Electronics and Telecommunications Research Institute

Junghee Lee

Yung Yi

KyoungSoo Park

Sungryoul Lee

Sangrok Lee

Jihyung Lee

Kiwook Sohn

Young Han Choi

Hyunggeun Oh

Deokjin Kim

Byungchul Bae

Sangwoo Moon

An apparatus and method for monitoring the confidentiality and integrity of a target system. The apparatus for monitoring the confidentiality and integrity of a target system includes a target area information reception unit for receiving target area information about a target area of the target system and storing the target area information, a monitoring unit for extracting attack information by monitoring at least one of confidentiality, corresponding to a data load instruction, and integrity, corresponding to a data store instruction, based on the target area information, and an attack-handling unit for determining whether an attack is occurring based on the extracted attack information and for handling the attack when it is determined that an attack is occurring.

Apparatus and method for monitoring confidentiality and integrity of target system

A malicious code analysis device and method used on an external device connected via a USB cable. The malicious code analysis method includes connecting a malicious code analysis device to an analysis target terminal, on which malicious code is to be executed, from outside the analysis target terminal via a USB cable, multi-booting the analysis target terminal based on multiple Operating System (OS) image files stored in the malicious code analysis device; providing user input to the analysis target terminal so that malicious code is incapable of recognizing that a current environment is an analysis environment, and analyzing, by the malicious code analysis device, the malicious code in consideration of both data modified by the malicious code, among pieces of data corresponding to the multiple OS image files, and the user input.

Malicious code analysis device and method based on external device connected via USB cable

An apparatus and method for storing data traffic on a flow basis. The apparatus for storing data traffic on a flow basis includes a packet storage unit, a flow generation unit, and a metadata generation unit. The packet storage unit receives packets corresponding to data traffic, and temporarily stores the packets using queues. The flow generation unit generates flows by grouping the packets by means of a hash function using information about each of the packets as input, and to store the flows. The metadata generation unit generates metadata and index data corresponding to each of the flows, and stores the metadata and the index data.

Apparatus and method for storing data traffic on flow basis

An intrusion detection apparatus and method using a load balancer responsive to traffic conditions between a central processing unit (CPU) and a graphics processing unit (GPU) are provided. The intrusion detection apparatus includes a packet acquisition unit, a character string check task allocation unit, a CPU character string check unit, and a GPU character string check unit. The packet acquisition unit receives packets, and stores the packets in a single task queue. The character string check task allocation unit determines the number of packets in the packet acquisition unit, and allocates character string check tasks to the CPU or the GPU. The CPU character string check unit compares the character strings of the packets with a character string defined in at least one detection rule inside the CPU. The GPU character string check unit compares the character strings of the packets with the character string inside the GPU.

Intrusion detection apparatus and method using load balancer responsive to traffic conditions between central processing unit and graphics processing unit

Growing community of inventors

Daejeon, South Korea

Junghee Lee