Korea Internet & Security Agency

Other

Samsung Electronics Co., Ltd.

I-sens, Inc.

Boryung Pharmaceutical Co., Ltd.

Tae Eun Kim

Jee Soo Jurn

Hwan Mook Kim

Hakhyun Nam

Dae Il Jang

Hwan Kuk Kim

Seul Ki Choi

Geon Bae Na

Eun Jung Ko

Sa Rang Na

Soo Jin Yoon

Tae Hyeon Kim

Ki Jong Son

Sae Woom Lee

Eun Byul Lee

Do Won Kim

Sang Hwan Oh

Joon Hyung Lim

Jong Ki Kim

Geun Sig Cha

Ji Han Kim

Joo Han Lee

Seong Min Park

Hyung Jin Cho

Kyung Wan Nam

Je Hak Kim

Young Kwon Park

Jin Hyun Cho

Han Chul Bae

Myeong-Ho Lee

Bo Min Choi

Yong Ha Chi

Soo Heui Paik

Seung Ho Kim

In Jin Jang

Eun Hye Ko

Kyung Sang Yu

Joo Youn Cho

Seo Hyun Yoon

So Jeong Yi

Gyeong Jin Na

Hakhyum Nam

Seo Yeon Kim

Dong Hwan Oh

Sang Goo Shin

Min Woo Suh

There is provided a method for automatically generating a cyber crisis scenario, performed by a computing system. The method may comprise classifying types of content included in a cyber crisis report and extracting image data and text data from the cyber crisis report, inputting the image data into an image processing model and extracting attack procedure/behavior information included in the image data, inputting the text data into a text processing model and generating structured attack procedure-related data from each attack procedure included in the text data, generating threat behavior data corresponding to the attack procedure-related data, and merging the threat behavior data with the attack procedure-related data, matching the attack procedure-related data to the attack procedure/behavior information and generating a cyber crisis scenario template and automatically generating a cyber crisis scenario based on the attack procedure-related data and the cyber crisis scenario template.

Ai multi-domain integrated system and method for automatic generation of cyber crisis scenario

A method of supporting decision-making of security control includes: (a) when an system for automatically analyzing a security threat receives a security warning from a security device, collecting security threat events generating the security warning from the security device; (b) when the collected security threat events exceed a preset event processing threshold, generating, by the system for automatically analyzing a security threat, a first request message for preferentially processing a security event; (c) when receiving the first request message generated from the system, determining, by the system for supporting priority of security control, a priority processing order of the security threat events, and notifying the system; and (d) when receiving the second request message generated from the system, determining, by the system for supporting priority of security control, a priority processing order and notifying the system for automatically analyzing a security threat of the determined priority processing order.

Method for supporting decision-making in security control environment based on artificial intelligence

Disclosed is a system and a method of detecting an abnormal act threatening to security based on artificial intelligence according to the present invention, and, more particularly, a system and a method of detecting an abnormal act threatening to security based on artificial intelligence that are capable of rapidly carrying out pre-processing of a large-scaled data set based on multi processing, and efficiently detecting the abnormal act threatening to security via various pieces of security device on the basis of studied artificial intelligence.

System and method of detecting abnormal act threatening to security based on artificial intelligence

An event processing method performed by a computing device is provided. The method may comprise receiving a plurality of events and generating a first event sequence in which the received events are sequentially arranged, determining first priorities for the events included in the first event sequence, using data output from a previously trained priority decision model, verifying the first priorities by comparing the first priorities with second priorities for the events included in the first event sequence, determining a feedback score for the first priorities based on results of the verification; and reinforcing the training of the priority decision model using the feedback score.

Event processing method and system

The method for automatically generating a playbook performed by a computing apparatus according to the present disclosure comprises periodically collecting asset information and CTI (Cyber Threat Intelligence) information of a target network, extracting TTP (Tactics, Techniques, Procedure) information using the collected asset information and the collected CTI information, retrieving a data source of the extracted TTP information, generating a temporary playbook including a data component matching a detection method of the extracted TTP information among a plurality of data components of the retrieved data source, verifying validity of the temporary playbook based on data component order information of the temporary playbook and determining whether rearrangement of data components included in the temporary playbook is needed, and rearranging data components included in the temporary playbook, and storing it as a final playbook.

TTP based automated playbook generation method and system performing the same

A method for identifying a type of a variable within a binary performed on a computing device is provided. The method comprises, identifying a variable from disassembly code of a binary, and determining a type of the variable based on an instruction of the disassembly code, associated with the variable.

Method and device for identifying type of variable in binary

There is provided a method of patching a binary having vulnerability which is performed by a computing device. The method comprises loading a first binary to be patched, into a memory, generating a second binary by patching to call a stack frame initialization function from a vulnerable function of the first binary, executing the stack frame initialization function by calling the vulnerable function when the second binary is executed and initializing a stack frame area of the vulnerable function so as to automatically initialize a variable declared in the vulnerable function.

Method and apparatus for patching binary having vulnerability

Provided are methods of detecting a Diameter spoofing attack. According to an embodiment, the method comprises, obtaining a normal International Mobile Subscriber Identity (IMSI) from a packet of a Diameter S6a protocol transmitted from a Mobile Management Entity (MME) to a Home Subscriber Server (HSS) of a home network, adding a record comprising the normal IMSI to a session table, obtaining an Insert Subscriber Data Request (IDR) message of the Diameter S6a protocol and determining a category of the IDR message.

Method and apparatus for detecting diameter protocol IDR message spoofing attack in mobile communication network

Provided is an Internet protocol (IP) generation method. The method is performed by an IP generation apparatus comprising one or more processors and memory and includes: forming a plurality of initialized partial numbers by dividing a decimal number indicating a count of IP addresses that can be generated; changing the partial numbers according to a predetermined rule; generating an IP decimal number by linking the changed partial numbers; generating a random IP address from the IP decimal number; and generating a plurality of different random IP addresses with improved time efficiency, by sequentially repeating the changing of the partial numbers, the generating of the IP decimal number and the generating of the random IP address.

Random IP generation method and apparatus

Provided are a method and a system capable of efficiently detecting security vulnerability of program. The method includes: generating binary information including route information indicating an execution route of a program on a first test case; acquiring first crash information including the first test case and the route information when a crash of the first test case occurs; restoring a control flow graph based on the binary information; calculating complexity of the restored control flow graph; determining whether the complexity is less than a threshold value; only when a result of the determination indicates that the complexity is less than a threshold value, performing: executing a route detection on the route information; generating a second test case by executing the route detection; and acquiring a second crash information including the second test case and the route information.

Method for automatically detecting security vulnerability based on hybrid fuzzing, and apparatus thereof

Provided are a method and a system capable of efficiently detecting security vulnerability of program. The system for detecting the security vulnerability according to an embodiment of the present invention includes a vulnerability detecting module that acquires crash information, a binary analysis module that determines priority of binary information and whether to execute the route detection, and a route detecting module that executes the route detection to generate a new test case.

Provided are a binary vulnerability analysis method performed by a computing device is provided, and the binary vulnerability analysis method includes a primary execution step of recording a symbolic constraint of a vulnerability associated with an execution flow path causing a crash to a target binary to be analyzed and a suspicious element on the execution flow path by performing taint analysis through a primary execution of the target binary; and a secondary execution step of performing a secondary execution, which is a symbolic execution, on the execution flow path and, if an instruction satisfying the symbolic constraint is found, determining that the vulnerability exists in the target binary by comparing the suspicious element and the found instruction.

Method and apparatus for identifying security vulnerability in binary and location of cause of security vulnerability

Provided are a method and an apparatus for identifying computer system information which process banner information of an open port of a computer system, create a CPE tree by analyzing a CPE dictionary, and search keywords of respective levels of the CPE tree in a banner and generate one or more CPEs based on the CPE tree observing a format of the CPE dictionary to select CPEs which most match information of an operating system or an application program of a specific computer system among various CPE candidates and rapidly and easily identify CPE type vulnerability information which can interlock with CVE vulnerability information.

Method and apparatus for identifying vulnerability information using keyword analysis for banner of open port

A device information gathering method is provided. The device information gathering method includes: allowing a device information gathering apparatus to transmit a packet to a randomly generated Internet Protocol (IP) address and to receive a syn-ack packet as a response; allowing the device information gathering apparatus to parse the syn-ack packet and thus to extract Transmission Control Protocol (TCP)/IP fields; and allowing the device information gathering apparatus to compare the TCP/IP fields and an OS fingerprint rule, which is in JavaScript Object Notation (JSON) format, and thus to generate an OS fingerprint of the randomly generated IP address, wherein the OS fingerprint rule stores Operating Systems (OSs) and TCP/IP field values corresponding to versions of the OSs as attribute-value pairs.

Rule-based fingerprint generation methods and apparatus

A personal blood glucose meter and a method for sensing abnormal measurement using the same are disclosed. A personal blood glucose meter includes: a sensor strip for collecting and applying a blood sample, wherein the sensor strip includes a reagent; an electrode unit including a plurality of electrodes for receiving the blood sample from the sensor strip to generate electric current based on potential differences; an MCU for measuring currents value generated from the electrode unit to determine whether a glucose value of the blood sample is normal or abnormal; a potential supply unit for applying a predetermined potential to the electrode unit; and a display unit displaying resultant output from the MCU.

Personal blood glucose meter and abnormal measurement detection method using same

Growing community of inventors

Seoul, South Korea

Tae Eun Kim