Electronics and Telecommunications Research Institute

Other

Ik Kyun Kim

Jung Tae Kim

Dae Sung Moon

Yang Seo Choi

Jong Soo Jang

Hyun Sook Cho

Dae Won Kim

Jin Tae Oh

Dong Ho Kang

Jong Hyun Kim

You Sung Kang

Mi Kyung Oh

Seon-Gyoung Sohn

Jung-Chan Na

Byoung-Koo Kim

Sang Jae Lee

Min Ho Han

Koo Hong Kang

Youngjun Heo

Chan Soo Kim

Dong Wook Kang

Sang Woo Lee

Jooyoung Lee

Byeong Cheol Choi

Nam-Su Jho

Doo Ho Choi

Seung Hun Jin

Chi Yoon Jeong

Jung Chan Na

Hyun Joo Kim

Seon Gyoung Sohn

Jong Arm Jun

Ki Jong Koo

Seung Yong Yoon

Taek-Young Youn

Hyup Jong Kim

Bo Heung Chung

Hong Il Ju

Jin Yong Lee

Byoung Koo Kim

Taesung Kim

Jae Geun Kim

Joong Yong Choi

Yong Sung Jeon

Han Sung Lee

Jong Hoon Lee

Kyou Ho Lee

Yeong Ho Park

Jonghyun Kim

Ho Hwang

Boo Sun Jeon

Young Wook Cha

Ha Young Seong

Kyungmin Park

Provided is a module and method for transmitting information using a wireless hidden signal, which is capable of transmitting important information data requiring extreme security using a wireless hidden signal, and allowing the important information to be detected and distinguished by only promised transmitting/receiving parties so that the possibility of the wireless hidden signal being discovered can be minimized and security can be enhanced. The module for transferring information using a wireless hidden signal includes: a hidden formatting unit configured to generate a transmission data frame structure based on data that needs to be wirelessly transmitted; a hidden encoding unit configured to encode the generated transmission data frame structure to generate and output a hidden encoded bit stream; and a hidden modulation unit configured to convert the output hidden encoded bit stream into a wireless signal in a wireless transmission format.

Module and method for transmitting information using wireless hidden signal

Collecting the topology and asset information of the virtual generated computer network, converting the topology and asset information into a training data set for training the neural network model, training the neural network model based on the training data set, and training A method and apparatus for predicting an attack vulnerability of a computer network through the step of inferring an attack vulnerability of a target computer network using a neural network model are provided.

Method and apparatus for predicting attack vulnerability of computer network

An electronic device includes a peripheral device, a processor, an interrupt controller configured to manage interrupts generated by the peripheral device and the processor on the basis of a register, and a virtualizer, wherein the virtualizer may be configured to virtualize a portion of the processor and a portion of the at least one peripheral device to generate a first partition, generate first interrupt information corresponding to an interrupt usable in the first partition, generate first processor information corresponding to a portion of the processor usable in the first partition, check whether a configuration of the register is related to at least one of the first interrupt information and the first processor information when the register is configured by the first partition, and allow the configuration of the register when the configuration of the register is related to the at least one information.

Electronic device, interrupt configuration control method, and storage medium

Disclosed is a method of generating secret information on the basis of a ring oscillator. According to an embodiment of the present disclosure, there is provided an apparatus for generating secret information on the basis of a ring oscillator, the apparatus including: multiple PUF information generation units each including at least one ring oscillator cell and generating physically unclonable function (PUF) information generated by the at least one ring oscillator cell; a phase checking unit cross-checking phases for the multiple pieces of the PUF information that are output from the multiple PUF information generation units, respectively; and a secret key generation unit outputting secret key information based on a result of comparing the multiple phases received from the phase checking unit.

Apparatus for generating secret information on basis of ring oscillator architecture and method of same

In the present invention, by providing an apparatus for securing data comprising a memory for storing information for data processing, a processor configured to partition original data into a plurality of partial data and generate a plurality of divided data by randomly determining positions of each of the plurality of partial data within the original data, and a communication interface configured to transmit each of the plurality of divided data to each of a plurality of servers, respectively, if an attacker obtains a portion of the divided data, it prevents the entire original data from being restored, and the legitimate user can restore the original data accurately even if some divided data is corrupted, and provides an efficient data polymorphic dividing technique that can minimize the amount of calculation required to secure data.

Method and apparatus for securing data

Disclosed is an apparatus of detecting a distributed reflection denial of service attack, including: a monitoring unit obtaining flow information including an IP and a port number of a source, an IP and a port number of a destination of data, and the number and the sizes of packets; a memory unit storing a flow table in which the flow information of the data, the packet number and the packet size are input; and a control unit detecting the DRDoS attack by using at least one of the number and the size of packets of the first entry and the flow information of the first entry.

Apparatus and method of detecting distributed reflection denial of service attack based on flow information

The method for tracking a cyber hacking is provided. The method of connection fingerprint generation and stepping-stone traceback based on NetFlow includes receiving a traceback request including IP packet attribute information of a victim and an attacker which corresponds to a target connection that is the last connection on a connection chain, generating a fingerprint for an associated connection based on the IP packet attribute information and requesting a NetFlow collector for relevant information, detecting a stepping-stone connection to the target connection which is generated at the time of generation of the fingerprint and instructing to check whether sorted candidate connections are present on the same connection chain as the target connection, and determining an order of the candidate connections based on an attacker host when the candidate connections are determined to be present on the same connection chain as the target connection.

System and method for connection fingerprint generation and stepping-stone traceback based on netflow

A behavior-based malicious code detecting apparatus and method using multiple feature vectors is disclosed. A malicious code learning method may include collecting characteristic factor information when a training target process comprising a malicious code is executed, generating a feature vector for malicious code verification based on the collected characteristic factor information, learning the generated feature vector through a plurality of machine learning algorithms to generate a model of representing the malicious code and a model of representing a normal file, and storing the model of representing the malicious code and the model of representing the normal file generated through the learning.

Behavior-based malicious code detecting apparatus and method using multiple feature vectors

The present invention relates to an apparatus and a method for detecting a malware code by generating and analyzing behavior pattern. A malware code detecting apparatus includes a behavior pattern generating unit which defines a characteristic parameter which distinguishes and specifies behaviors of a malware code and normally executable programs, converts an API calling event corresponding to the defined characteristic parameter and generates a behavior pattern in accordance with a similarity for behaviors of converted API call sequences to store the behavior pattern in a behavior pattern DB; and a malware code detecting unit which converts the API calling event corresponding to the defined characteristic parameter when the target process is executed into the API call sequence and determines whether the behavior pattern is a malware code in accordance with a similarity for behaviors of the converted API call sequence and the sequence stored in the behavior pattern DB.

Apparatus and method for detecting malware code by generating and analyzing behavior pattern

A computing device configured to execute an instruction set is provided. The computing device includes a system call hooker for hooking system calls that occur by the instruction set while the instruction set is executed, a category extractor for extracting a category to which each of the hooked system calls belongs with reference to category information associated with a correspondence relationship between a system call and a category, a sequence extractor for extracting one or more behavior sequences expressed in an N-gram manner from a full sequence of the hooked system calls with reference to the extracted category, and a model generator for generating a behavior pattern model of the system calls that occur when the instruction set is executed, based on a number of times that each of the extracted behavior sequences occurs.

Method of modeling behavior pattern of instruction set in N-gram manner, computing device operating with the method, and program stored in storage medium to execute the method in computing device

Disclosed are provided a method and a system for network connection chain traceback by using network flow data in order to trace an attack source site for cyber hacking attacks that goes by way of various sites without addition of new equipment of a network or modification a standard protocol when the cyber hacking attack occurs in the Internet and an internal network.

Method and system for network connection chain traceback using network flow data

According to a method and system for real-time malware detection based on web browser plugin, the method and system may connect a web server of a web site through a web browser module, execute a security module through a browser plugin of the web site, update a database for a browser cache of the web site from the web server by the security module, cache a web content of the web site from the web server, match cache data of the web content with the database, and warn about the web content if data matched with the cache data of the web content does not exist in the database.

System and method for real-time malware detection based on web browser plugin

A method for detecting an abnormal traffic on a control system protocol, includes: checking whether session information exists in a management table; adding a new entry to the management table; checking whether a transaction ID in a table entry is the same as that of the received MODBUS request message; and checking whether data and length thereof of the received MODBUS request message are the same as those in the table entry. Further, the method includes detecting an abnormal traffic; and updating the table entry with packet information of the MODBUS request message.

Method for detecting abnormal traffic on control system protocol

An apparatus for detecting an abnormality sign in a control system, the control system comprising control equipments, network equipments, security equipments or server equipments, the apparatus includes an information collection module configured to collect system information, network information, security event information or transaction information in interworking with a control equipments, network equipments, security equipments or server equipments. The apparatus includes storage module that stores the information collected by the information collection module. The apparatus includes an abnormality detection module configured to analyze a correlation between the collected information and a prescribed security policy to detect whether there is an abnormality sign in the control system.

Apparatus and method for detecting abnormality sign in control system

The present invention relates to an insider threat detection device and method which collects and analyzes a variety of information generated by insiders working for an organization, such as behaviors, events, and states of the insider, and detects an abnormal insider who may become a potential threat. According to the present invention, the insider threat detection method and apparatus analyzes information related to insiders using the correlation analysis method, and previously detects an abnormal sign of an insider who may become a potential threat to an organization, which makes it possible to protect the organization from attacks on systems inside the organization or seizure of important information inside the organization.

Insider threat detection device and method

Growing community of inventors

Daejeon, South Korea

Ik Kyun Kim