• ETRI Journal
• /
• v.31 no.1
• /
• pp.21-30
• /
• 2009

In low bit-rate video transmission, the payload of a single packet can often contain a whole coded frame due to the high compression ratio in both spatial and temporal domains of most modern video coders. Thus, the loss of a single packet not only causes the loss of a whole frame, but also produces error propagation into subsequent frames. In this paper, we propose a novel whole frame error concealment algorithm which reconstructs the first of the subsequent frames instead of the current lost frame to suppress the effects of error propagation. In the proposed algorithm, we impose a constraint which uses side match distortion (SMD) and overlapped region difference (ORD) to estimate motion vectors between the target reconstructed frame and its reference frame. SMD measures the spatial smoothness connection between a block and its neighboring blocks. ORD is defined as the difference between the correlated pixels which are predicted from one reference pixel. Experimental results show that the proposed algorithm effectively suppresses error propagation and significantly outperforms other conventional techniques in terms of both peak signal-to-noise ratio performance and subjective visual quality.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2008.10a
• /
• pp.274-277
• /
• 2008

Rekeying is the process of changing the encryption key of an ongoing communication. The main objective is to limit the amount of data encrypted with the same key. The IEEE 802.11 standard defines the Wired Equivalent Privacy, or WEP, encapsulation of 802.11 data frames. MAC at sender encrypts the payload (frame body and CRC) of each 802.11 frame before transmission using RC4 stream cipher. MAC at receiver decrypts and passes data to higher level protocol. WEP uses symmetric key stream cipher (RC4) where same key will be used for data encryption and decryption at the sender and the receiver. WEP is not promising with the advancement of the wireless technology existing today. We propose to use the existing information to define the security attributes. This will eliminate the steps that regenerated keys have to be sent to each other over certain period. The rekeying scheme is according to the number of bytes transmitted. Therefore, even the attacker has recorded the packets, it will be insufficient information and time for the attacker to launch the attacks as the key is not deterministic. We develop a packet simulation software for packet transmission and simulate our propose scheme. From the simulation, our propose scheme will overcome the weak WEP key attack and provide an alternative solution to wireless packet transmission. Besides that, our solution appears to be a software approach where only driver updates are needed for the wireless client and server.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2010.10a
• /
• pp.434-437
• /
• 2010

NIPS(Network Intrusion Prevention System) is in line at the end of the external and internal networks which performed two kinds of action: Signature-based filtering and anomaly detection and prevention-based on self-learning. Among them, a signature-based filtering is well known to defend against attacks. By using signature-based filtering, intrusion prevention system passing a payload of packets is compared with attack patterns which are signature. If match, the packet is discard. However, when there is packet delay, it will increase the required pattern matching time as the number of signature is increasing whenever there is delay occur. Therefore, to ensure the performance of IPS, we needed more efficient pattern matching algorithm for high-performance ISP. To improve the performance of pattern matching the most important part is to reduce the number of comparisons signature rules and the packet whenever the packets arrive. In this paper, we propose an improve signature hashing-based pattern matching method. We use tuple pruning algorithm with Bloom filters, which effectively remove unnecessary tuples. Unlike other existing signature hashing-based IPS, our proposed method to improve the performance of IPS.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.1
• /
• pp.27-37
• /
• 2011

The IDS/IPS(Intrusion Detection/Prevention System) has been widely deployed to protect the internal network against internet attacks. Reducing the packet inspection time is one of the most important challenges of improving the performance of the IDS/IPS. Since the IDS/IPS needs to match multiple patterns for the incoming traffic, we may have to apply the multiple pattern matching schemes, some of which use finite automata, while the others use the shift table. In this paper, we first show that the performance of those schemes would degrade with various kinds of pattern sets and payload, and then propose a hybrid multiple pattern matching scheme which combines those two schemes. The proposed scheme is organized to guarantee an appropriate level of performance in any cases. The experimental results using real traffic show that the time required to do multiple pattern matching could be reduced effectively.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.34 no.1
• /
• pp.103-114
• /
• 2024

In a situation where drone-related crimes continue to rise, research in drone forensics becomes crucial for preventing and responding to incidents involving drones. Conducting forensic analysis on flight record files stored internally is essential for investigating illegal activities. However, analyzing flight record files generated through the exclusive DUML protocol requires a deep understanding of the protocol's structure and characteristics. Additionally, a forensic analysis tool capable of handling cryptographic payloads and analyzing various drone models is imperative. Therefore, this study presents the methods and characteristics of flight record files generated by drones. It also explains the structure of the flight record file and the features of the DUML packet. Ultimately, we conduct forensic analysis based on the presented structure of the DUML packet and propose an extension forensic analysis system that operates more universally than existing tools, performing expanded syntactic analysis.

• The KIPS Transactions:PartC
• /
• v.14C no.3 s.113
• /
• pp.209-220
• /
• 2007

IPS(Intrusion Prevention Systems), which is installed in inline mode in a network, protects network from outside attacks by inspecting the incoming/outgoing packets and sessions, and dropping the packet or closing the sessions if an attack is detected in the packet. In the signature based filtering, the payload of a packet passing through IPS is matched with some attack patterns called signatures and dropped if matched. As the number of signatures increases, the time required for the pattern matching for a packet increases accordingly so that it becomes difficult to develop a high performance US working without packet delay. In this paper, we propose a high performance IPS based on signature hashing to make the pattern matching time independent of the number of signatures. We implemented the proposed scheme in a Linux kernel module in a PC and tested it using worm generator, packet generator and network performance measure instrument called smart bit. Experimental results show that the performance of existing method is degraded as the number of signatures increases whereas the performance of the proposed scheme is not degraded.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2017.04a
• /
• pp.928-931
• /
• 2017

네트워크 트래픽 데이터를 정제하여, Convolutional Neural Network Model 훈련에 적합한 데이터 세트로 변환하는데, 그 방법은 패킷 단위의 트래픽 데이터를 이미지 형태로 만드는 것이다. 완성된 데이터 세트를 훈련데이터로 하여 Convolutional Neural Network Model에 훈련하고, 훈련데이터의 이미지 크기를 변환해가며 훈련시킨 결과에 대해 비교 분석 및 평가를 진행한다.

• Convergence Security Journal
• /
• v.3 no.1
• /
• pp.73-84
• /
• 2003

The IPv4 that used to be generally used as a medium of computer communications in 1980s has reached its limits now. IPv6 (IP Version 6) is being prepared to solve the limitations of the IPv4. However, the biggest problem of IPv6 is that it is not compatible with the IPv4. To resolve the compatibility issue, Dual Stack, Tunneling and Header Converting methods have been proposed. The Header Converting method allows communications between the IPv4 and IPv6 networks with the converter. This method's strength is that it is easy to embody and the procedures for embodiment is simple. However, this method still contains the weaknesses that the existing IPv4 has. On the current document, the Header Converting method among the three methods is discussed to resolve the problems this method has. To solve the Header Converting method's weakness, the security problem between sections, the IP Header field values are converted to the relative field values and IPSec (IP Security) and ESP (Encapsulation Security Payload) are applied. The proposed "Encrypted Header Converting Method" that is encrypted in packet units has solved the weakness that the pre-existing Header Converting method used to have.d to have.

• The KIPS Transactions:PartC
• /
• v.12C no.4 s.100
• /
• pp.503-510
• /
• 2005

With the increasing importance of network protection from cyber threats, it is requested to develop a multi-gigabit rate pattern matching method for protecting against malicious attacks in high-speed network. This paper devises a high-speed pattern matching algorithm with TCAM by using an m-byte jumping window pattern matching scheme. The proposed algorithm significantly reduces the number of TCAM lookups per payload by m times with the marginally enlarged TCAM size which can be implemented by cascading multiple TCAMs. Due to the reduced number of TCAM lookups, we can easily achieve multi-gigabit rate for scanning the packet payload. It is shown by simulation that for the Snort nile with 2,247 patterns, our proposed algorithm supports more than 10 Gbps rate with a 9Mbit TCAM.

• Journal of IKEEE
• /
• v.22 no.2
• /
• pp.289-301
• /
• 2018

IIoT, the IoT technology applied to the industrial field, is being used as a monitoring technology for increasing in production rate and safety of workers. However, monitoring through the construction of IIoT network using Ethernet and RS485 in production lines where dozens to hundreds of machine tools are manufacturing components, have difficulties of infrastructure cost and network flexibility and fluidity. Therefore, in this paper, using IEEE 802.15.4 standard WSN device to construct a Ad-Hoc WSN in the production line. In addition, the transmission period and order of the sensor nodes are set by applying the EtherCAT communication method in which the payload frames are shared by all the sensor nodes. From this, we have overcome the problem of reliability decline and real-time issue due to the packet collision of wireless network and confirmed that it is a wireless network routing method that can be used in the actual industrial field.