• Annual Conference of KIPS
• /
• 2013.05a
• /
• pp.534-537
• /
• 2013

인터넷상에서 다양한 사용자 및 구성요소로 이루어진 분산시스템은 Sybil Attack 에 취약하다. 최근 온라인 소셜 네트워크(Online Social Network)의 그래프 정보를 사용해, Sybil Attack 에 대응하기 위한 Sybil-resistant value 추출 기법들이 제안되었다. 이 논문에서는 이러한 OSN 기반의 Sybil-resistant value 추출 기법들에 대한 성능을 평가한다. 특히 OSN 그래프의 각 노드들의 이웃 노드 개수 정보에 따른 성능과 Sybil 노드들의 Attack Edge 에 따른 성능을 평가한다. Facebook 에서 추출한 샘플 OSN 그래프를 사용한 성능 평가 분석을 통해, 실제 사용자를 위한 Sybil-resistant value 를 정상적으로 추출하기 위해서는 OSN 그래프 상에서 이웃 노드의 개수가 10 개 이상이어야 한다는 점과, Random Route Tail Intersection 기법이 Sybil 사용자 그룹의 Attack Edge 의 영향을 가장 적게 받는 다는점을 확인 하였다.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2012.05a
• /
• pp.467-470
• /
• 2012

This paper proposes a technique of sybil attack detection using an ID-based certificate on sensor network. First, it can solve the broadcast storm problem happening when keys are distributed to sensor nodes. Second, it prevents the replay attack by periodically generating and changing the keys of sensor nodes with Key-chain technique. Third, it authenticates sensor node's ID using hash function. So, it maximizes sensor node's memory usage, reduces communication overhead. Finally it detects Sybil attack through ID-based certificate. Therefore, the proposed technique of Sybil attack detection using ID-based certificate consider simultaneously energy efficiency and stability on sensor network environment, and can trust the provided information through sensor network.

• Journal of information and communication convergence engineering
• /
• v.9 no.6
• /
• pp.676-682
• /
• 2011

Sybil attack can disrupt proper operations of wireless sensor network by forging its sensor node to multiple identities. To protect the sensor network from such an attack, a number of countermeasure methods based on RSSI (Received Signal Strength Indicator) and LQI (Link Quality Indicator) have been proposed. However, previous works on the Sybil attack detection do not consider the fact that Sybil nodes can change their RSSI and LQI strength for their malicious purposes. In this paper, we present a Sybil attack detection method based on a transmission power range. Our proposed method initially measures range of RSSI and LQI from sensor nodes, and then set the minimum, maximum and average RSSI and LQI strength value. After initialization, monitoring nodes request that each sensor node transmits data with different transmission power strengths. If the value measured by monitoring node is out of the range in transmission power strengths, the node is considered as a malicious node.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.17 no.6
• /
• pp.1462-1470
• /
• 2013

This paper proposes an SWAD-KNH(Sybil & Wormhole Attack Detection using Key, Neighbor list and Hop count) technique which consists of an SWAD(Sybil & Wormhole Attack Detection) module detecting an Worm attack and a KGDC(Key Generation and Distribution based on Cluster) module generating and an sense node key and a Group key by the cluster and distributing them. The KGDC module generates a group key and an sense node key by using an ECDH algorithm, a hash function, and a key-chain technique and distributes them safely. An SWAD module strengthens the detection of an Sybil attack by accomplishing 2-step key acknowledgement procedure and detects a Wormhole attack by using the number of the common neighbor nodes and hop counts of an source and destination node. As the result of the SWAD-KNH technique shows an Sybil attack detection rate is 91.2% and its average FPR 3.82%, a Wormhole attack detection rate is 90%, and its average FPR 4.64%, Sybil and wormhole attack detection rate and its reliability are improved.

• Annual Conference of KIPS
• /
• 2007.11a
• /
• pp.1151-1153
• /
• 2007

P2P 및 Mobile Network, Reputations System 등의 분산 시스템은 sybil attack 에 노출되어 있다. sybil attack 은 한 명의 사용자가 다수의 식별자를 가진 것으로 위장하여 시스템 내에서 마치 실제 다수의 사용자인 양 시스템을 악용하는 공격방법이다. sybil attack 을 막기 위한 다양한 노력이 진행되었고, 최근에 SybilGuard 라는 social network 를 이용한 방어 방법이 제시되었다. SybilGuard 는 악의적인 사용자를 막기 위하여, Random Walk 의 변형이면서 결정적인 경로의 특징을 가지는 임의경로(Random Route)를 사용하여 악의적인 사용자의 sybil attack 을 방어한다. SybilGuard 는 sybil node 의 개수를 제한하고, 이들을 하나의 동일한 그룹으로 분류할 수 있도록 하여 시스템 내에서 가짜 식별자의 개수를 제한한다. 이를 위해 각 노드가 시스템에 돌어올 때 Verifier(V)노드가 이들 노드를 확인하게 되는데, 이를 위해 시스템 내의 선한 노드(Honest Node)를 사용하여 이들을 확인한다. 이 때, honest node 들은 verifier 의 요청에 따라 확인요청을 수행하게 되는데, social network 의 특성상 몇몇 노드들은 사회적인 명망으로 매우 큰 링크수를 가지게 될 것이며, 따라서 이들 노드들이 처리해야할 요청의 양이 매우 많아지게 될 것이다. 따라서 이들 honest node 들 간에 로드분포를 균등하게 하는 것이 요구되며, 이 논문에서는 부하 조절을 하기 위한 기법을 제시하고, 이들을 평가한다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.6 no.10
• /
• pp.2731-2749
• /
• 2012

Sybil attack has been proved effective in mitigating the P2P botnet, but the impacts of some important parameters were not studied, and no model to estimate the effectiveness was proposed. In this paper, taking Kademlia-based botnets as the example, the model which has the upper and lower bound to estimate the mitigating performance of the Sybil attack is proposed. Through simulation, how three important factors affect the performance of the Sybil attack is analyzed, which is proved consistent with the model. The simulation results not only confirm that for P2P botnets in large scale, the Sybil attack is an effective countermeasure, but also imply that the model can give suggestions for the deployment of Sybil nodes to get the ideal performance in mitigating the P2P botnet.

• KIPS Transactions on Computer and Communication Systems
• /
• v.2 no.12
• /
• pp.533-540
• /
• 2013

Anonymity is the one of main reasons for substantial improvement of Internet. It encourages various users to express their opinion freely and helps Internet based distributed systems vitalize. But, anonymity can cause unexpected threats because personal information of an online user is hidden. Especially, distributed systems are threatened by Sybil attack, where one malicious user creates and manages multiple fake online identities. To prevent Sybil attack, the traditional solutions include increasing the complexity of identity generation and mapping online identities to real-world identities. But, even though the high complexity of identity generation increases the generation cost of Sybil identities, eventually they are generated and there is no further way to suppress their activity. Also, the mapping between online identities and real identities may cause high possibility of losing anonymity. Recently, some methods using online social network to prevent Sybil attack are researched. In this paper, a new method is proposed for extracting a user's system-wide Sybil-resistant trust value by using the properties embedded in online social network graphs. The proposed method can be categorized into 3 types based on sampling and decision strategies. By using graphs sampled from Facebook, the performance of the 3 types of the proposed method is evaluated. Moreover, the impact of Sybil attack on nodes with different characteristics is evaluated in order to understand the behavior of Sybil attack.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.9 no.9
• /
• pp.3738-3750
• /
• 2015

Sybil attack is a special kind of attack which is difficult to be detected in Wireless Sensor Network (WSN). So a lightweight detection mechanism based on LEACH-RSSI-ID (LRD) is proposed in this paper. Due to the characteristic of Low-Energy Adaptive Clustering Hierarchy (LEACH) protocol, none of nodes can be the cluster head forever.

• KIISE Transactions on Computing Practices
• /
• v.21 no.10
• /
• pp.670-679
• /
• 2015

With a rapid development of internet, many users these days refer to various recommender sites when buying items, movies, music and more. However, there are malicious users (Sybil) who raise or lower item ratings intentionally in these recommender sites. And as a result, a recommender system (RS) may recommend incomplete or inaccurate results to normal users. We suggest a recommender algorithm to separate ratings generated by users into normal ratings and outlier ratings, and to minimize the effects of malicious users. Specifically, our algorithm first ensures a stable RS against three kinds of attack models (Random attack, Average attack, and Bandwagon attack) which are the main recent security issues in RS. To prove the performance of the method of suggestion, we conducted performance analysis on real world data that we crawled. The performance analysis demonstrated that the suggested method performs well regardless of Sybil size and type when compared to existing algorithms.

• Annual Conference of KIPS
• /
• 2010.11a
• /
• pp.1098-1100
• /
• 2010

WSN(Wireless Sensor Networks)는 Ubiquitous환경을 실현하기 위한 기술로써 현재 그에 대한 연구가 활발히 진행되고 있다. 하지만 지금까지의 연구는 서비스제공에 치중되어 보안에 대한 고려는 많이 이루어 지지 않았다. 또한 자원이 한정적인 센서의 특징상 현재까지 알려진 다양한 보안기법을 그대로 센서에 적용하는 것은 불가능하며 Monitoring하고자 하는 장소에 센서를 설치함으써 공격자에게 센서가 쉽게 노출되는 취약점이 있다. 센서에 대한 공격기법 중 Sybil Attack은 하나의 Node가 두 개 이상의 Node로 가장하여 WSN상에 통신되는 정보에 대한 신뢰도를 낮추며 통신이 불가능하도록 하는 기술이다. 이를 방지하기 위해 다양한 기법들이 제시되었고 그에 대한 신뢰도도 증명하였다. 하지만 2차원 상에 한정적인 탐지기법을 제공하여 실용적인 적용이 불가능하다. 현실적인 적용을 위해 본 논문에서는 3차원 상에서 Sybil node 탐지기법을 제시한다.