Korea Internet & Security Agency

Seong Min Park

Do Won Kim

Hyung Jin Cho

Young Kwon Park

Bo Min Choi

Jin Hyun Cho

Sung Moon Kwon

Tae Eun Kim

Hwan Kuk Kim

Eun Hye Ko

Provided is a method for detecting abnormal traffic. The method comprises collecting non-access stratum (NAS) traffic between a user equipment (UE) and a mobility management node, identifying a ciphering algorithm supported by the UE from a network access request message transmitted from the UE to the mobility management node, and identifying the UE as a first type of terminal at risk based on a determination that the UE only supports a null ciphering algorithm.

Method and apparatus for detecting null-ciphering channels

Provided is a method for rearranging traffic data performed by a computing device. The method comprises obtaining traffic data transmitted and received between a base station and a terminal, calculating a value of a Radio Resource Control (RRC) inactivity timer based on a RRC release message included in the traffic data, determining a size of a time window using the calculated value of the RRC inactivity timer and rearranging, for each time window having the determined size, the traffic data of a target terminal by an RRC connection request time.

Method and apparatus for rearranging traffic data

Provided are methods of detecting a Diameter spoofing attack. According to an embodiment, the method comprises, obtaining a normal International Mobile Subscriber Identity (IMSI) from a packet of a Diameter S6a protocol transmitted from a Mobile Management Entity (MME) to a Home Subscriber Server (HSS) of a home network, adding a record comprising the normal IMSI to a session table, obtaining an Insert Subscriber Data Request (IDR) message of the Diameter S6a protocol and determining a category of the IDR message.

Method and apparatus for detecting diameter protocol IDR message spoofing attack in mobile communication network

Growing community of inventors

Jeollanam-do, South Korea

Seong Min Park