scenario. This study has significance in that it presented a security guideline for enhancing security stability of the VPN used in facilities that require high-level security, such as the Ministry of National Defense (MND).

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.11 no.4
• /
• pp.15-31
• /
• 2001

In this paper we classify security threat elements of satellite communication into four parts; Level-0(satellite propagation signal), Level-1(satellite control data), Level-2(satellite application data) and ground network security level according to the personality and data of the satellite communication network. And we analyze each security levels. Using analyzed security threat elements, we divide security requirements into signal security level and information security level separately. And then above the existent signal security level countermeasure, we establish the countermeasure on the basis of information security policy such as satellite network security policy, satellite system security policy and satellite data security policy in information security level. In this paper we propose secure satellite communication network through the countermeasure based on information security policy.

• Convergence Security Journal
• /
• v.20 no.4
• /
• pp.197-208
• /
• 2020

Based on the network infrastructure advanced in the information knowledge society, the structure of computer net work is operated by establishing the composition of network in various forms that have secured the security. In case of computer network of national/public organizations, it is necessary to establish the technical and managerial securit y environment even considering the characteristics of each organization and connected organizations. For this, the im portance of basic researches for cyber training by analyzing the technical/managerial vulnerability and cyber threats based on the classification and map of cyber threats according to the characteristics of each organization is rising. T hus, this study aims to analyze each type of external/internal cyber threats to computer network of national/public o rganizations established based on the dualistic infrastructure network of internet and national information network, a nd also to present the cyber threat framework for drawing the elements of cyber security training, by drawing and analyzing the actual elements of cyber threats through the case-based scenario.

• Convergence Security Journal
• /
• v.24 no.1
• /
• pp.3-9
• /
• 2024

Currently, cyberattacks and security threats are constantly evolving, and organizations need quick and efficient security response methods. This paper proposes ways to strengthen internal network security by utilizing Unified Threat Management (UTM) equipment to improve network security and effectively manage and analyze the log data of the internal network collected through these equipment using Elastic Stack (Elasticsearch, Logstash, Kibana, hereinafter referred to as ELK Stack).

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.14 no.2
• /
• pp.1-10
• /
• 2014

In this study, I analyzed the increased threat of cyber warfare and the threat of reality about what is happening around the currently. And to prepare for it, I proposed the fact how main developed countries deal with cyber warfare. Also, I presented North Korea's cyber warfare threat which is equipped with world's top 3 cyber warfare performance and the way how their strategy influence to South Korea's national security. Moreever, I studied the existing North Korea's cyber warfare threat and the way how, how South Korea deal with it and prepare to against expected threat of cyber warfare in future.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.22 no.6
• /
• pp.305-313
• /
• 2021

The upcoming warfare will be network-centric warfare with the acquiring and sharing of information on the battlefield through the connection of the entire weapon system. Therefore, the amount of information generated increases, but the technology of evaluating the information is insufficient. Threat assessment is a technology that supports a quick decision, but the information has many uncertainties and is difficult to apply to an advanced battlefield. This paper proposes a threat assessment based on artificial intelligence while removing the target uncertainty. The artificial intelligence system used was a fuzzy inference system and a multi-layer perceptron. The target was classified by inputting the unique characteristics of the target into the fuzzy inference system, and the classified target information was input into the multi-layer perceptron to calculate the appropriate threat value. The validity of the proposed technique was verified with the threat value calculated by inputting the uncertain target to the trained artificial neural network.