Electronics and Telecommunications Research Institute

Korea Telecommunication Authority

Korea Telecom

Ik-Kyun Kim

Dae-Sung Moon

Jung-Tae Kim

Joo-Young Lee

Jong-Hyun Kim

Kyung-Min Park

Yong-Sung Jeon

Ki-Jong Koo

You-Sung Kang

Ha-Young Seong

Sang-Min Lee

Sang-Woo Lee

Jong-Arm Jun

Jong-Hoon Lee

Byoung-Koo Kim

Mi-Kyung Oh

Doo-Ho Choi

Jong-Oh Kim

Sang-Jae Lee

Ji-Hyeon Song

Kyou-Ho Lee

Young-Wook Cha

Koo-Hong Kang

Samuel Woo

Ki-Young Kim

Dae-Won Kim

Jooyoung Lee

Hyun-Sook Cho

Yong-Je Choi

Young-Su Kim

Seung-Hun Jin

Dong-Wook Kang

Seung-Yong Yoon

Tae-Sung Kim

Byeong-Cheol Choi

Min-Ho Han

Yang-Seo Choi

Jin-Yong Lee

Jong-Soo Jang

Sang-Su Lee

Ho Hwang

Jong-Kook Lee

Jong-Geun Park

Hyun-Joo Kim

Sun-Oh Choi

Disclosed herein is a method for transmitting information using a monitor brightness change. The method may include generating a transmission data frame structure for transmitting digital information, encoding the bit of the digital information, and converting the encoded bit of the digital information into a wireless signal that is a brightness change signal of blue (B) color, among red, green, and blue (RGB) for configuring colors on a monitor.

Method for transmitting/receiving information using monitor brightness change

Disclosed herein are an apparatus and method for inferring a cyberattack path based on attention. The apparatus includes memory in which at least one program is recorded and a processor for executing the program. The program generates test data required for generating an intelligent attack graph and generates an attack graph based on an intelligent attack path prediction model.

Apparatus for inferring cyberattack path based on attention, and apparatus and method for training intelligent attack path prediction model

Disclosed herein is a method for detecting a covert channel in wireless communication. The method includes setting a wireless communication specification, detecting a covert timing channel, and detecting a covert storage channel.

Method and apparatus for detecting covert channel for wireless communication

Disclosed herein are an apparatus and method for detecting violation of control flow integrity. The apparatus includes memory for storing a program and a processor for executing the program, wherein the processor multiple branch identifier registers to which identifiers of branch targets are written, a set branch identifier instruction configured to command an identifier of a branch target to be written to a branch identifier register at a predetermined sequence number, among the multiple branch identifier registers, and a check branch identifier instruction configured to command a signal indicating detection of a control flow hijacking attack to be issued based on whether a value written to the branch identifier register at the predetermined sequence number is identical to a value of an identifier of a branch target at the predetermined sequence number, wherein the program detects whether a control flow is hijacked based on the multiple branch identifier registers.

Apparatus and method for detecting violation of control flow integrity

Disclosed herein are a network environment synchronization apparatus and method. The network environment synchronization apparatus includes one or more processors, and execution memory for storing at least one program that is executed by the one or more processors, wherein the at least one program is configured to collect data from a network environment and generate a management structure in which collected data is distributed into preset respective group units, generate data discriminators for respective group units using a preset hash function, determine whether data of the management structure has changed with reference to data newly collected from the network environment based on the data discriminators, and when it is determined whether data of the management structure has changed, update the data of the management structure with the newly collected data.

Network environment synchronization apparatus and method

Disclosed herein are an apparatus for detecting unknown malware using a variable-length operation code (opcode) and a method using the apparatus. The method includes collecting opcode information from a detection target, generating a multi-pixel image having a variable length by performing feature engineering on the opcode information; and detecting unknown malware by inputting the multi-pixel image to a deep-learning model based on AI.

Apparatus for detecting unknown malware using variable opcode sequence and method using the same

Disclosed herein are an apparatus and method for detecting a malicious script. The apparatus includes one or more processors and executable memory for storing at least one program executed by the one or more processors. The at least one program is configured to extract token-type features, each of which corresponds to a lexical unit, and tree-node-type features of an abstract syntax tree from an input script, to train two learning models to respectively learn two pieces of learning data that are generated in consideration of features extracted respectively from the token-type features and the node-type features as having the highest frequency, and to detect whether the script is a malicious script based on the result of ensemble-based malicious script detection performed for the script, which is acquired using an ensemble detection model generated from the two learning models.

Apparatus and method for detecting malicious script

Disclosed herein is a device equipped with flash memory, which includes memory in which at least one program is recorded and a processor for executing the program. The memory includes flash memory including a data area and a backup area, and the program divides data into two or more segments depending on whether the data can be stored in a single page and stores the same in the data area. The first segment is stored in a page along with a segment number, indicating the sequential position of the divided data, a segment offset, indicating the number of pages between the pages in which the current segment and the next segment are stored, the size of a data file name, the size of the data, and the file name. At least one additional segment may be stored in another page along with the segment number and segment offset thereof.

Device with flash memory and method for writing/erasing/updating data in flash memory thereof

Disclosed herein are an apparatus and method for authenticating an IoT device. The method, performed by the IoT device authentication apparatus, includes transmitting, by the IoT device authentication apparatus, a random number to the IoT device and encrypting, by the IoT device authentication apparatus, the random number using a previously registered first white-box cryptography value through a white-box cryptography method; generating, by the IoT device, a first device response value from a previously registered first device challenge value using a Physical Unclonable Function (PUF) and encrypting, by the IoT device, the random number, received from the IoT device authentication apparatus, using the first device response value; and performing, by the IoT device authentication apparatus, authentication of the IoT device by checking whether the random number encrypted using the white-box cryptography method matches the random number encrypted using the PUF, which is received from the IoT device.

Apparatus and method for authenticating IoT device based on PUF using white-box cryptography

Disclosed herein are a server apparatus, a client apparatus, and a method for communication based on network address mutation. The method for communication based on network address mutation, performed by the server apparatus and the client apparatus, includes setting the external address of a network interface for receiving a packet from the client apparatus; setting the internal address of a hidden interface in order to forward the packet received through the network interface to the hidden interface; modifying the external address based on a preset network address mutation rule; and communicating with the client apparatus by forwarding the packet, received from the client apparatus based on the modified external address, to the hidden interface.

Server apparatus, client apparatus and method for communication based on network address mutation

Disclosed herein are a stepping-stone detection apparatus and method. The stepping-stone detection apparatus includes a target connection information reception unit for receiving information about a target connection from an intrusion detection system (IDS), a fingerprint generation unit for generating a target connection fingerprint based on the information about the target connection, and generating one or more candidate connection fingerprints using information about one or more candidate connections corresponding to one or more flow information collectors, and a stepping-stone detection unit for detecting a stepping stone by comparing the target connection fingerprint, in which a maximum allowable delay time is reflected, with the candidate connection fingerprints.

Stepping-stone detection apparatus and method

Disclosed herein is an apparatus for enhancing network security, which includes an information collection unit for collecting information about states of hosts that form a network and information about connectivity in the network; an attack surface analysis unit for analyzing attack surfaces by creating an attack graph using the information about the states and the information about connectivity; a security-enhancing strategy establishment unit for establishing a security-enhancing strategy based on the attack graph; and a security-enhancing strategy implementation unit for delivering a measure based on the security-enhancing strategy to a corresponding host, thereby taking a security-enhancing measure.

Apparatus for enhancing network security and method for the same

Disclosed herein are an apparatus and method for detecting a Distributed Reflection Denial of Service (DRDoS) attack. The DRDoS attack detection apparatus includes a network flow data reception unit for receiving network flow data from network equipment, a session type determination unit for determining a session type of the received network flow data, a host type determination unit for determining a type of host corresponding to the network flow data based on the session type, an attack method determination unit for determining an attack method corresponding to the network flow data, a protocol identification unit for identifying a protocol of the network flow data, and an attack detection unit for detecting a DRDoS attack based on the session type, the host type, the attack method, and the protocol.

Apparatus and method for detecting distributed reflection denial of service attack

Disclosed is a method for detecting a cyberthreat through correlation analysis of security events, which includes extracting a false-positive data set by extracting, from source data, information about security events occurring during a predetermined time period based on a time at which erroneous detection occurred; extracting a true-positive data set by extracting, from the source data, information about security events occurring during the predetermined time period based on a time at which an intrusion threat was correctly detected; extracting a current data set by extracting information about security events occurring during the predetermined time period from data to be analyzed; generating event coincidence statistics by extracting a frequency of each security event in the respective data sets and by compiling statistics thereon; generating an event vector based on the event coincidence statistics; and performing intrusion threat detection through a vector space model based on the event vector.

Method and apparatus for detecting cyberthreats through correlation analysis

An apparatus and method for visualizing data. The apparatus for visualizing data includes a behavior information collection unit for executing an application from which information is to be collected and collecting behavior information from a process of the executed application, a behavior feature extraction unit for extracting behavior features in an order in which the behavior information is called, a behavior sequence generation unit for generating a behavior sequence by arranging the behavior features in chronological order, and a behavior sequence visualization unit for visualizing the behavior sequence as a 3D sequence object.

Apparatus for visualizing data and method for using the same

Growing community of inventors

Daejeon, South Korea

Ik-Kyun Kim