Electronics and Telecommunications Research Institute

Jung-Chan Na

Seon-Gyoung Sohn

Byoung-Koo Kim

Sung Won Sohn

Ik Kyun Kim

Dong Ho Kang

Youngjun Heo

Hyun Sook Cho

Ju-Young Kim

Jong Hyun Kim

Hyun-Sook Cho

Chi Yoon Jeong

Hyun Joo Kim

Hyunwoo Kim

Geon Lyang Kim

Seon Gyoung Sohn

Beom Hwan Chang

Byeong-Cheol Choi

Byung-Gil Lee

Hyun-joo Kim

Jong-Hyun Kim

Kwan-Tae Cho

Min-Ho Han

Boo-Sun Jeon

Soo-Hyung Lee

Sung-Won Sohn

Joong-Yong Choi

Dae-Hee Seo

Won-Joo Park

Jong Ho Ryu

Byung-Doo Kim

Hyo-Chan Bang

Jae-Hoon Nah

Jong-Soo Jang

Chi-Yoon Jeong

Geon-Lyang Kim

Jong-Ho Ryu

Young-Jun Heo

Dong-Ho Kang

Do-Hyeung Kim

Seong-Cheon Park

Seung-Hee Oh

Seoung-Hyeon Lee

Beom-Hwan Chang

A method of integrating different homomorphic operations in homomorphic encryption is provided. The method includes receiving a homomorphic ciphertext and encryption scheme information from a ciphertext generating apparatus by using a communication interface, performing a homomorphic multiplication operation on the homomorphic ciphertext by using a homomorphic multiplication operator, analyzing the encryption scheme information to determine one operation of a re-linearization operation performed by a re-linearization operator and a key switching operation performed by a key switching operator by using a main controller, performing the determined one operation by using the re-linearization operator or the key switching operator, and performing a modulus switching operation on an operation result of the determined one operation by using a modulus switching operator.

Computing apparatus and method of integrating different homomorphic operations in homomorphic encryption

Disclosed herein are a one-way data transmission apparatus, a one-way data reception apparatus, and a one-way data transmission/reception method using the apparatuses. The one-way data transmission/reception method uses a one-way data transmission apparatus and a one-way data reception apparatus, and includes receiving data from a high-security zone through a one-way path, generating tag information of the data, sending a message in which the tag information is added to the data to the one-way data reception apparatus, receiving the message from the one-way data transmission apparatus, checking the tag information of the message, and transmitting the data to a low-security zone.

One-way data transmission apparatus, one-way data reception apparatus, and one-way data transmission/reception method using the same

A method for detecting an abnormal traffic on a control system protocol, includes: checking whether session information exists in a management table; adding a new entry to the management table; checking whether a transaction ID in a table entry is the same as that of the received MODBUS request message; and checking whether data and length thereof of the received MODBUS request message are the same as those in the table entry. Further, the method includes detecting an abnormal traffic; and updating the table entry with packet information of the MODBUS request message.

Method for detecting abnormal traffic on control system protocol

The present invention relates to an apparatus and method that control a vessel deviating from an anchorage using wide-range sensor-based spherical trigonometry. In the method, vessels anchored in an anchorage are monitored. The anchorage is defined as a group, and the group of the anchored vessels is managed. Leaving of a vessel, needing to deviate from the anchorage, from the group is controlled. If a vessel recognized as a vessel identical to one that left the group requests anchoring after a predetermined period of time has elapsed, the anchoring-requesting vessel is controlled.

Apparatus and method for controlling vessel deviating from anchorage

An apparatus for detecting an abnormality sign in a control system, the control system comprising control equipments, network equipments, security equipments or server equipments, the apparatus includes an information collection module configured to collect system information, network information, security event information or transaction information in interworking with a control equipments, network equipments, security equipments or server equipments. The apparatus includes storage module that stores the information collected by the information collection module. The apparatus includes an abnormality detection module configured to analyze a correlation between the collected information and a prescribed security policy to detect whether there is an abnormality sign in the control system.

Apparatus and method for detecting abnormality sign in control system

Provided are a web-based traceback system and method using reverse caching proxy, which can effectively protect a web server against various attacks launched by illegitimate user by acquiring network information and location information of users who attempt to access the web server through an anonymous server, without a requirement of installing any agent program in the users' clients. The web-based traceback system may include a reverse caching proxy server receiving a hypertext transfer protocol (HTTP) packet transmitted to a web server by a client, analyzing the header of the HTTP packet and determining whether the client has attempted to access the web server through an anonymous server based on the results of the analysis; and a web tracking server generating a response page for the HTTP packet upon receiving the results of the determination performed by the reverse caching proxy server, inserting a tracking code in the response page, and providing the response page to the client through the reverse caching proxy server, wherein the tracking code is automatically executed in a web browser of the client and thus provides network information of the client to the web tracking server.

Web-based traceback system and method using reverse caching proxy

An apparatus and method for visualizing a network condition related to a network security are provided. The apparatus includes a traffic feature extracting unit, a network condition displaying unit, and a traffic abnormal condition determining unit. The traffic feature extracting unit extracts information including source address, source port, destination address, and destination port from network traffics, selects two of the extracted information, and calculates unique dispersion degrees of two unselected information. The network condition displaying unit displays a two-dimensional cube expressed using the calculated unique dispersion degrees for the classified traffics. The traffic abnormal condition determining unit determines whether the traffics are in an abnormal condition or not based on the two-dimensional security cube.

Apparatus and method for visualizing network situation using security cube

A system for defending against a distributed denial-of-service attack includes an intrusion detection system, an active security management system and an active security node. The intrusion detection system generates alert data if a denial-of-service attack is detected. The active security management system manages a domain, analyzes the alert data, generates and transmits a backtracking sensor in a case of the distributed denial-of-service attack, transmits mobile sensors to a host backtracked by the backtracking sensor to remove a master or an agent program within the host; and generates and transmits a backtracking sensor by using an IP address of a host that has transmitted a packet to the removed master or agent program. The active security node executes the transmitted backtracking sensor to backtrack an attacking host of the distributed denial-of-service attack and, if the backtracked host is determined as a real attacker, intercepts a traffic generated from the real attacker.

System and method for defending against distributed denial-of-service attack on active network

Disclosed are a system and method of sharing intrusion detection information detected at different networks and tracking the intrusion, to thereby defense against the intrusion on a network to which an intruder belongs, and a computer-readable medium storing a program for implementing the above method therein. The system detects an intrusion through the analysis of an input packet, adds information associated with the intrusion into the packet, creates an active packet and transmits the active packet to an address of an intruder, which transmitted the packet. Thereafter, the system tracks the intrusion, for all routes through which the intruder passed based on the active packet, and filters the packet associated with the intruder for the isolation thereof.

Security system for networks and the method thereof

Growing community of inventors

Daejeon, South Korea

Jung-Chan Na