Electronics and Telecommunications Research Institute

Young Chan Shin

Jin Tae Oh

Cheol Won Lee

Tae Joo Chang

Hwa Shin Moon

Ki Bom Kim

Hyun Uk Hwang

Sung Won Yi

Sung Jai Baik

Method and apparatus for collecting evidence are provided. An exemplary embodiment enhances accuracy and efficiency of collecting evidence by analyzing link information in the target computer and collecting collection target file. And the exemplary embodiment can collect evidence from a target computer as well as from a remote computer through analyzing the link information in the target computer, identifying the path of collection target file and extracting the target file.

Method and apparatus for collecting evidence

Provided is a method and apparatus for generating a network attack signature capable of generating a signature having a high reliability while minimizing a whitelist used to prevent false positive. An application header and application data are separated from each other to measure byte distributions of the application header and the application data from an input packet. When an attack signature is generated by analyzing the measured byte distributions, a substring of the application data is used to generate the attack signature, and a substring of the application header is used as supporting information on the signature.

Method and apparatus for generating network attack signature

Growing community of inventors

Daejeon, South Korea

Young Chan Shin