Soongsil University

Crowdstrike, Inc.

Souhwan Jung

JungSoo Park

Ngoc-Tu Chau

Jaehyeon Yoon

Seongeun Kang

Young Sik Youn

Thien-phuc Doan

Huy Hoang Nguyen

Kihun Hong

Seung Wook Jung

Provided is a method for detecting a synthetic voice based on a biological sound, the method comprises receiving an audio stream; extracting a biological feature vector corresponding to a meaningless voice from the audio stream; extracting a synthetic voice feature vector from the audio stream; combining the biological feature vector and the synthetic voice feature vector to generate a combined feature vector; and determining whether the audio stream is a synthetic voice based on the combined feature vector. Accordingly, it is possible to detect a synthetic voice at a lower computational cost than a conventional neural network that detects a synthetic voice by learning the correlation between frames.

Synthetic voice detection method based on biological sound, recording medium and apparatus for performing the same

Provided is a secure communication control system. The secure communication control system comprises a guest control unit provided in a guest operating system for generating a thread requesting arbitrary data from a host application installed in a host operating system; a guest shared key generation unit for generating a guest shared key to be used in the thread; a guest communication unit for transmitting the thread and the guest shared key to the host operating system; a host shared key generation unit for generating a host shared key corresponding to the guest shared key; a host control unit for requesting data according to the thread from the host application to receive the data from the host application, generating a session key from the guest shared key, and generating cipher text by encrypting the data using the session key; and a host communication unit for transmitting the cipher text and the host shared key to the guest operating system.

Secure communication control system and method used in virtualized operating system environment

Provided is a hybrid trusted execution environment based android security framework, an android device equipped with the same and a method of executing a trusted service in the android device. The hybrid trusted execution environment based android security framework includes a hardware resource that comprises a rich execution environment (REE) where an android operating system (OS) runs, and a secure container which implements a virtualized trusted execution environment (VTEE) that processes a security task in the rich execution environment (REE) when an application running on the rich execution environment requests the security task.

Hybrid trust execution environment based android security framework, android device equipped with the same and method of executing trust service in android device

Provided is an adaptive dynamic analysis method, an adaptive dynamic analysis platform and a device equipped with the same. The adaptive dynamic analysis method for an application running in a container environment of a Linux host includes stopping execution of a first activity of the application, and acquiring analysis information for malicious code diagnosis of the application, conducting dynamic analysis using the analysis information, acquiring environment information to execute a second activity based on the dynamic analysis, and performing an execution environment update of the application by reflecting the environment information, and executing the application to enable the second activity to run.

Adaptive dynamic analysis method, adaptive dynamic analysis platform, and device equipped with the same

A mobile device having a system for analyzing malicious code is provided. The mobile device includes a container agent generating at least one Android container executing Android malicious code for dynamic analysis in response to a request received from a cloud controller and checking a state of the at least one Android container, a Linux host, a hardware module containing an operating system (OS) for the Linux host, and an analysis agent detecting a problem occurring upon an operation of the Android malicious code in the at least one Android container through the Linux host, and transmitting information of kernel-related malicious code behavior to an analysis server.

Mobile device for analyzing malicious code using a container platform, system for analyzing malicious code in a mobile device using the same, and method for analyzing malicious code using the same

A system for running a Linux based Android container platform with a processor and a memory is disclosed. The system includes a Linux host, an Android container which runs on the Linux host, and an integrated security module including a Linux security module having a Linux policy of a process running on the Linux host, and an Android security module having an Android policy of a process running on the Android container. The integrated security module is mounted in a directory shared between the Linux host and the Android container and the integrated security module overwrites a pre-existing Linux security module.

Linux based android container platform, device equipped with the same and method for apply security system in Linux based android container environment

A duo operating system (OS) for Android security is provided. The duo operating system includes an Android kernel providing drivers for a hardware and an interface of a mobile device, a security platform storing a security key of an integrity check when a kernel is booted in a Linux space, a first layer containing a Linux-based operating system executing a mobile device monitoring and a mobile device security examination, and a second layer containing one or more container-based Android operating systems being a user space layer interacting with users through Android applications.

Duo operating system for android security, mobile device having the same, method of securing mobile device having the same

Provided is a method and apparatus of dynamic loading file extraction. The method for extracting a specific dynamic generated file of an application running in an Android container environment includes conducting first analysis to identify if a file extension that is stored in the Android container corresponds to a preset critical extension, to extract a file with the critical extension, and conducting second analysis to identify a deleted file standing for a file deleted after stored in the Android container, and running the application again and extracting the deleted file based on a result of the second analysis.

Method and apparatus of dynamic loading file extraction for an application running in an android container

An Android dynamic loading file extraction method includes checking if at least one call of DexClassLoader, BaseDexClassLoader, PathClassLoader and openDexFile is made to a decompile code of Android Application Package (APK), hooking a dynamic loading method created in dynamic loading mechanism when the at least one call is made, extracting a dex path from the dynamic loading method, identifying if a File.delete method is invoked when the dex path is extracted, hooking the File.delete method when the File.delete method is invoked, extracting a path of the File.delete method and identifying if the path of the File.delete method is matched with the dex path, and extracting a dex file or jar file from the decompile code of APK when the path of the File.delete method is unmatched with the dex path. Accordingly, the dex file used in dynamic loading mechanism of the malicious application is extracted, and static analysis of the hidden codes is conducted using reverse engineering mechanism.

Android dynamic loading file extraction method, recording medium and system for performing the method

An RFID tag using a physically unclonable function (PUF) generates a response value corresponding to a challenge value, receives an RFID reader ID from an RFID reader, generates a first message authentication code for the RFID reader ID, an RFID tag ID and time information by using, as a secret key, a first response value corresponding to a first challenge value, and transmits, to the RFID reader, the first challenge value, the first message authentication code and the time information of the RFID tag, which are tag identification elements, when the RFID reader ID is received. At this time, the RFID tag shares, with an RFID tag authentication server, the same message authentication code generation function, the RFID tag ID, the first challenge value, and the first response value generated by a PUF module.

Growing community of inventors

Seoul, South Korea

Souhwan Jung