Electronics and Telecommunications Research Institute

Jungtaek Seo

Woonyon Kim

Jeong-Han Yun

Kyoung-Ho Kim

Eung Ki Park

Heemin Kim

Sungho Jeon

Sinkyu Kim

Jaeduck Choi

Eungki Park

Manhyun Chung

Gunhee Lee

Dongwook Kim

Byunggil Min

Yeop Jang

Choon Soo Kim

Yuseok Jeon

Incheol Shin

SeongKu Kang

Chun Soo Kim

Mincheol Jeon

Youngjun Cho

A method and system for extracting an access control list having a predetermined format from packets collected for a predetermined period of time, without requiring TCP flag information. By an information collection unit, network packets and network traffic logs are collected. By the information collection unit, a network traffic log including Media Access Control (MAC), Internet Protocol (IP), and port information is extracted from each network packet. By an information analysis unit, an access control list is generated based on the network traffic log.

Method and system for extracting access control list

The present invention presents a network apparatus and a selective information monitoring method using the network apparatus, which allow a user to monitor only required information (the field information of packets) from all received packets. The network apparatus one or more physical interfaces connected to a monitoring target host and configured to receive network packets from the monitoring target host, and a switch fabric module including a configurable monitoring module configured to perform filtering so that selective information is extracted from the network packets collected through the one or more physical interfaces.

Network apparatus and selective information monitoring method using the same

An apparatus and method for collecting digital evidence from a target system to be analyzed at a remote location and then providing security in a remote digital forensic environment based on the collected digital evidence. The method of providing security includes making, by a security providing apparatus, an evidence collection request for collection of evidence of an evidence collection-target apparatus from an evidence collection agent in a remote digital forensic environment, collecting evidence data corresponding to the evidence collection request from the evidence collection agent, verifying the evidence data based on a signature value of the evidence data collected from the evidence collection agent, generating evidence analysis data based on the verified evidence data, verifying the evidence analysis data based on a signature value of the evidence analysis data, and providing security for the evidence collection-target apparatus based on results of the verification of the evidence analysis data.

Device and method for providing security in remote digital forensic environment

An apparatus and a method for multilateral one-way communication are provided. The apparatus includes a one-way input module unit, detachably mounted to a plurality of slots formed in a rail, for receiving data from an external transmission host and for transmitting the received data to an internal network through one-way communication; a one-way output module unit, mounted detachably to the plurality of slots formed in the rail, for transferring data of interest to an internal network through one-way communication, and transmitting data of interest to an external reception host, and a two-way module unit, mounted detachably to the plurality of slots formed in the rail, for performing data communication between the transmission host and the reception host in a bidirectional mode.

Apparatus and method for multilateral one-way communication

An out-of-vehicle device interface apparatus includes a request message reception unit, a response message request unit, and a response message transmission unit. The request message reception unit receives a request message from an out-of-vehicle device, generates electrical signals in electric lines, and transfers the request message. The response message request unit requests response messages for the request message from one or more devices constituting an in-vehicle network based on one or more of the electric lines in which electrical signals have been generated. The response message transmission unit receives the response messages from the one or more devices, and transfers the response messages to the out-of-vehicle device via unidirectional communication.

Out-of-vehicle device interface apparatus and method for protecting in-vehicle network

A one-way data transmission and reception system and method, which mitigate the problem of a buffer overflow that may occur on a reception system while also mitigating the problem of data loss caused by a link error that may occur in the unidirectional line of a physical one-way data transmission system. The one-way data transmission system includes a first interface unit connected to a first network. A second interface unit is unidirectionally connected to a reception system connected to a second network. An interface integration module unit transmits a delayed Transmission Control Protocol (TCP) Acknowledgement (ACK) frame to a TCP session established with a device of the first network unit through the first interface unit, and transmits one or more identical data frames to the reception system through the second interface unit.

One-way transmission and reception with delayed TCP ACK message and monitoring for UDP and TCP frames

A whitelist-based network switch defines a whitelist and a handling rule based on an access control list, security policies, etc., and monitors and blocks network traffic based on the whitelist and the handling rule. The whitelist-based network switch includes a whitelist monitoring unit for storing a whitelist including permitted communication rules, monitoring one or more packets input through a plurality of switch interfaces based on the whitelist, and permitting communication of each packet conforming to the whitelist, and a whitelist management unit for updating the whitelist and transmitting an updated whitelist to the whitelist monitoring unit.

Whitelist-based network switch

An apparatus for protecting traffic trend in a network of a control system using artificial communication is provided. In accordance with an embodiment, the apparatus includes a communication terminal device installed in a network and configured to create and filter artificial communication. A communication server device determines whether to create artificial communication at a current time in the communication terminal device, requests a transmitting side-communication terminal device to create artificial communication, and requests a receiving side-communication terminal device to filter the artificial communication.

Apparatus and method for protecting communication pattern of network traffic

A technology for preventing leakage of personal information from traffics of terminals by transmitting and receiving fake communication data artificially generated so that an attacker does not identify normal communication between terminals is provided. A method for transmitting fake communication data includes: making a response request to whether or not a fake communication application is presented in an opponent terminal using an address book registered in a terminal; receiving a response corresponding to the response request and selecting targets to and from which the fake communication data are to be transmitted and received in a terminal list corresponding to the received response; controlling a communication amount depending on the selected targets; and transmitting the fake communication data to a corresponding receiving terminal depending on a control result.

Method for transmitting and receiving fake communication data and terminal performing the same

The present invention relates to an apparatus and method for analyzing vulnerability of a Zigbee network. For this, the apparatus for analyzing vulnerability of a Zigbee network present invention includes an allocation supporting unit for analyzing an environment of a Zigbee network and allocating a plurality of analyzers to multiple channels of the Zigbee network. A public vulnerability inspection unit inspects the Zigbee network for predefined public vulnerability via the plurality of analyzers. A new vulnerability analysis unit analyzes new vulnerability of the Zigbee network via the plurality of analyzers.

Apparatus and method for analyzing vulnerability of zigbee network

An apparatus and method for preventing the leakage of vehicle information in a normal communication environment by inserting fake communication data into vehicle communication traffic on a vehicle network. In the method for preventing leakage of vehicle information, a vehicle information leakage prevention apparatus connected to an in-vehicle module analyzes a vehicle communication protocol between the module and another module. It is determined whether encryption has been applied to the vehicle communication protocol, based on results of analysis of the vehicle communication protocol. A method of generating fake communication data is selected depending on whether encryption has been applied to the vehicle communication protocol. A fake communication data is generated depending on the selected method, and the generated fake communication data is transferred to a vehicle information leakage prevention apparatus connected to the other module.

Growing community of inventors

Daejeon, South Korea

Jungtaek Seo