Electronics and Telecommunications Research Institute

Dae-Sung Moon

Ik-Kyun Kim

Ki-Jong Koo

Joo-Young Lee

Kyung-Min Park

Jong-Hyun Kim

Sang-Min Lee

Jang-Hee Yoo

Jung-Tae Kim

Yun-Su Chung

Ji-Hyeon Song

Samuel Woo

Jooyoung Lee

Woo-Yong Choi

Seung-Hun Jin

Yang-Seo Choi

Ki-Young Moon

So-Hee Park

Ho Hwang

Jae-Hak Yu

Byung-Jun Kang

Yong-Jin Lee

Sun-Oh Choi

Disclosed herein are an artificial Intelligence (AI)-based cyber training method. The AI-based cyber training method may include generating a unit attack by training an attack agent based on environment and state information of a cyber range (CR) and a set of attack tools executable on a system, executing the unit attack in the CR, and then determining whether the unit attack has succeeded, and determining whether to perform an attack or a defense based on whether the unit attack has succeeded.

Artificial intelligence-based cyber training method and apparatus

Disclosed herein are an apparatus and method for inferring a cyberattack path based on attention. The apparatus includes memory in which at least one program is recorded and a processor for executing the program. The program generates test data required for generating an intelligent attack graph and generates an attack graph based on an intelligent attack path prediction model.

Apparatus for inferring cyberattack path based on attention, and apparatus and method for training intelligent attack path prediction model

Disclosed herein are an apparatus and method for updating an Internet-based malware detection engine using virtual machine scaling. The method may include creating a scaling group and an update group set based on a first virtual machine image, creating a second virtual machine image for a running virtual machine in response to occurrence of a snapshot event in the virtual update group run based on the first virtual machine image, modifying the scale-out image of the scaling group to the second virtual machine image, updating the scaling group by triggering a scale-out event and a scale-in event in the scaling group in response to occurrence of an update event, and modifying the scale-in image of the scaling group to the second virtual machine image.

Apparatus and method for updating internet-based malware detection engine using scaling control of virtual machine

Disclosed herein are a network environment synchronization apparatus and method. The network environment synchronization apparatus includes one or more processors, and execution memory for storing at least one program that is executed by the one or more processors, wherein the at least one program is configured to collect data from a network environment and generate a management structure in which collected data is distributed into preset respective group units, generate data discriminators for respective group units using a preset hash function, determine whether data of the management structure has changed with reference to data newly collected from the network environment based on the data discriminators, and when it is determined whether data of the management structure has changed, update the data of the management structure with the newly collected data.

Network environment synchronization apparatus and method

Disclosed herein are an apparatus for detecting unknown malware using a variable-length operation code (opcode) and a method using the apparatus. The method includes collecting opcode information from a detection target, generating a multi-pixel image having a variable length by performing feature engineering on the opcode information; and detecting unknown malware by inputting the multi-pixel image to a deep-learning model based on AI.

Apparatus for detecting unknown malware using variable opcode sequence and method using the same

Disclosed herein are a server apparatus, a client apparatus, and a method for communication based on network address mutation. The method for communication based on network address mutation, performed by the server apparatus and the client apparatus, includes setting the external address of a network interface for receiving a packet from the client apparatus; setting the internal address of a hidden interface in order to forward the packet received through the network interface to the hidden interface; modifying the external address based on a preset network address mutation rule; and communicating with the client apparatus by forwarding the packet, received from the client apparatus based on the modified external address, to the hidden interface.

Server apparatus, client apparatus and method for communication based on network address mutation

Disclosed herein is an apparatus for enhancing network security, which includes an information collection unit for collecting information about states of hosts that form a network and information about connectivity in the network; an attack surface analysis unit for analyzing attack surfaces by creating an attack graph using the information about the states and the information about connectivity; a security-enhancing strategy establishment unit for establishing a security-enhancing strategy based on the attack graph; and a security-enhancing strategy implementation unit for delivering a measure based on the security-enhancing strategy to a corresponding host, thereby taking a security-enhancing measure.

Apparatus for enhancing network security and method for the same

Disclosed are an apparatus and method for reconstructing a transmitted file with high performance in real time, which select analysis target packets for reconstruction by first checking using hardware whether data file-related information is present in packets transmitted via large-capacity traffic over a broadband network, and which reconstruct a file in real time only from the selected analysis target packets. The file reconstruction apparatus for reconstructing a data file from packets on a network includes a packet monitoring unit for extracting packets on the network, a collected packet selection unit for determining whether, for the extracted packets, each packet is a reconstruction target based on flow information, and selecting a reconstruction target packet, and a file reconstruction unit for performing file reconstruction by extracting data from the reconstruction target packet and by storing the extracted data as data of a reconstructed file in a relevant flow.

Apparatus and method for reconstructing transmitted file in real time for broadband network environment

Disclosed herein is an object image capture apparatus. The object image capture apparatus includes a first camera unit, a second camera unit, and a control unit. The first camera unit obtains a wide-area view image by capturing a wide-area view region. The second camera unit obtains a close-up view image by capturing the close-up view region of the wide-area view region. The control unit controls the second camera unit by dividing the wide-area view image into a plurality of blocks, analyzing the resulting blocks, and defining a target block, in which a moving object is detected, as a close-up view region from among the plurality of blocks.

Object image capture apparatus and method

A fingerprint verification apparatus that adds chaff fingerprint information to real fingerprint information of a user and then, hides and stores the fingerprint information of the user with a polynomial generated by unique information of the individual, thereby safely protecting the important fingerprint information of the user stored in a storing unit from an external attacker and safely managing an private key using the fingerprint information when using the private key as the unique information for making the polynomial.

Growing community of inventors

Daejeon, South Korea

Dae-Sung Moon