Earticle

많은 기업과 조직에서는 LTE 망을 활용한 모바일 오피스 환경을 구축하고 있으며 공공 안전과 국가 방위에서도 모바일 환경의 국가재난망과 공군 LTE망을 구축하고 있다. 하지만 최근의 모바일 정보보안 위협은 정보유출 공격에서서비스를 무력화 시키는 DDoS 공격으로 위협이 진화되고 있다. 특히, 스마트폰, 스마트패드, 태블릿PC 등 단말기의 종류와 수가 기하급수적으로 증가하고, 모바일 단말기의 사양 및 회선 속도가 빠르게 발전함에 따라 모바일 환경에서DDoS 공격은 더욱 위협적으로 진화하고 있다. 현재 DDoS 공격 대응은 네트워크 또는 서버 앞 단계에서 차단하는 방법이 보편적이지만 모바일 네트워크 상에 DDoS 공격 트래픽이 유통되어 네트워크 자원을 소비하는 문제점은 계속 상존하고 있다. 그러므로 본 논문에서는 단말기 단계에서부터 DDoS 공격을 선제적으로 차단하기 위해 국가재난망 및 공군 LTE망과 같은 사설 모바일 네트워크에서 유통되는 트래픽 유형을 분석하여 DDoS 공격을 차단하는 방안을 제시한다. 하지만 국가재난망과 공군 LTE망에서 유통되는 트래픽을 직접적으로 분석하는 것은 제한되므로 유통되는 정보유형이 유사한 마인크래프트 게임의 전송 트래픽과 동영상 파일 업로드 전송 트래픽을 대상으로 시계열 분석하여 사설모바일 네트워크에서의 DDoS 공격 탐지 기준을 정립하고 DDoS 공격을 탐지·차단하는 APP을 시범 구현하여 그 실효성을 검증하였다.

Many companies and organizations are building a mobile office environment using the LTE network, the national disaster network and Air Force LTE network are built for public safety and national defense. However the recent threats on information security have been evolving from information leakage to DDoS attacks to neutralize the service. Especially, the type of device such as Smart phones, smart pad, tablet PC, and the numbers are growing exponentially and As performance of mobile device and speed of line develop rapidly, DDoS attacks in the mobile environment is becoming a threat. So far, universal countermeasure to DDoS attacks has been interception the network and server step, Yet problem regarding DDoS attack traffic on mobile network and expenditure of network resources still remains. Therefore, this paper analyzes the traffic type distributed in the private mobile network such as the National Disaster Network, and Air Force LTE network in order to preemptively detect DDoS attacks on terminal step. However, as direct analysis on traffic distributed in the National Disaster Network, and Air Force LTE network is restricted, transmission traffics in Minecraft and uploading video file upload which exhibit similar traffic information are analyzed in time series, thereby verifing its effectiveness through establishment of DDoS attacks standard in mobile network and application that detects and protects DDoS attacks

SIP(Session Initiation Protocol)는 멀티미디어 세션을 관리하는 응용계층 프로토콜로서, 인터넷 전화 등 많은응용서비스에서 활용되고 있다. SIP 대상 공격들 중 플러딩 공격은 가장 위협이 큰 공격이라고 할 수 있다. 이를해결하기 위하여 제안된 화이트리스트 기반의 탐지 및 대응 방법들은 화이트리스트에 없는 비정상 사용자로 부터의공격을 탐지하고 차단하는 것이 가능하지만, 정상 사용자로 위장하여 화이트리스트에 등록한 후에 플러딩 공격할 시에는 대응할 수 없다. 본 논문에서는 화이트리스트에 속한 사용자들로부터 발생되는 메시지를 대상으로 카운팅 블룸필터를 적용하여 정상 사용자에 의한 악의적인 플러딩 공격을 탐지하고, 이에 대응하는 방법을 제안한다. 실험 결과는 기존 방법에서는 화이트리스트에 속한 사용자로 부터의 공격을 탐지하지 못하나, 제안방법은 이를 효과적으로 탐지하고 대응함을 보여준다.

SIP(Session Initiation Protocol) is an application layer protocol to manage multimedia sessions, and has been utilized for various application services such as Internet telephony. Flooding attacks are one of the most dangerous attacks on SIP-based applications. To solve the problem, the whitelist-based schemes can detect and countermeasure against attacks from abnormal users. However, they can’t react against attacks by legitimate users who have been registered in the whitelist. In this paper, we propose a method to detect and countermeasure flooding attacks from legitimate users listed in the whitelist by applying counting Bloom filters to messages from them. Experimental results show that existing whitelist-based schemes can’t detect flooding attacks from users listed in the whitelist, while the proposed method can detect and countermeasure against those attacks very effectively.

Distributed Denial of Service (DDoS) attacks has started posing a serious threat to all sorts of businesses, which have used the power of internet to their credit. DDoS attacks have put a big question mark on the capabilities and reliability of the World Wide Web. The use of supreme techniques to combat the DDoS attacks has not been substantial enough to fight the distributed nature of attacks. Hackers have been successful in blocking the services and flooding traffic to servers, in spite of a tight check on the network. Thus, in the view of personal data being present on the web and the threat to global economy worth million dollars, it becomes really important to devise some new techniques that are self-capable enough to capture, trace and nullify the dangers posed by such attacks. This term paper talks about such solutions to combat DDoS attacks. Here, the flow entropy in combination with average entropy technique is used to detect an attack. It highlights how the loop holes of one technique are covered by the other, resulting in a considerable improvisation in the methods of how we deal with these attacks.

군 관련 대외기관에서는 정보유출방지를 위하여 다양한 정보보호방지체계를 도입하여 운용하고 있 다. 그럼에도 불구하고 군 관련 대외기관은 항상 군 관련 자료들이 노출될 위험에 놓여 있으며, 이 정보유출이 지금도 지속되고 있는 실정이다. 즉 많은 정보보호체계들이 사용자 불편을 통해 업무 비 효율성을 추구하고 있어 많은 취약점과 문제점을 갖고 있기 때문이다. 각 조직들이 이를 해결하기 위 해 많은 HW와 SW를 도입하고 있지만 강력한 통제는 조직의 비효율성만 증가시키는 결과를 초래하 였다. 그래서 본 논문에서는 가상화 기반의 정보보호체계 구축을 위한 Virtual Security Zone 모델을 제시 연구하였다. 가상화 개념을 군 전산망에 적용한 모델로 망분리를 통한 기밀성, 무결성을 높였으 며 DDoS 공격 대응 체계를 구축하여 가용성 향상을 추구하였다. 이를 통해 군 독립 이중화 망을 사 용하는 군 기관의 정보보호체계를 구축하는 새로운 방안 제시를 위한 선행연구자료로 활용될 것으로 판단한다.

In this paper, the Military organization are commonly used for a variety of information system network(ex: Military network, Internet, Local Internet). The Organization which uses independent redundant military network has always been exposed to the risk of leakage of military-related materials. In order to prevent data loss defense agencies are governed by the introduction of a variety of systems. And military information security system is currently has a number of vulnerabilities and issues. Military organization has introduced a number of hardware and software in order to solve problems and unplanned. However to strengthen the information security policy has been badly efficiency of organization military business. So in this paper, we study that information disclosure prevention system using Virtual Security Zone for improving business condition of organization which uses independent redundant military network. This model is applied to the military computer network virtualization concept raised the confidentiality and integrity via a separate network. And to establish a DDoS attack response system sought to improve availability.

Two supervised learning algorithms, a basic neural network and a long short-term memory recurrent neural network, are applied to traffic including DDoS attacks. The joint effects of preprocessing methods and hyperparameters for machine learning on performance are investigated. Values representing attack characteristics are extracted from datasets and preprocessed by two methods. Binary classification and two optimizers are used. Some hyperparameters are obtained exhaustively for fast and accurate detection, while others are fixed with constants to account for performance and data characteristics. An experiment is performed via TensorFlow on three traffic datasets. Three scenarios are considered to investigate the effects of learning former traffic on sequential traffic analysis and the effects of learning one dataset on application to another dataset, and determine whether the algorithms can be used for recent attack traffic. Experimental results show that the used preprocessing methods, neural network architectures and hyperparameters, and the optimizers are appropriate for DDoS attack detection. The obtained results provide a criterion for the detection accuracy of attacks.

Since the development of Graphic Processing Unit (GPU) in 1999, the development speed of GPUs has become much faster than that of CPUs and currently, the computational power of GPUs exceeds CPUs dozens and hundreds times in terms of decimal calculations and costs much less. Owing to recent technological development of hardwares, general-purpose computing and utilization using GPUs are on the rise. Thus, in this paper, we have identified the elements to be considered for the Smart Grid Security. Focusing on a Performance Improvement of the Basic Algorithm for the Stateful Inspection to Detect DDoS Attacks using CUDA. In the program, we compared the search speeds of GPU against CPU while they search for the suffix trees. For the computation, the system constraints and specifications were made identical during the experiment. We were able to understand from the results of the experiment that the problem-solving capability improves when GPU is used. The other finding was that performance of the system had been enhanced when shared memory was used explicitly instead of a global memory as the volume of data became larger.

DDoS(Distributed Denial-of-Service) 공격은 인터넷 침해가운데 가장 위협적인 공격들 중 하나이며 이러한 공격을 실시간으로 탐지하기 위한 연구는 활발히 이루어져 왔다. 하지만 기존의 탐지 메커니즘이 가지고 있는 높은 오탐지율은 여전히 보완해야할 과제로 남아 있다. 따라서 본 논문에서는 DDoS공격 탐지의 근거로 사용된 기존의 트래픽 볼륨(traffic volume), 엔트로피(entropy), 그리고 카이제곱(chi-square)을 이용한 비정상 행위탐지(Anomaly detection)방식의 침임탐지시스템이 가지는 오탐지율(false alarm rate)을 개선할 수 있는 방안을 제안한다. 또한 공격 탐지 시 프로토콜, TCP 플래그(flag), 그리고 포트 번호를 이용하여 네트워크 관리자에게 보다 자세한 공격 정보를 제공함으로써 효율적으로 공격에 대처할 수 있는 시스템을 설계한다.

최근 나타나고 있는 DDoS 공격의 특징을 보면 소량의 트래픽을 이용하여 특정한 응용 계층 서비스를 마비시키는 형태로 진화하고 있다. 정상적인 TCP 세션 수립 후 DB와 연동되는 웹서버의 dynamic 콘텐츠에 대한 대량의 GET request를 발생시켜 웹서버와 DB서버 간 connection full 및 서버 부하를 유발함으로써 웹서비스를 중단시킨다. 이에 본 논문에서는, 공격 시간 전‧후에 수집된 각 IP 탐색트리의 cost 정보를 추출하여 정렬하고, 각 IP별 cost 크기를 비교하여 정상과 공격 모집단으로 구분한다. 각 모집단에서 표본조사를 실시하여 모평균의 신뢰구간을 계산하며 각 신뢰구간에서 임의추출을 통한 상대 도수 분포를 작성한다. 이를 통하여 정상 집단과 이상 집단의 각 IP별로 값을 비교하여 최종 공격을 판단한 후 해당 IP를 차단한다. 제안 시스템은 평균 92.51%로 높은 탐지 성능을 보였으며 GET flooding 형태의 DDoS 공격 탐지에 특화된 것임을 알 수 있다.

The characteristic trend of DDoS attacks appeared recently, has evolved into a form paralyzing specific application layer services using small amount of traffic. After establishing a normal TCP session, the attacks cause suspension of the web services by exhaustion of connection resources and maximum load between the web server and DB server occurring a large numner of GET request for the dynamic contents of the web server that interworks with DB server. In the study, cost information in each IP navigation tree is collected and sorted before and after the attack and traffics are divide into normal and attack population by comparing the total cost per each IP address. Calculation of the confidence interval of the mean is performed from a population sample and relative frequency distribution is constructed by randomization in confidence interval. Upon the distribution, the cost of each IP in normal and abnormal group is compared and it is determined whether or not the attack finally. The proposed system showed high detection performance with an average of 92.51%, and verified that it was specialized to DDoS attack detection of GET flooding type.

Task environment for enterprises and public institutions are moving into cyberspace-based environment and structing the LTE wireless network. The applications "App" operated in the LTE wireless network are mostly being developed with Android-based. But Android-based malwares are surging and they are the potential DDoS attacks. DDoS attack is a major information security threat and a means of cyber attacks. DDoS attacks are difficult to detect in advance and to defense effectively. To this end, a DMZ is set up in front of a network infrastructure and a particular server for defensive information security. Because There is the proliferation of mobile devices and apps, and the activation of android diversify DDoS attack methods. a DMZ is a limit to detect and to protect against DDoS attacks. This paper proposes an information security method to detect and Protect DDoS attacks from the terminal phase using a Preemptive military strategy concept. and then DDoS attack detection and protection app is implemented and proved its effectiveness by reducing web service request and memory usage. DDoS attack detection and protecting will ensure the efficiency of the mobile network resources. This method is necessary for a continuous usage of a wireless network environment for the national security and disaster control.