Electronics and Telecommunications Research Institute

Hyeok-Chan Kwon

Gae-Il An

Byung-Ho Chung

Sok-Joon Lee

Sin-Hyo Kim

Do-Young Chung

Jong-Sik Moon

Sang-Woo Lee

Yong-Hyuk Moon

Seung-Min Lee

Dae-Hee Seo

Jae-Hoon Nah

Taek-Yong Nam

Dong-Il Seo

Disclosed herein is a method for visualizing a medical device network and a security threat. The method includes representing nodes in zones that are divided into a server zone including nodes corresponding to server devices, a medical device zone including nodes corresponding to medical devices, a white zone including registered nodes excluding the server devices and the medical devices, and a gray zone including nodes included in none of the above-mentioned zones, representing links between the nodes, and representing a node and a link in which a security attack is detected using a different color when the security attack is detected in the node.

Method and apparatus for visualizing medical device network and security attack

Disclosed herein are an attack detection apparatus and method based on measurement of networking behavior abnormalities in symbolic spaces. The attack detection method based on measurement of networking behavior abnormalities in symbolic spaces includes creating profiles based on a transmission address of a flow received from a network, measuring a behavior abnormality of a device corresponding to the transmission address of the flow on the network, and mapping the measured behavior abnormality to behavior symbols in symbolic spaces, generating a behavior symbol sequence pattern, in which the behavior symbols are sequentially connected, for each profile, and detecting presence or non-presence of an attack and a device associated with the attack based on an output of the abnormal behavior prediction model that receives the behavior symbol sequence pattern as input.

Attack detection apparatus and method based on measurement of networking behavior abnormalities in symbolic spaces

Disclosed herein are a device identification apparatus and method based on network behavior. The device identification apparatus includes one or more processors, and execution memory for storing at least one program that is executed by the one or more processors, wherein the at least one program is configured to collect packet data of a device connected to a network through port mirroring and extract behavior features from the packet data, analyze the behavior features and then generate unique information based on a previously created detection model, and extract an identification number corresponding to the unique information from a database and then identify the device.

Device identification apparatus and method based on network behavior

Disclosed herein are a finite-field division operator, an elliptic curve cryptosystem having the finite-field division operator, and a method for operating the elliptic curve cryptosystem. The method for operating an elliptic curve cryptosystem may include, setting, by a key setting unit, a length of a key of a cryptographic algorithm, generating, by the key setting unit, first setup information that indicates a number of words corresponding to the key length, and generating, by the key setting unit, second setup information that indicates a number of repetitions of an operation by a finite-field division operator corresponding to the key length.

Finite-field division operator, elliptic curve cryptosystem having finite-field division operator and method for operating elliptic curve cryptosystem

An apparatus and method for collecting the radio frequency (RF) feature of a wireless device in a wireless communication apparatus are disclosed herein. The RF feature extraction unit adds a tag having a unique value to a received radio signal, and extracts RF feature information from the radio signal. The MAC information extraction unit extracts the source MAC address and tag information of a MAC protocol frame from the received radio signal, and then removes the added tag. The tag comparison unit selects an source MAC address and RF feature information, when the tags have the same value, from the RF feature information and tag information from the RF feature extraction unit and the source MAC address and tag information from the MAC information extraction unit. The RF feature storage unit stores the selected source MAC address and RF feature information.

Apparatus and method for collecting radio frequency feature of wireless device in wireless communication apparatus

An apparatus and a method for identifying a rogue device having a media access control (MAC) address counterfeited/forged when a wireless intrusion prevention system controls an access to an access point (AP) and a wireless terminal which are not applied are disclosed. The apparatus includes: a sensor unit configured to collect MAC addresses, RSSI values, and RF feature values based on RF signals of wireless terminals; an RF feature database configured to store the collected MAC addresses, RSSI values, and RF feature values; and a terminal identification unit configured to identify whether a MAC of any one of the wireless terminals is forged by comparing information of the RF feature database with the RSSI value and the RF feature value of any one of the wireless terminals according to a MAC verification request of any one of the wireless terminals from the sensor unit.

Apparatus and method for identifying rogue device

Disclosed herein is an apparatus for analyzing the vulnerability of a wireless local area network (LAN). The apparatus includes a collection unit, an analysis unit, and an attack unit. The collection unit collects packets transmitted and received in a wireless LAN service. The analysis unit analyzes the state of a network using the collected packets. The attack unit makes a wireless attack against an attack target using the state of the network, and controls the mode switching of a device driver based on an operating mode.

Apparatus for analyzing vulnerability of wireless local area network

An authentication apparatus for a non-real-time IPTV system decrypts a first encrypted value included in a contents request message received from a device using a preset session key, and then verifies the validity of the contents request message. If the verification results of the contents request message are valid, the authentication apparatus encrypts a variation between timestamps of the authentication apparatus and the device using the session key, and then generates a second encrypted value. After verification information by which the device is capable of verifying the authentication apparatus has been generated using the second encrypted value, the authentication apparatus sends verification information, together with contents corresponding to the contents request message, to the device.

Growing community of inventors

Daejeon, South Korea

Hyeok-Chan Kwon