Earticle

최근 다양한 형태의 악성코드 등장으로 인해 기존의 정적 분석은 많은 한계를 노출하고 있다. 정적분석 은 (악성)코드를 실제로 실행하지 않고 원시 코드나 목적 코드를 가지고 코드나 프로그램의 구조를 분석 하는 것을 의미한다. 한편 정보보안 분야에서의 동적 분석이란 일반적으로 (악성)코드를 직접 실행하여 분석하는 형태로 프로그램의 실행 플로우를 파악하기 위해 (악성)코드의 실행 전후 상태를 비교·조사하여 분석하는 형태를 의미한다. 그러나 동적 분석을 위해서는 막대한 양의 데이터와 로그를 분석해야 하며 모 든 실행 플로우를 실제로 저장하기도 어려웠다. 본 논문에서는 윈도우 환경(윈도우 10 R5 이상)에서 2세 대 PT를 기반으로 악성코드 탐지 및 실시간 다중 동적 분석을 수행하는 시스템의 전처리기 구조를 제안 하였고 이를 구현하였다.

Recently, due to the appearance of various types of malware, the existing static analysis expose s many limitations. Static analysis means analyzing the structure of a code or program with sourc e code or object code without actually executing the (malicious) code. On the other hand, dynamic analysis in the field of information security generally refers to a form that directly executes and a nalyzes (malware) code, and compares and examines and analyzes the state before and after execu tion of (malware) code to grasp the execution flow of the program. However, dynamic analysis req uired analyzing huge amounts of data and logs, and it was difficult to actually store all execution flows. In this paper, we propose and implement a preprocessor architecture of a system that performs malware detection and real-time multi-dynamic analysis based on 2nd generation PT in Windows environment (Windows 10 R5 and above).

운영 체제의 코어에 Intel PT가 포함된 경우, 크래시 발생 시 디버거는 프로그램 상태를 검사할 수 있을 뿐만 아니라 크래 시를 발생시킨 제어 플로우를 재구성할 수 있다. 또한, 커널 패닉 및 기타 시스템 정지와 같은 상황을 디버그하기 위해 실행 트레이스 범위를 전체 시스템으로 확장할 수도 있다. 2세대 PT인 WinIPT 라이브러리는 Windows 10 (버전 1809/Redstone 5) 에서 제공하는 IOCTL 및 레지스트리 메커니즘을 통해 프로세스 별 및 코어 별 트레이스를 실행할 수 있는 추가 코드가 포함 된 Intel PT 드라이버를 포함하고 있다. 즉 기존 1세대 PT에서 비정규화된 방식으로만 제한적인 접근이 가능했던 PT 트레이 스 정보를 2세대 PT에서는 운영 체제에서 제공하는 IOCTL 및 레지스트리 메커니즘을 통해 프로세스 별 및 코어 별 트레이 스를 실행할 수 있게 되었다. 본 논문에서는 1/2세대 PT를 이용하여 윈도우 환경에서 PT 데이터 패킷의 수집·저장·디코딩 및 악성코드 검출을 위한 방법을 비교·설명하였다.

If the operating system's core file contains an Intel PT, the debugger can not only check the program state at the time of the crash, but can also reconfigure the control flow that caused the crash. We can also extend the execution trace scop e to the entire system to debug kernel panics and other system hangs. The second-generation PT, the WinIPT library, inc ludes an Intel PT driver with additional code to run process and core-specific traces through the IOCTL and registry mec hanisms provided by Windows 10 (RS5). In other words, the PT trace information, which was limited access only by the first generation PT, can be executed by process and core by the IOCTL and registry mechanism provided by the operatin g system in the second generation PT. In this paper, we compare and describe methods for collecting, storing, decoding an d detecting malicious codes of data packets in a window environment using 1/2 generation PT.

Renewable energy and energy storage system are a hot topic today since the global warming is related to the burning of fossil fuels. Renewable generations using wind, solar and wave sources are integrated into power system for securing economic feasibility. However, grid-connected wind power having its natural variability greatly may affect stability of power system, and TSO (Transmission System Operator) and ISO (Independent System Operator) have developed grid code for wind power. Especially, technical requirements for testing and simulation are specified in grid code because GCC (Grid Code Compatibility) is ascertained through onsite testing and computer simulation. Therefore, the simulation model requirements should be understood clearly from the early stage of project, and the exact models and reports can be delivered to TSO and certification body on time. Namely, wind turbine manufacturer should deliver its dynamic models, model validation report and test report, on the other hand, wind power plant owner should deliver its dynamic models and commissioning report. The accurate understanding of different simulation model requirements presented from various national grid code avoids simulation modeling error.

The structural integrity of either a passenger car or a light truck is one of the basic requirements for a full vehicle engineering and development program. The results of the vehicle product performance are measured in terms of ride and handling, durability, Noise/Vibration/Harshness (NVH), crashworthiness, and occupant safety. The level of performance of a vehicle directly affects the marketability, profitability and, most importantly, the future of the automobile manufacturer. In this study, the Virtual Proving Ground (VPG) approach has been developed to simulate dynamic nonlinear events as applied to automotive ride & handling. The finite element analysis technique provides a unique method to create and analyze vehicle system models, capable of including vehicle suspensions, powertrains, and body structures in a single simulation. Through the development of this methodology, event-based simulations of vehicle performance over a given three-dimensional road surface can be performed. To verify the predicted dynamic results, a single lane change test was performed. The predicted results were compared with the experimental test results, and the feasibility of the integrated CAE analysis methodology was verified.

Lately, ocean nuclear power plants have attracted attention as one of diverse uses of nuclear power plants. Because ocean nuclear power plants are movable or transportable, it is necessary to analyze the thermal hydraulics in a moving frame of reference, and computer codes have been developed to predict thermal hydraulics in large moving systems. The purpose of this study is to incorporate a three dimensional dynamic motion model into the SPACE code (Safety and Performance Analysis CodE) so that the code is able to analyze thermal hydraulics in an ocean nuclear power plant. A rotation system that describes three-dimensional rotations about an arbitrary axis was implemented, and modifications were made to the one-dimensional momentum equations to reflect the rectilinear and rotational acceleration effects. To demonstrate the code's ability to solve a problem utilizing a rotational frame of reference, code calculations were conducted on various conceptual problems in the two-dimensional and three-dimensional pipeline loops. In particular, the code results for the three-dimensional pipeline loop with a tilted rotation axis agreed well with the multi-dimensional CFD results.