Ajou University Industry-academic Cooperation Foundation

Samsung Electronics Co., Ltd.

Tae Shik Shon

Hyo Hyun Choi

Hyung Uk Yoo

Jin Ho Kim

Choong Seon Hong

Wook Choi

Sun Gi Kim

Yeong Hun Shin

Bon Hyun Koo

Yong Jong Park

Seok Lee

Sung Moon Kwon

Seok Cheol Lee

The electronic device for performing digital forensics on an in-vehicle infotainment environment according to an exemplary embodiment of the present invention includes a processor which identifies each specification information of an in-vehicle infotainment (IVI) system installed in a vehicle and a user terminal communicating with the IVI system, collects communication section data generated in a communication section between the IVI system and the user terminal, first device data of the IVI system and second device data of the user terminal through collection methods prepared in response to the specification information, extracts artifacts associated with the in-vehicle infotainment environment by analyzing the communication section data, the first device data and the second device data through analysis methods prepared in response to the specification information, and verifies the artifacts through mutual comparison between the communication section data, the first device data and the second device data.

Electronic device for performing digital forensics on in-vehicle infotainment environment and method thereof

The present application relates to a method and apparatus for digital forensic corresponding to an IoT (Internet of Things) terminal, the method including: performing, by an electronic device, an analysis of an Internet of Things (IoT) terminal to which digital forensics is to be performed; selecting an injection method of injecting, by the electronic device, a certificate into the IoT terminal; injecting, by the electronic device, a certificate into at least one of the IoT terminal, the electronic device, and a portable device communicating with the IoT terminal using the selected injection method; and verifying, by the electronic device, data stored in a cloud server communicating with the IoT terminal based on the injected certificate, and can also be applied to other embodiment.

Method and apparatus for digital forensic corresponding to internet of things

An operating method of a computing device operated by at least one processor includes collecting traffic packets; extracting particular field data from the traffic packets, transforming the extracted particular field data to a vector with a reduced dimension for each traffic packet, and creating training data with the vector for each traffic packet; training a traffic prediction model with the training data, the traffic prediction model predicting from an input traffic packet a next input traffic packet and whether the next input traffic packet is abnormal; and predicting with the trained traffic prediction model a frequency of abnormal traffic packets to be input, and outputting an abnormal traffic warning by comparing the predicted frequency and a threshold.

Method and apparatus for detecting abnormal traffic pattern

Provided is a method for generating a one class model based on a data frequency. The method for generating a one class model based on a data frequency includes: generating, by a machine learning apparatus, a plurality of spatial coordinates by arranging a plurality of learning data in corresponding coordinates in a feature space; classifying, by the machine learning apparatus, the plurality of spatial coordinates into a plurality of internal coordinates PI and a plurality of external coordinates PO based on a frequency of the learning data arranged in the respective spatial coordinates which belong to the plurality of spatial coordinates; and generating, by the machine learning apparatus, a one class model based on the plurality of internal coordinates PI based on mutual spatial distances of the plurality of external coordinates PO and the plurality of internal coordinates PI.

Method and apparatus for generating one class model based on data frequency

Provided are a method of monitoring a network driving apparatus provided in a network and a system thereof. The present invention provides a network monitoring method that performs monitoring which does not hinder existing network availability through a means for detouring a path of a packet transferred to a monitoring target apparatus by using one or more servers and clients connected to a network and further, provides extensibility which can be applied to the network using various communication protocols through a protocol converting means that detours the path of the packet after converting the existing protocol into a TCP/IP protocol.

Method and system of monitoring network

According to an aspect of the inventive concept, there is provided a system for detecting vulnerabilities of communication protocol software, including: a field selection module selecting message fields of a communication protocol of an industrial control system; a value set configuration module configuring first value sets with respect to the respective message fields selected by the field selection module; a test case generation module generating first test cases by Cartesian product of the first value sets; a test module generating first code coverage data by testing the communication protocol software of the industrial control system based on the first test cases; and a code coverage analysis module analyzing the first code coverage data, wherein the field selection module selects concentration message fields which influence the first code coverage data among the message fields according to an analysis result of the code coverage analysis module.

Method and system for detecting vulnerabilities of communication protocol software

A mobility management system and method is provided for efficiently support mobility to an IPv6 based LoWpan. The mobility management method for Internet Protocol version 6 (IPv6) based personal area network (PAN) moving with a mobile router according to the present invention includes detecting, at a mobile terminal, movement of the mobile router; determining whether the movement is an intra-network movement or an inter-network movement, transmitting, when the movement is an intra-network movement, a neighbor discovery request message to a gateway of a currently attached network and receiving a neighbor discovery response message containing a temporary address transmitted by the gateway in response to the neighbor discovery request message. When the movement is an inter-network movement, the gateway receives the binding acknowledgement message from a home agent and establishes a bidirectional tunnel with the home agent.

Mobility management system and method for internet protocol based low power wireless network

A method, apparatus and system for displaying topology information of a wireless sensor network includes a plurality of sensor nodes. The method typically includes: receiving node information collected and extracted from the sensor nodes; comparing the received node information with stored node information; computing, when the received node information is unequal to the stored node information, visualization information on a sensor node whose information is not present in the stored node information; and displaying the sensor nodes on concentric circles using the visualization information.

Method, apparatus and system for displaying topology information of wireless sensor network

A mobility header compression method and system for an IPv6-based LoWPAN is provided for supporting IPv6 mobility to the IPv6-based LoWPAN checks a packet carrying data and a first and a second headers containing transmission information about the data to determine whether the second header contains a compressed Internet Protocol version 6 (IPv6) information. When the second header contains a compressed IPv6 information, ands followed by a mobility header, a mobility support-indicative field of the first header is set to indicate that the second header is followed by the mobility header and the rest of the fields of the second header are compressed except for the mobility header-indicative field. A mobility information-indicative field of the mobility header is set to indicate inclusion of mobility information; and the rest of the fields of the mobility header are compressed except for the mobility information-indicative field.

Mobility header compression method and system for internet protocol-based low power wireless network

A method and system for detecting a suspicious frame in a wireless sensor network that includes: a plurality of sensor nodes, for sending sensed data and data regarding an upper-level node and cluster head node. A data collecting node receives data from the sensor nodes, sends information, and extracts data received from the sensor nodes. A first probability of occurrence of the routing path is computed with respect to training frames, and a second probability of occurrence of a source routing path is computed using the first probability. The second probability is compared with a reference value, and displays an indication notifying an abnormality of the source node according to when the second probability and the reference value.

Growing community of inventors

Suwon-si, South Korea

Tae Shik Shon