Electronics and Telecommunications Research Institute

Jong Soo Jang

Sung Won Sohn

Jin Tae Oh

Jung Chan Na

Beom Hwan Chang

Ki Young Kim

Geon Lyang Kim

Seon Gyoung Sohn

Soo Hyung Lee

Jintae Oh

Chi Yoon Jeong

Hyun Joo Kim

Seung Won Shin

Taek Yong Nam

Seung Yong Yoon

Byoung Koo Kim

Jin Oh Kim

Ik Kyun Kim

Jong Hyun Kim

Hyo Chan Bang

Geon Woo Kim

Jong Wook Han

Jong Ho Ryu

Seung Min Lee

Dong Young Kim

Kyo Il Chung

Jeong Nyeo Kim

Ji Man Park

Dae Won Kim

Young Soo Park

Yun Kyung Lee

Sung Ik Jun

Yang Seo Choi

Kwang Ho Baik

Ho Gyun Lee

Deok Gyu Lee

Ki Hyun Kim

Ki-Young Kim

Hyun Sook Cho

Sang-Woo Lee

Sang Woo Lee

Yong-Sung Jeon

Joo Young Lee

Ki Young Moon

Sang Su Lee

Moo Seop Kim

Young Sae Kim

Won Joo Park

Ju Han Kim

Hyochan Bang

Sungwon Yi

Changhoon Kim

Bo Heung Chung

Hyung Kyu Lee

Yang-Seo Choi

Seung Wan Han

Hwa Shin Moon

Yong Sung Jeon

Seungmin Lee

SuGil Choi

Hyeok Chan Kwon

Jae Hoon Nah

Seungho Ryu

Gaeil An

Dongyoung Kim

Sun Hee Lim

Gae Ii Ahn

YouRi Lee

Donghyuk Lee

Gaeil Ahn

Seon Gyoung Shon

A method and apparatus for protecting an application layer in a computer network system. The method includes creating a session between a client and a data provider in response to a session connection request from the client, and determining the client as an application layer attacking client when the client generates a session termination request before the data provider transmits to the client a response packet to a data request from the client under the created session.

Method and apparatus for protecting application layer in computer network system

A system and method for image information processing are disclosed. The system for image information processing includes: at least one image pickup terminal for providing image data picked up through a camera; an image information processing server for processing data collected from at least one image pickup terminal into data of a new format; and an application server for receiving the processed data from the image information processing server and providing the same to at least one user terminal. The amount of transmission data can be reduced and the reliability of information security can be increased since it is possible to allocate unique IDS to a plurality of image pickup terminals and application servers and identify the image pickup terminals and application servers only by their unique IDs without containing any particular information upon data transmission.

System and method for image information processing using unique IDs

There is provided a system and method for providing an application service using image data. One image data processing server collects images (for example, still images and moving images) captured by various kinds of image capturing apparatuses, such as CCTV systems and processes the collected images into data required to provide application services. A plurality of application service servers only provide processed data of the image data processing server without requiring an additional process to a display device of a user. Accordingly, the configuration of each of the application service servers is simplified to thereby reduce manufacturing costs.

System and method for providing application service using image data

Enclosed are a signature string storage memory optimizing method, a signature string pattern matching method, and a signature matching engine. Signature is tokenized in units of substrings and the tokenized substrings are stored in an internal memory block and an external memory block to optimize a memory storage pattern. Therefore, matching of introduction data to signature patterns is effectively performed.

Signature string storage memory optimizing method, signature string pattern matching method, and signature string matching engine

A block cipher ARIA substitution apparatus, the apparatus includes a first Sbox operation unit for performing operations of a substitution box Sand a substitution box S; a second Sbox operation unit for performing operations of a substitution box Sand a substitution box S; and a control unit for determining modes of the first Sbox operation unit and the second Sbox operation unit. The first Sbox operation unit has a first inverse affine transformation unit for performing an inverse affine operation for obtaining S; a finite field inverse element operation unit for computing an inverse element of GF(2) or a result value of the first inverse affine transformation unit; a first affine transformation unit for performing an affine operation for obtaining S; and a first and a second multiplexer.

Block cipher aria substitution apparatus and method

There are provided a system and method for tracing back an attacker by using centroid decomposition technique, the system including: a log data input module collecting log data of an intrusion alarm from an intrusion detection system; a centroid node detection module generating a shortest path tree by applying a shortest path algorithm to network router connection information collected by a network administration server, detecting a centroid node by applying centroid decomposition technique removing a leaf-node to the shortest path tree, and generating a centroid tree whose node of each level is the detected centroid node; and a traceback processing module requesting log data of a router matched with the node of each level of the centroid tree, and tracing back a router identical to the log data of the collected intrusion alarm as a router connected to a source of an attacker by comparing the log data of the router with the log data of the collected intrusion alarm. According to the system and method, an attacker causing a security intrusion event may be quickly detected, a load on the system is reduced, and a passage host exposed to a danger or having weaknesses may be easily recognized, thereby easily coping with an attack.

Log-based traceback system and method using centroid decomposition technique

A method and apparatus for extracting a windows executable file that can search for a pattern related to windows executable files among a large quantity of network packets using a hardware-based session tracking and pattern matching technology and that can extract all packets included in the corresponding session are provided. The method of extracting a windows executable file includes: collecting incoming packets having a payload according to a session of a reference packet having an MZ pattern; performing a portable executable (PE) pattern matching for the collected incoming packets; and forming a PE file based on at least one incoming packet satisfying the PE pattern matching.

Method of extracting windows executable file using hardware based on session matching and pattern matching and apparatus using the same

There are provided an apparatus and method for detecting an executable code, capable of verifying reliability of an extracted signature by determining whether there is present an executable code in network data by using instruction pattern information related calling mechanism of function for distinguishing the executable code from a non-executable code, the method including: forming instructions by reverse assembling network data suspicious as an attack; comparing the respective formed instructions with instruction patterns according to calling mechanism of function; and determining whether there is present an executable code in the network data according to a result of the comparing.

Method and apparatus for detecting executable code

There are provided an apparatus and method for sampling a security event based on contents of the security event, the apparatus including: a security event accumulation module collecting security events occurring in a network system and storing the security events for each type according to contents of the security event; a security event analysis module calculating distribution of the security events for each type by analyzing the stored security events; and a security event extraction module sampling the stored security events according to the calculated distribution of the security events for each type. The apparatus and method may improve speed of visualization of a security event and a security event analysis apparatus and may increase accuracy thereof.

Apparatus and method for sampling security events based on contents of the security events

There are provided a network attack detection apparatus and method capable of determining even unknown network attack, the apparatus connected between two networks or connected by port mirroring of an Ethernet switch to real-time monitor all packets flowing through the networks. The apparatus decodes a payload portion of an inputted network packet into a machine code instruction, determines whether an executable code is included in the decoded machine code by analyzing relationship between instructions, and determines whether the packet is harmful based on statistics with respect to a possibility that an executable code exists in a service and a certain transaction of the service when the executable code is included.

Apparatus and method for detecting network attack

There are provided a low power SHA-1 hash algorithm apparatus having a low power structure and optimized to a trusted platform module (TPM) applied to a mobile trusted computing environment and a low power keyed-hash message authentication code (HMAC) encryption apparatus using the low power SHA-1 hash algorithm apparatus, the HMAC encryption apparatus including: a key padder padding key data for HMAC algorithm; an XOR operator XOR operating the padded key data and a padding constant; a data connector connecting a text to be encrypted, to data obtained by the XOR operating; a data padder padding the connected data; an SHA-1 hash algorithm part performing an SHA-1 hash algorithm on the padded data; a data selector selecting and applying one of a result of the SHA-1 hash algorithm and the text to be encrypted, to the data connector; and a controller controlling operations of the key padder, data connector, and data padder, a sequence of performing a hash algorithm of the SHA-1 hash algorithm part, and storing an operation result to read data required for performing an encryption operation and store data with memory.

Low power HMAC encryption apparatus

There are provided a network security state visualization device and method, the device including: a security event collector collecting original security event information from network security apparatuses; a security event analyzer analyzing the original security event information collected by the security event collector and extracting characteristic data corresponding to a security event; and a three-dimensional visualization display unit visualizing a correlation between the characteristic data extracted by the security event analyzer as a three-dimensional screen to be displayed.

Method and apparatus for visualizing network security state

A double-integration signal processing apparatus for pulse width amplification and A/D conversion is provided. The current mode double-integration conversion apparatus includes: a current mode double-integration unit which integrates an input current in a predetermined time interval and outputs an integration voltage; a comparison unit which compares the integration voltage output from the current mode double-integration unit with a predetermined comparison voltage V k and outputs an comparison pulse signal; and a gate logic unit which performs a logic operation by using the comparison pulse signal of the comparison unit and an internal signal and outputs an logic operation pulse signal. Accordingly, the current mode double-integration conversion apparatus can be applied to various sensors.

Current mode double-integration conversion apparatus

Disclosed is an Academy, Research Institute, and Agency (ARIA) encryption/decryption apparatus for encrypting and decrypting input data by repeating a plurality of rounds. The ARIA encryption/decryption apparatus includes a first register storing input data or an intermediate calculation value according to a first control signal; a second register storing a input round key for every round; an exclusive OR operation unit performing an exclusive OR operation on values stored in the first and second registers; a substitution unit substituting a result of the exclusive OR operation on a basis of an ARIA substitution algorithm; a diffusion unit diffusing a result of the substitution in the substitution unit on a basis of an ARIA diffusion algorithm if a current round is not a final round; and a control unit outputting the first control signal so that an output of the diffusion unit is used as the intermediate calculation value if the current round is the final round or an output of the substitution unit is used as the intermediate calculation value if the current round is the final round, and outputting an output of the exclusive OR operation unit as a result of the ARIA encryption/decryption.

ARIA encryption/decryption apparatus and method, and method of generating initialization key for the same

An apparatus for protecting legitimate traffic from DoS and DDoS attacks has a high-priority () and a low-priority () queue. Besides, a queue information table () has STT (Source-based Traffic Trunk) service queue information of a specific packet. A queue coordinator () updates the queue information table () based on a load of a provided STT and a load of the high-priority queue (). A packet classifier () receives a packet from the network access unit (), investigates an STT service queue of the packet from the queue information table (), selectively transfers the packet to the high-priority () or the low-priority () queue and provides information on the packet to the queue coordinator (). A buffer () buffers outputs of the high-priority () and the low-priority () queue and provides outputs to the network () to be protected.

Method and apparatus for protecting legitimate traffic from DoS and DDoS attacks

Growing community of inventors

Daejeon, South Korea

Jong Soo Jang