Electronics and Telecommunications Research Institute

Jung-Tae Kim

Ik-Kyun Kim

Sang-Min Lee

Jong-Hyun Kim

Ji-Hyeon Song

Dae-Sung Moon

Hyun-Sook Cho

Young-Su Kim

Jong-Hoon Lee

Ki-Jong Koo

Min-Ho Han

Koo-Hong Kang

Jong-Geun Park

Disclosed herein are an apparatus and method for updating an Internet-based malware detection engine using virtual machine scaling. The method may include creating a scaling group and an update group set based on a first virtual machine image, creating a second virtual machine image for a running virtual machine in response to occurrence of a snapshot event in the virtual update group run based on the first virtual machine image, modifying the scale-out image of the scaling group to the second virtual machine image, updating the scaling group by triggering a scale-out event and a scale-in event in the scaling group in response to occurrence of an update event, and modifying the scale-in image of the scaling group to the second virtual machine image.

Apparatus and method for updating internet-based malware detection engine using scaling control of virtual machine

Disclosed herein are an apparatus for detecting unknown malware using a variable-length operation code (opcode) and a method using the apparatus. The method includes collecting opcode information from a detection target, generating a multi-pixel image having a variable length by performing feature engineering on the opcode information; and detecting unknown malware by inputting the multi-pixel image to a deep-learning model based on AI.

Apparatus for detecting unknown malware using variable opcode sequence and method using the same

Disclosed herein are an apparatus and method for detecting a malicious script. The apparatus includes one or more processors and executable memory for storing at least one program executed by the one or more processors. The at least one program is configured to extract token-type features, each of which corresponds to a lexical unit, and tree-node-type features of an abstract syntax tree from an input script, to train two learning models to respectively learn two pieces of learning data that are generated in consideration of features extracted respectively from the token-type features and the node-type features as having the highest frequency, and to detect whether the script is a malicious script based on the result of ensemble-based malicious script detection performed for the script, which is acquired using an ensemble detection model generated from the two learning models.

Apparatus and method for detecting malicious script

Disclosed herein are a stepping-stone detection apparatus and method. The stepping-stone detection apparatus includes a target connection information reception unit for receiving information about a target connection from an intrusion detection system (IDS), a fingerprint generation unit for generating a target connection fingerprint based on the information about the target connection, and generating one or more candidate connection fingerprints using information about one or more candidate connections corresponding to one or more flow information collectors, and a stepping-stone detection unit for detecting a stepping stone by comparing the target connection fingerprint, in which a maximum allowable delay time is reflected, with the candidate connection fingerprints.

Stepping-stone detection apparatus and method

Disclosed herein are an apparatus and method for detecting a Distributed Reflection Denial of Service (DRDoS) attack. The DRDoS attack detection apparatus includes a network flow data reception unit for receiving network flow data from network equipment, a session type determination unit for determining a session type of the received network flow data, a host type determination unit for determining a type of host corresponding to the network flow data based on the session type, an attack method determination unit for determining an attack method corresponding to the network flow data, a protocol identification unit for identifying a protocol of the network flow data, and an attack detection unit for detecting a DRDoS attack based on the session type, the host type, the attack method, and the protocol.

Apparatus and method for detecting distributed reflection denial of service attack

An apparatus and a method for an attack source traceback capable of tracing back an attacker, that is, an attack source present behind a command and control (C&C) server in a cyber target attack having non-connectivity over a transmission control protocol (TCP) connection are disclosed. The apparatus for the attack source traceback includes: a server information extracting unit detecting an attack for a system, which is generated via a server to thereby extract information on the server; a traceback agent installing unit installing a traceback agent in the server based on the information on the server; and a traceback unit finding an attack source for the system by analyzing network information of the server obtained by the traceback agent.

Apparatus and method for attack source traceback

Provided are an apparatus for providing a social network service using the relationship of ontology and a method thereof. The apparatus includes: an ontology storage unit storing social ontology defining relationship information between a user and a social network subscriber, service ontology defining position and relationship information of services, and tag ontology defining tag information related to information included in the social ontology and the service ontology; when a service request is inputted from the user, an ontology analysis unit retrieving a tag corresponding to the user's current position and the service request factor by using the relationship of the ontologies stored in the ontology storage unit; a service processing unit extracting the corresponding service on the basis of the retrieved tag information; and a service providing unit providing the user with the extracted service.

Growing community of inventors

Daejeon, South Korea

Jung-Tae Kim