Electronics and Telecommunications Research Institute

Kiwook Sohn

Hyunggeun Oh

Geun Yong Kim

Hyung Geun Oh

Myeong Ryeol Choi

Dong Su Nam

Taek Kyu Lee

YuJeong Han

Seok Won Lee

Ji-Eun Lee

Yung Yi

Cheolho Lee

Young Han Choi

KyoungSoo Park

Junghee Lee

Jung Hwan Moon

Sungryoul Lee

Jihyung Lee

Hyung-Geun Oh

Deokjin Kim

Sangwoo Moon

Dong-Phil Kim

Jun-Young Choi

Tae-Hyung Kim

Jaehun Lee

Yosik Kim

Eunyoung Kim

Jinmo Park

Youngtae Yun

Byungchul Bae

An apparatus and method for processing packets are disclosed. The apparatus for processing packets includes a session processing unit, a parallel processing unit, and a storage unit. The session processing unit divides a packet group, including a plurality of HTTP packets, into a plurality of session files, and then distributes the session files. The parallel processing unit generates metadata and extracts content from each of the distributed session files based on the plurality of session files. The storage unit stores the metadata generated by the parallel processing unit and the content extracted by the parallel processing unit.

Apparatus and method for processing packets

Disclosed herein is an Intrusion Detection System (IDS) false positive detection apparatus and method. An IDS false positive detection apparatus includes a payload extraction unit for extracting payloads by dividing each packet corresponding to an IDS detection rule into a header and a payload. A false positive payload information generation unit generates false positive payload information required to identify a false positive payload by extracting a payload of a false positive packet based on results of packet analysis received from a manager. A false positive payload determination unit transmits results of a determination of whether each payload extracted by the payload extraction unit corresponds to a false positive payload, based on the false positive payload information, to the manager.

Intrusion detection system false positive detection apparatus and method

A packet analysis apparatus and method and a VPN server, which secure evidence against a situation in which a hacker disguises a packet as a normal packet to make an attack using a VPN server as a router. The packet analysis apparatus includes a packet classification unit for gathering and classifying packets which are used between a host and the VPN server and plaintext packets which are used between the VPN server and a target. A first comparative analysis unit compares contents of an encapsulated IP datagram of each encrypted VPN packet, obtained by decrypting the encrypted VPN packet, with contents of a plaintext IP datagram included in each plaintext packet and present for a target to which the host desires to transfer the encrypted VPN packet. A second comparative analysis unit compares lengths of the encapsulated IP datagram and the plaintext IP datagram with each other.

Packet analysis apparatus and method and virtual private network server

An intrusion detection apparatus and method using a load balancer responsive to traffic conditions between a central processing unit (CPU) and a graphics processing unit (GPU) are provided. The intrusion detection apparatus includes a packet acquisition unit, a character string check task allocation unit, a CPU character string check unit, and a GPU character string check unit. The packet acquisition unit receives packets, and stores the packets in a single task queue. The character string check task allocation unit determines the number of packets in the packet acquisition unit, and allocates character string check tasks to the CPU or the GPU. The CPU character string check unit compares the character strings of the packets with a character string defined in at least one detection rule inside the CPU. The GPU character string check unit compares the character strings of the packets with the character string inside the GPU.

Intrusion detection apparatus and method using load balancer responsive to traffic conditions between central processing unit and graphics processing unit

An apparatus and method for manifesting an event to verify the security of a mobile application are provided. The apparatus for manifesting an event to verify the security of a mobile application includes a tester application production unit, a tester application execution unit, and a tester application daemon execution unit. The tester application production unit produces a tester application for testing an application to be tested based on application information which is extracted from the application to be tested. The tester application execution unit executes the application to be tested by manifesting an event included in the extracted application information, and extracts a user view object output to a screen of a smart device when the application to be tested is executed. The tester application daemon execution unit generates a touch event based on the extracted user view object, and performs a screen change.

Apparatus and method for manifesting event to verify security of mobile application

An apparatus and method for detecting forgery/falsification of a homepage. The apparatus includes a homepage image shot generation module for generating homepage image shots of an entire screen of an accessed homepage. A character string extraction module extracts character strings from each homepage image shot using an OCR technique. A character string comparison module compares each of the extracted character strings with character strings required for determination of homepage forgery/falsification, thus determining whether the extracted character string is a normal character string or a falsified character string. A homepage falsification determination module determines whether the corresponding homepage has been forged/falsified, based on results of the comparison. A character string learning module learns the character string extracted from the homepage image shot, based on results of the determination, and classifies the character string as the normal character string or the falsified character string.

Apparatus and method for detecting forgery/falsification of homepage

The present invention relates to a smart terminal fuzzing apparatus and method using a multi-node structure. The smart terminal fuzzing apparatus includes a fuzzing command management unit for managing fuzzing instructions corresponding to performance of fuzzing. An algorithm management unit creates fuzzing commands based on the fuzzing instructions, and distributes the fuzzing commands to a plurality of fuzzing nodes connected to a fuzzing client depending on a distribution algorithm. A fuzzing client management unit performs control such that fuzzing is performed by the plurality of fuzzing nodes in compliance with the fuzzing commands through the fuzzing client. A log management unit receives results of performance of fuzzing from the plurality of fuzzing nodes and manages the fuzzing results.

Smart terminal fuzzing apparatus and method using multi-node structure

A method for analyzing user's behaviors is provided. API function call patterns occurring when operations on various objects are performed on a computer system are configured with contexts. User's behaviors are recognized as associations between the contexts and systematically expressed. Information flow occurring in the user's behaviors (i.e., associations between the contexts) is tracked. The information flow chain is divided into a source and a destination. When the information flow a confidential object to a leakage point occurs, the information leakage is rapidly detected and blocked. By exactly recognizing behaviors belonging to the corresponding information flow chain, user's behaviors related to the information leakage can be detected. Furthermore, the behavior expression based on the contexts configured with the API function call patterns with respect to the system object can be achieved by naturally connecting the API function call occurring on the system as an abstract behavior.

Method for recognizing information flow and detecting information leakage by analyzing user's behaviors

Growing community of inventors

Daejeon, South Korea

Kiwook Sohn