Electronics and Telecommunications Research Institute

Jin Tae Oh

Jong Soo Jang

Sung Won Sohn

Byoung Koo Kim

Ik Kyun Kim

Seung Yong Yoon

Dae Won Kim

Woong Shik You

Hwa Shin Moon

Yang Seo Choi

Kwang Ho Baik

Sung Won Yi

Ki Young Kim

Jin Kyeong Kim

Hyun Sook Cho

Sang Kwang Lee

Jae-Ho Lee

Kwi Hoon Kim

Seung Won Shin

Hyun Jae Kim

Sungwon Yi

Young Boo Kim

Young Chan Shin

Provided herein is a communication method using MIMO (Multiple-Input Multiple-Output) technology for communicating with a terminal included in each of a plurality of base station cells using a communication apparatus, the method including calculating, by the communication apparatus, the number of terminals included inside a base station cell; generating, by the communication apparatus, pilot signals corresponding to the calculated number of terminals; and allocating, by the communication apparatus, the pilot signals to a terminal that may maximize a network capacity based on the generated pilot signals.

Communication method using multiple input multiple output and communication apparatus performing the same

Provided herein is a PLC synchronization method including allocating a predetermined value with respect to a plurality of modulation symbols depending on whether sum of squared magnitude of in-phase component and orthogonal component is arranged in a predetermined range, calculating first moving sum and second moving sum of a value allocated to the plurality of modulation symbols, and performing PLC (physical layer link channel) synchronization based on the plurality of modulation symbols having maximum value of the first moving sum and the second moving sum.

Method and apparatus for synchronizing physical layer link channel

Provided herein is a sentence hiding and displaying system comprising: an image creating interface receiving an input of information on an original image, a plurality of sentences corresponding to the original image, and a language that needs to be hidden; an image creator configured to determine a sentence that needs to be hidden based on the plurality of sentences and the language that needs to be hidden, and to create on the original image an image where the sentence that needs to be hidden is hidden; a sentence display interface configured to receive an input of information on a language selected by a user; and a sentence extractor and displayer configured to parse a sentence expressed in the selected language of among sentences that need to be hidden based on the hidden image and the selected language, and to display the sentence expressed in the selected language.

Sentence hiding and displaying system and method

Enclosed are a signature string storage memory optimizing method, a signature string pattern matching method, and a signature matching engine. Signature is tokenized in units of substrings and the tokenized substrings are stored in an internal memory block and an external memory block to optimize a memory storage pattern. Therefore, matching of introduction data to signature patterns is effectively performed.

Signature string storage memory optimizing method, signature string pattern matching method, and signature string matching engine

A method and apparatus for extracting a windows executable file that can search for a pattern related to windows executable files among a large quantity of network packets using a hardware-based session tracking and pattern matching technology and that can extract all packets included in the corresponding session are provided. The method of extracting a windows executable file includes: collecting incoming packets having a payload according to a session of a reference packet having an MZ pattern; performing a portable executable (PE) pattern matching for the collected incoming packets; and forming a PE file based on at least one incoming packet satisfying the PE pattern matching.

Method of extracting windows executable file using hardware based on session matching and pattern matching and apparatus using the same

There are provided an apparatus and method for detecting an executable code, capable of verifying reliability of an extracted signature by determining whether there is present an executable code in network data by using instruction pattern information related calling mechanism of function for distinguishing the executable code from a non-executable code, the method including: forming instructions by reverse assembling network data suspicious as an attack; comparing the respective formed instructions with instruction patterns according to calling mechanism of function; and determining whether there is present an executable code in the network data according to a result of the comparing.

Method and apparatus for detecting executable code

There are provided a network attack detection apparatus and method capable of determining even unknown network attack, the apparatus connected between two networks or connected by port mirroring of an Ethernet switch to real-time monitor all packets flowing through the networks. The apparatus decodes a payload portion of an inputted network packet into a machine code instruction, determines whether an executable code is included in the decoded machine code by analyzing relationship between instructions, and determines whether the packet is harmful based on statistics with respect to a possibility that an executable code exists in a service and a certain transaction of the service when the executable code is included.

Apparatus and method for detecting network attack

Provided is a method and apparatus for generating a network attack signature capable of generating a signature having a high reliability while minimizing a whitelist used to prevent false positive. An application header and application data are separated from each other to measure byte distributions of the application header and the application data from an input packet. When an attack signature is generated by analyzing the measured byte distributions, a substring of the application data is used to generate the attack signature, and a substring of the application header is used as supporting information on the signature.

Method and apparatus for generating network attack signature

An apparatus and method for extracting signature candidates and optimizing a corresponding signature are provided. The apparatus includes a packet separator, a header parser, a traffic information generator, a substring extractor, and a signature candidate extractor. The packet separator separates a packet into a header and a payload. The header information parser parses the header information, and the traffic information generator generates traffic information. The substring extractor measures a frequency of appearing of a substring with a predetermined length in the separated payload for a constant observation period, and extracts a substring having a frequency higher than a predetermined setup value by updating the measured frequency information to a substring frequency table. The signature candidate extractor generates a signature by collecting the extracted substring information and the generated traffic information, updates a signature frequency table, and extracts a signature candidate with reference to information of the signature frequency table.

Apparatus and method for extracting signature candidates of attacking packets

A real-time stateful packet inspection method and apparatus is provided, which uses a session table processing method that can efficiently generate state information. In the apparatus, a session table stores session data of a packet received from an external network. A hash key generator hashes a parameter extracted from the received packet and generates a hash pointer of the session table corresponding to the packet. A session detection module searches the session table for a session corresponding to the received packet. A session management module performs management of the session table such as addition, deletion, and change of sessions of the session table. A packet inspection module generates state information corresponding to the received packet from both directionality information of the packet and entry header information of the packet stored in the session table and then inspects the packet based on the generated state information.

Real-time stateful packet inspection method and apparatus

An apparatus and method for managing a session state are provided. The apparatus for managing a session state during transmission control protocol (TCP) handshaking includes: a session index unit producing and managing an index including 5-tuple information of a session corresponding to an input packet; a detailed information manager generating and managing an entry by extracting state information of a session in which a predetermined time does not pass after the session has been completely established, to respond to an intrusion detection against the input packet when the index is produced; a brief information manager generating and managing an entry including state information, which includes states of session connection and disconnection and directionality of the input packet, of a session in which a predetermined time elapses after the session has been completely established; and a search unit searching an index of the session corresponding to the input packet in the session index unit, and, if an index does not exist, searching the brief information manager after the session has been completely established.

Apparatus and method for managing session state

A method and apparatus for storing an intrusion rule are provided. The method stores a new intrusion rule in an intrusion detection system having already stored intrusion rules, and includes: generating combinations of divisions capable of dividing the new intrusion rule into a plurality of partial intrusion rules; calculating the frequency of hash value collisions between each of the generated division combinations and the already stored intrusion rules; dividing the new intrusion rule according to the division combination which has the lowest calculated frequency of hash value collisions; and storing the divided new intrusion rule in a corresponding position of the intrusion detection system. According to the method and apparatus, the size of the storage unit occupied by the intrusion rule can be reduced, and by performing pattern matching, the performance of the intrusion detection system can be enhanced.

Method and apparatus for storing intrusion rule

A method of storing a pattern matching policy and a method of controlling an alert message are provided. The method includes (a) generating a content structure as a sub-structure of a header combination structure of a stored traffic pattern which is a policy to be newly applied to a pattern matching apparatus; (b) determining whether a content of the stored traffic pattern is identical to a content of an original traffic pattern stored in advance in the pattern matching apparatus; (c) allocating a content index of the content of the original traffic pattern to the content of the stored traffic pattern if the content of the stored traffic pattern is identical to the content of the original traffic pattern; and (d) determining whether a header combination structure of the original traffic pattern comprises only one content structure or more than one content structure and allocating a header index of the header combination structure of the stored traffic pattern to the header combination structure of the original traffic pattern if the header combination structure of the original traffic pattern is found to comprise only one content structure. Accordingly, it is possible to efficiently use hardware memories with limited storage capacities and effectively perform a pattern matching function.

Method of storing pattern matching policy and method of controlling alert message

A method and apparatus for storing pattern matching data and a pattern matching method using the method and apparatus are provided. The method of storing original data for pattern matching in a pattern matching apparatus includes: dividing the original data into segments of a predetermined size; performing a hash operation on each of the divided segments; determining whether or not the hash operation value of each segment causes a hash collision with a hash operation value stored in a first external memory disposed outside the pattern matching apparatus; and controlling the hash operation value of each segment determined not to cause a hash collision to be stored in the first external memory. According to the method and apparatus, the original data desired to be used for pattern matching can be stored at a faster speed in a pattern matching data storing apparatus.

Growing community of inventors

Daejeon, South Korea

Jin Tae Oh