Korea Internet & Security Agency

Sung Taek Oh

Woong Go

Jae Hyuk Lee

Mi Joo Kim

Hong Geun Kim

Jun Hyung Park

Soon Tai Park

Jae Han Jeong

Sam Shin Shin

Su Jeong Kim

There is provided a method for identifying attack infrastructure, performed by a computing system. The method may comprise collecting network traffic data of a host device that is the target of a security incident, acquiring, from the network traffic data, first data regarding port numbers recorded in the network traffic data, second data regarding protocols recorded in the network traffic data, and third data regarding textual information included in network packets recorded in the network traffic data or category information provided by network equipment, automatically identifying attack infrastructure corresponding to the first data, the second data, and the third data by using a predefined classification model and blocking network access of an Internet Protocol (IP) address associated with the attack infrastructure, wherein the attack infrastructure corresponds to resources utilized by an attacker during the security incident.

Method and system for identifying attack infrastructure

Provided are a method for detecting an anomaly in devices, the method being performed by a computing device and comprising: acquiring operation information on a first device connected to a security management unit (SMU) of a first domain, and operation information on a second device connected to a SMU of a second domain, and detecting an anomaly in the first device and/or the second device by comparing the operation information on the first device with the operation information on the second device, wherein the SMU of the first domain is not directly connected to the SMU of the second domain.

Method and apparatus for detecting anomaly in a plurality of devices by collectively analyzing information on devices

Provided is a method performed by a computing device for identifying a device. The method include receiving a target packet from an identification target device, extracting a pattern of the target packet, the target packet being transmitted by the identification target device from the packet, matching the pattern of the target packet with at least one of packet patterns stored in an identification information DB, comparing a first model name with a second model name, the first model name being corresponding to the matched pattern stored in the identification information DB, the second model name being selected by a user of a user terminal, and transmitting a proposed model name to the user terminal based on determining that the first model name and the second model name are different, the proposed model name being used for connection between the user terminal and the identification target device.

Method and apparatus for identifying devices using collective intelligence

There is provided a method of generating malicious traffic, the method being performed by a computing apparatus and comprising obtaining traffic data transmitted from a first device infected with first malicious code or received by the first device, generating a traffic template of the first device by analyzing the traffic data, and generating a malicious traffic template of a terminal group, wherein the malicious traffic template of the terminal group comprises the traffic template of the first device.

Method and apparatus for generating virtual malicious traffic template for terminal group including device infected with malicious code

Provided is a method performed by a computing device for detecting abnormal behavior in a network. The method comprises obtaining a plurality of individual rules, wherein an individual rule of the plurality of individual rules is for extracting first output data from at least one input data set among a plurality of input data sets, the first output data satisfying a first extraction condition, obtaining a plurality of association rules, wherein an association rule of the plurality of association rules is for extracting second output data from at least one of the plurality of input data sets and the first output data, the second output data satisfying a second extraction condition and detecting abnormal behavior in a network based on third output data, the third output data being extracted using one of the plurality of individual rules and the plurality of association rules.

Method and apparatus for detecting abnormal behavior in network

An apparatus comprising a processor to execute the rule optimizer to perform a number of operations. One operation comprises obtaininglog data including a result of detecting an exploit attack based on a rule. Another operation comprises time-series analyzing the obtained log data to update at least some of previously applied detection rules. There is provided an apparatus for automatically optimizing a rule to improve the detection accuracy for an exploit attack in a rule-based attack detection system, and a method performed on the apparatus.

Apparatuses for optimizing rule to improve detection accuracy for exploit attack and methods thereof

Provided is a method for classifying a cyber-attack performed in a computing device having an artificial neural network. The method comprises obtaining a plurality of features extracted from collected packets and inputting the plurality of features into the artificial neural network and using data output from the artificial neural network to determine a type of cyber-attack indicated by the collected packet.

Method and apparatus for identifying the type of cyber-attack against IoT devices

There is provided a reinforcement learning method in which a discount factor is automatically adjusted, the method being executed by a computing device and comprising repeatedly training a reinforcement learning model, which determines an evaluation result of input data, using the input data, wherein the repeatedly training of the reinforcement learning model comprises obtaining first result data which is output as a result of inputting the input data to the reinforcement learning model. obtaining second result data which is the result of evaluating the input data using a first evaluation model. obtaining a first return which is the result of adding a discount factor to a first reward given in consideration of whether the first result data and the second result data match. training the reinforcement learning model using the first return and automatically adjusting the discount factor by considering the second result data.

Growing community of inventors

Jeollanam-do, South Korea

Sung Taek Oh