Electronics and Telecommunications Research Institute

Geon Lyang Kim

Beom Hwan Chang

Jong Soo Jang

Sung Won Sohn

Jung Chan Na

Seon Gyoung Sohn

Jong Hyun Kim

Chi Yoon Jeong

Hyun Joo Kim

Soo Hyung Lee

Jong Ho Ryu

Hyo Chan Bang

Jin Oh Kim

Soo-In Lee

Dong Young Kim

Hyun Woo Lee

Hyun Sook Cho

Jeong Nyeo Kim

Jae Deok Lim

Gwang-Soon Lee

Jung-Chan Na

Won Joo Park

Hyochan Bang

Young-Kwon Hahm

Young-Ho Jeong

Su Wan Park

Chung-Hyun Ahn

So-Ra Park

Dongyoung Kim

Kyung Soo Lim

Sammo Cho

Seon Gyoung Shon

A system and method of verifying integrity of software for verifying the integrity of software installed on a mobile terminal is provided. The system includes the mobile terminal configured to transmit mobile terminal information including a first software hash value and a software identification (ID) with respect to the software, and an office trust software monitor server configured to transmit the software ID transmitted from the mobile terminal to a software publishing server, receive a second software hash value with respect to the software corresponding to the software ID from the software publishing server, compare the first software hash value and the second software hash value, and verify the integrity of the software.

System and method of verifying integrity of software

Provided are a web-based traceback system and method using reverse caching proxy, which can effectively protect a web server against various attacks launched by illegitimate user by acquiring network information and location information of users who attempt to access the web server through an anonymous server, without a requirement of installing any agent program in the users' clients. The web-based traceback system may include a reverse caching proxy server receiving a hypertext transfer protocol (HTTP) packet transmitted to a web server by a client, analyzing the header of the HTTP packet and determining whether the client has attempted to access the web server through an anonymous server based on the results of the analysis; and a web tracking server generating a response page for the HTTP packet upon receiving the results of the determination performed by the reverse caching proxy server, inserting a tracking code in the response page, and providing the response page to the client through the reverse caching proxy server, wherein the tracking code is automatically executed in a web browser of the client and thus provides network information of the client to the web tracking server.

Web-based traceback system and method using reverse caching proxy

There are provided a system and method for tracing back an attacker by using centroid decomposition technique, the system including: a log data input module collecting log data of an intrusion alarm from an intrusion detection system; a centroid node detection module generating a shortest path tree by applying a shortest path algorithm to network router connection information collected by a network administration server, detecting a centroid node by applying centroid decomposition technique removing a leaf-node to the shortest path tree, and generating a centroid tree whose node of each level is the detected centroid node; and a traceback processing module requesting log data of a router matched with the node of each level of the centroid tree, and tracing back a router identical to the log data of the collected intrusion alarm as a router connected to a source of an attacker by comparing the log data of the router with the log data of the collected intrusion alarm. According to the system and method, an attacker causing a security intrusion event may be quickly detected, a load on the system is reduced, and a passage host exposed to a danger or having weaknesses may be easily recognized, thereby easily coping with an attack.

Log-based traceback system and method using centroid decomposition technique

There are provided an apparatus and method for sampling a security event based on contents of the security event, the apparatus including: a security event accumulation module collecting security events occurring in a network system and storing the security events for each type according to contents of the security event; a security event analysis module calculating distribution of the security events for each type by analyzing the stored security events; and a security event extraction module sampling the stored security events according to the calculated distribution of the security events for each type. The apparatus and method may improve speed of visualization of a security event and a security event analysis apparatus and may increase accuracy thereof.

Apparatus and method for sampling security events based on contents of the security events

There are provided a network security state visualization device and method, the device including: a security event collector collecting original security event information from network security apparatuses; a security event analyzer analyzing the original security event information collected by the security event collector and extracting characteristic data corresponding to a security event; and a three-dimensional visualization display unit visualizing a correlation between the characteristic data extracted by the security event analyzer as a three-dimensional screen to be displayed.

Method and apparatus for visualizing network security state

Provided is a geographic information transceiving system and method using a digital broadcasting network. The system and method segments new geographic and map data of a region, on which a geographic information service is provided, makes data segment files of different sizes, and multiplexes and transmits the files. A geographic information transmitting system includes: a geographic information collector for receiving real-time geographic information and real-time traffic information; a geographic information processor for extracting/processing local geographic information and local traffic information from the geographic information collecting means and outputting whole area information, geographic information and traffic information for a plurality of resolution levels; a digital broadcasting unit for converting and transmitting the geographic information/traffic information data in conformity to digital broadcast signals; a geographic information multiplexer for multiplexing the geographic information/traffic information data; and a transmitter for transmitting the multiplexed geographic information/traffic information data to a corresponding region.

Geographic information transceiving system and method thereof

A network status display device using a traffic pattern map is provided. The device includes: a traffic feature extractor extracting a port number of a port having the maximum occupancy of micro-flows and macro-flows for each network address section and host address section with reference to traffic information collected by an external traffic information collector, calculating and storing an occupancy rate of the port; a traffic status display unit making a network traffic pattern map expressed by destination-source network addresses and a host traffic pattern map expressed by destination-source host addresses and displaying the port information stored in the traffic feature extractor on the network traffic pattern map and the host traffic pattern map; and a traffic anomaly determination unit determining whether a network status is abnormal with reference to the network traffic pattern map and the host traffic pattern map and detecting and reporting a harmful or abnormal traffic which causes the abnormal network status. The device can determine whether the anomaly deteriorating the network performance exists and can easily and quickly detect the harmful or abnormal traffic which causes the anomaly by the use of the port information of the port having the maximum occupancy of the micro-flows and the macro-flows for each network address section and each host address section.

Network status display device and method using traffic pattern map

A network status display device using a traffic flow-radar is provided. The network status display device includes: a traffic feature extractor calculating flow occupancy rates for total flows, micro-flows and macro-flows with respect to each of a plurality of traffic features with reference to traffic information for each traffic feature such as a network address, a port, a transmitting/receiving host address or a protocol collected by an external traffic information collector, and storing the calculation result; a traffic status display unit displaying the flow occupancy rates for each traffic feature calculated and stored in the traffic feature extractor on a radar with dots for each traffic feature; and a traffic anomaly determination unit determining whether a network status is abnormal with reference to the radar for each traffic feature, detecting and reporting the type of the abnormal network status and harmful or abnormal traffic that generates the abnormal network status, when the abnormal status occurs.

Network status display device and method using traffic flow-radar

Provided is an apparatus for detecting a network attack situation. The apparatus includes an alarm receiver receiving a plurality of alarms raised in a network to which the alarm receiver is connected, converting the alarms into predetermined alarm data, and outputting the alarm data; an alarm processor analyzing an attack situation in the network based on attributes of the alarm data and a number of times that the alarm data is generated; a memory storing basic data needed to analyze the state of the network and providing the basic data to the alarm processor; and an interface transmitting the result of the analysis by the alarm processor to an external device, receiving a predetermined critical value from the external device, which is a basis for determining the occurrence of the attack situation, and outputting the critical value to the alarm processor such that the alarm processor can store the critical value in the memory. Equal numbers of hash engines and detection engines for processing the alarms in the network to the number of data groups classified as network attack situations are formed in a line. Therefore, a network attack situation can be detected in real time based on a great number of alarms indicating intrusion detection.

Apparatus and method of detecting network attack situation

The in-band adjacent-channel digital audio broadcasting system includes a scrambling unit for scrambling a signal to be broadcasted, thereby generating a scrambled signal; an outer coding unit for performing a first encoding of the scrambled signal, thereby generating an outer encoded signal; an outer interleaving unit for performing a first interleaving of the outer encoded signal a byte by byte basis, thereby generating an outer interleaved signal; an inner coding unit for performing a second encoding the outer interleaved signal, thereby generating an inner encoded signal; an inner interleaving unit for performing a second interleaving of the inner encoded signal, thereby generating an inner interleaved signal; a modulating unit for modulating the inner interleaved signal, thereby generating an orthogonal frequency division multiplexing (OFDM) symbols; a guard interval inserting unit for inserting a guard interval between the OFDM symbols in order to eliminate an inter-symbol interference, thereby generating an OFDM frame; and an RF processing unit for performing a conversion of the OFDM frame into an analog radio frequency signal so that the OFDM signal can be transmitted in a specific frequency channel of an FM frequency band, and for amplifying and outputting the analog radio frequency signal.

In-band adjacent-channel digital audio broadcasting system

Growing community of inventors

Daejeon, South Korea

Geon Lyang Kim