Electronics and Telecommunications Research Institute

Jung Chan Na

Sung Won Sohn

Jong Soo Jang

Seon Gyoung Sohn

Beom Hwan Chang

Geon Lyang Kim

Soo Hyung Lee

Chi Yoon Jeong

Hyun Joo Kim

Jin Oh Kim

Jong Hyun Kim

Hyo Chan Bang

Jong Ho Ryu

Dong Young Kim

Hyun Sook Cho

Dong Ho Kang

Jae Seung Lee

Hyun Woo Kim

Ju Young Kim

Ik Kyun Kim

Ki Young Moon

Chee Hang Park

Won Joo Park

Hyochan Bang

Byung Gil Lee

Byoung Koo Kim

Do Hyeung Kim

Joong Yong Choi

Byung Doo Kim

Seung Hee Oh

Seong Cheon Park

Kwan Tae Cho

Dongyoung Kim

Young Jun Heo

Dae Hee Seo

Seon Gyoung Shon

Provided are a method and apparatus for a hardware-based accelerated arithmetic operation on homomorphically encrypted messages. The method of performing hardware-based modular multiplication on homomorphically encrypted messages according to the present invention includes receiving a plurality of homomorphically encrypted messages expressed in a polynomial form and a modulus for modular multiplication, decomposing the modulus into a product of a plurality of disjoint factors through CRT operation, and extracting a divided ciphertext from a plurality of homomorphically encrypted messages based on each of the disjoint factors, performing NTT transformation on each coefficient of the divided ciphertext, performing a pointwise multiplication operation between result values of the NTT transformation, performing INTT transformation on a result value of the pointwise multiplication operation to obtain the divided ciphertext, and merging the divided ciphertext obtained in the performing of the INTT transformation through ICRT operation to generate an output ciphertext.

Method and apparatus for hardware-based accelerated arithmetic operation on homomorphically encrypted message

The present invention relates to a vessel traffic service system and a method for extracting accident data, and more particularly, to a technique that search and extracts possible event traffic data automatically from data of a concerned area without knowing exact time when a marine accident occurs. The vessel traffic service system includes: an input unit receiving conditional information for extracting accident occurrence data from a user; a storage unit storing at least one of an automatic identification system (AIS) signal, a radar signal, and a camera image signal; and a control unit extracting an event occurrence part from at least one of the AIS signal, the radar signal, and the camera image signal of a point and a time at which an accident occurs in accordance with the conditional information to generate an accident candidate list.

Vessel traffic service system and method for extracting accident data

An abnormal traffic detection apparatus and method based on Modbus communication pattern learning is provided. The abnormal traffic detection apparatus based on the Modbus communication pattern learning previously detects and responds to abnormal traffic on a Modbus/TCP protocol. According to the present invention, a communication service between control systems can be stably provided by previously detecting the abnormal traffic capable of interfering with a stable operation of the control system. Particularly, since the effective abnormal traffic on the Modbus/TCP protocol can be previously detected, security of the control system can be increased by rapid detection and response with respect to security threats on the Intranet of the control system, and availability can be secured.

Abnormal traffic detection apparatus and method based on modbus communication pattern learning

The present invention relates to an insider threat detection device and method which collects and analyzes a variety of information generated by insiders working for an organization, such as behaviors, events, and states of the insider, and detects an abnormal insider who may become a potential threat. According to the present invention, the insider threat detection method and apparatus analyzes information related to insiders using the correlation analysis method, and previously detects an abnormal sign of an insider who may become a potential threat to an organization, which makes it possible to protect the organization from attacks on systems inside the organization or seizure of important information inside the organization.

Insider threat detection device and method

There are provided a system and method for tracing back an attacker by using centroid decomposition technique, the system including: a log data input module collecting log data of an intrusion alarm from an intrusion detection system; a centroid node detection module generating a shortest path tree by applying a shortest path algorithm to network router connection information collected by a network administration server, detecting a centroid node by applying centroid decomposition technique removing a leaf-node to the shortest path tree, and generating a centroid tree whose node of each level is the detected centroid node; and a traceback processing module requesting log data of a router matched with the node of each level of the centroid tree, and tracing back a router identical to the log data of the collected intrusion alarm as a router connected to a source of an attacker by comparing the log data of the router with the log data of the collected intrusion alarm. According to the system and method, an attacker causing a security intrusion event may be quickly detected, a load on the system is reduced, and a passage host exposed to a danger or having weaknesses may be easily recognized, thereby easily coping with an attack.

Log-based traceback system and method using centroid decomposition technique

There are provided an apparatus and method for sampling a security event based on contents of the security event, the apparatus including: a security event accumulation module collecting security events occurring in a network system and storing the security events for each type according to contents of the security event; a security event analysis module calculating distribution of the security events for each type by analyzing the stored security events; and a security event extraction module sampling the stored security events according to the calculated distribution of the security events for each type. The apparatus and method may improve speed of visualization of a security event and a security event analysis apparatus and may increase accuracy thereof.

Apparatus and method for sampling security events based on contents of the security events

A message security processing system and method for Web services are provided. In the message security processing system in which messages are exchanged between a client and a server with a SOAP-RPC format, each of the client and the server includes: a security interface allowing information related to digital signature, encryption, and timestamp insertion to be set in a security context object for an application program to meet security requirements of the client or the server; a security handler receiving the security context object from the security interface, and performing security processing of a request message by calling security objects stored in a request queue of the security context object one by one in order or performing security processing of a response message by calling security objects stored in a response queue of the security context object one by one in order; and an XML security unit supporting an XML security functions by called by the security handler.

Message security processing system and method for web services

There are provided a network security state visualization device and method, the device including: a security event collector collecting original security event information from network security apparatuses; a security event analyzer analyzing the original security event information collected by the security event collector and extracting characteristic data corresponding to a security event; and a three-dimensional visualization display unit visualizing a correlation between the characteristic data extracted by the security event analyzer as a three-dimensional screen to be displayed.

Method and apparatus for visualizing network security state

A network status display device using a traffic pattern map is provided. The device includes: a traffic feature extractor extracting a port number of a port having the maximum occupancy of micro-flows and macro-flows for each network address section and host address section with reference to traffic information collected by an external traffic information collector, calculating and storing an occupancy rate of the port; a traffic status display unit making a network traffic pattern map expressed by destination-source network addresses and a host traffic pattern map expressed by destination-source host addresses and displaying the port information stored in the traffic feature extractor on the network traffic pattern map and the host traffic pattern map; and a traffic anomaly determination unit determining whether a network status is abnormal with reference to the network traffic pattern map and the host traffic pattern map and detecting and reporting a harmful or abnormal traffic which causes the abnormal network status. The device can determine whether the anomaly deteriorating the network performance exists and can easily and quickly detect the harmful or abnormal traffic which causes the anomaly by the use of the port information of the port having the maximum occupancy of the micro-flows and the macro-flows for each network address section and each host address section.

Network status display device and method using traffic pattern map

A network status display device using a traffic flow-radar is provided. The network status display device includes: a traffic feature extractor calculating flow occupancy rates for total flows, micro-flows and macro-flows with respect to each of a plurality of traffic features with reference to traffic information for each traffic feature such as a network address, a port, a transmitting/receiving host address or a protocol collected by an external traffic information collector, and storing the calculation result; a traffic status display unit displaying the flow occupancy rates for each traffic feature calculated and stored in the traffic feature extractor on a radar with dots for each traffic feature; and a traffic anomaly determination unit determining whether a network status is abnormal with reference to the radar for each traffic feature, detecting and reporting the type of the abnormal network status and harmful or abnormal traffic that generates the abnormal network status, when the abnormal status occurs.

Network status display device and method using traffic flow-radar

Provided is an apparatus for detecting a network attack situation. The apparatus includes an alarm receiver receiving a plurality of alarms raised in a network to which the alarm receiver is connected, converting the alarms into predetermined alarm data, and outputting the alarm data; an alarm processor analyzing an attack situation in the network based on attributes of the alarm data and a number of times that the alarm data is generated; a memory storing basic data needed to analyze the state of the network and providing the basic data to the alarm processor; and an interface transmitting the result of the analysis by the alarm processor to an external device, receiving a predetermined critical value from the external device, which is a basis for determining the occurrence of the attack situation, and outputting the critical value to the alarm processor such that the alarm processor can store the critical value in the memory. Equal numbers of hash engines and detection engines for processing the alarms in the network to the number of data groups classified as network attack situations are formed in a line. Therefore, a network attack situation can be detected in real time based on a great number of alarms indicating intrusion detection.

Apparatus and method of detecting network attack situation

Provided is an apparatus for detecting and visualizing anomalies in network traffic which includes a traffic information storing portion storing information on network traffic, a traffic state display portion presenting a status of the network traffic generated for a predetermined threshold time based on the information on network traffic on an orthogonal coordinates system in a form of a graph connecting at least one point data as a coordinate value, and a traffic anomalies determination portion determining an existence of anomalies in the network traffic based on a shape of the graph.

Apparatus and method for detecting and visualizing anomalies in network traffic

Growing community of inventors

Daejeon, South Korea

Jung Chan Na