Electronics and Telecommunications Research Institute

Korea Advanced Institute of Science and Technology

S2w Inc.

Samsung Electronics Co., Ltd.

Atto Research Co., Ltd.

Seung Won Shin

Jong Soo Jang

Sung Won Sohn

Ki Young Kim

Jintae Oh

Chang Hoon Yoon

Sang Duk Suh

Seung Hyeon Lee

Myoung Sung You

Yong Jae Lee

Seung Yong Yang

Jin Tae Oh

Hyunho Shin

Kibeom Park

Yeon Keun Kim

Jin Woo Chung

Young Jin Jin

Jian Cui

Da Yeon Yim

Eu Gene Jang

Yong Joo Song

Jae Woong Chung

Provided is a system for training a language model for cybersecurity, which includes: a document collection unit that collects a cybersecurity document used for training a language model for cybersecurity; an extraction unit that identifies non-linguistic elements in the cybersecurity document based on a non-linguistic element database; a tokenization unit that tokenizes the cybersecurity document to generate a plurality of tokens; and a language model application unit that controls the language model to simultaneously perform a first task of classifying types of the non-linguistic elements including at least one of a Bitcoin address, a hash value, an IP address, and a vulnerability identifier included in the cybersecurity document and a second task of recovering only linguistic elements of the cybersecurity document.

Method of training language model for cybersecurity and system performing the same

According to the present specification, a method for inspecting a high-speed network packet payload by a terminal includes: a step of receiving L7 (Layer 7) policy related to containers from a user; a step of extracting string patterns to be inspected for each of the containers on the basis of the L7 policy through a pattern compiler; a step of creating a deterministic finite automaton (DFA) on the basis of the extracted string patterns through the pattern complier; and a step of converting a state transition table of the deterministic finite automaton into a match-action table through the pattern compiler and storing the match-action table in an eBPF (extended Berkeley Packet Filter) map for a payload inspection engine.

High-speed network packet payload inspection system based on eBPF (extended Berkeley Packet Filter)/XDP (express data path) for container environment

A method for securing network communication between containers by a terminal, includes: a step of installing an HSI (Hyperion Secure Interface) for communication with a secure bridge included in an NIC (Network Interface Chip) in a secure container through a manager module; a step of changing a source address of a transmission packet to a specific token on the basis of a map of the HSI through the manager module; a step of delivering the transmission packet to the secure bridge through the HSI; a step of determining whether the specific token of the transmission packet is valid; and a step of changing the specific token to the source address and delivering the transmission packet to a target container when the specific token is valid.

Hardware-based reliable and secure container network

The present disclosure relates to a pre-5-Generation (5G) or 5G communication system to be provided for supporting higher data rates Beyond 4-Generation (4G) communication system such as Long Term Evolution (LTE). The present disclosure provides an apparatus and a method for handling a network attack in a software defined network (SDN). The method for handling a network attack in an SDN according to various embodiments of the present disclosure includes detecting a first candidate of the network attack in a flow during a first time interval, in response to detecting the first candidate, changing quality of service (QoS) of the flow from first QoS to second QoS, detecting a second candidate of the network attack in the flow of the second QoS during a second time interval following the first time interval, and in response to detecting the second candidate, blocking the flow. The apparatus and the method according to various embodiments of the present disclosure may gradually block a network attack through multiple levels, to thus reduce the probability of determining a wrong network attack and to lower a recovery cost for network failure. Therefore, the apparatus and the method according to various embodiments of the present disclosure enable efficient network management.

Device and method for handling network attacks in software defined network

A control apparatus which manages a software defined network including a plurality of switches includes a security management module that authenticates at least one application program, and an application program management module that executes the authenticated application program among the at least one application program in a first process, and executes the application program whose authentication fails in a second process. The application program management module may be executed in the first process, and the first process may be different from the second process.

Control apparatus in software defined network and method for operating the same

A method and apparatus for storing pattern matching data and a pattern matching method using the method and apparatus are provided. The method of storing original data for pattern matching in a pattern matching apparatus includes: dividing the original data into segments of a predetermined size; performing a hash operation on each of the divided segments; determining whether or not the hash operation value of each segment causes a hash collision with a hash operation value stored in a first external memory disposed outside the pattern matching apparatus; and controlling the hash operation value of each segment determined not to cause a hash collision to be stored in the first external memory. According to the method and apparatus, the original data desired to be used for pattern matching can be stored at a faster speed in a pattern matching data storing apparatus.

Method and apparatus for storing pattern matching data and pattern matching method using the same

In a real-time network attack pattern detection system and method, a common pattern is detected in real time from packets, which are suspected to be a network attack such as Worm, to effectively block the attack. The system includes: a suspicious packet detector for classifying a suspicious attack packet from all input packets; a first data delaying unit for receiving the input packet from the suspicious packet detector to output an one-clock delayed data; a second data delaying unit for receiving an output signal from the first data delaying unit to output an one-clock delayed data; a hash key generator for receiving an output data of the suspicious packet detector, an output data of the first data delaying unit and an output data of the second data delaying unit to generate a hash key; a hash table for storing a lookup result obtained by the hash key generated from the hash key generator; and an existence & hit checker for checking the lookup result of the hash table.

Real-time network attack pattern detection system for unknown network attack and method thereof

The present invention relates to a network intrusion detection and prevention system. The system includes: a signature based detecting device; an anomaly behavior based detecting device; and a new signature creating and verifying device disposed between the signature based detecting device and the anomaly behavior based detecting device, wherein if the anomaly behavior based detecting device detects network-attack-suspicious packets, the new signature creating and verifying device collects and searches the detected suspicious packets for common information, and then creates a new signature on the basis of the searched common information and at the same time, verifies whether or not the created new signature is applicable to the signature based detecting device, and then registers the created new signature to the signature based detecting device if it is determined that the created new signature is applicable.

Network intrusion detection and prevention system and method thereof

An apparatus and method for performing packet header lookup based on sequential lookup is provided. A header analyzer separates a header from a packet received via a network and outputs a lookup sequence. A unit lookup unit looks up matching the header combination rules with each field to be analyzed and input from the header analyzer based on the lookup sequence input from the header analyzer and outputs a match signal and a match address. A rule combination memory stores identification information for the header combination rules. A sequence combination memory stores lookup sequence information and sequence combination information. A rule combination unit generates match results based on the match signal input from the unit lookup unit and data read from the rule combination memory and the sequence combination memory.

Apparatus and method for performing header lookup based on sequential lookup

Growing community of inventors

Daejeon, South Korea

Seung Won Shin