Earticle

최근 웹 애플리케이션의 복잡성 증가와 함께 새로운 보안 취약점이 지속적으로 발생하고 있으나, 기존 알려진 정적 분석 도구는 취약점(CVE) 데이터베이스에 의존적으로 제로데이 공격 및 복합적인 위협에 대응이 어려운 한계를 지니고 있 다. 따라서, 본 연구는 Nmap 기반 정적 분석과 생성형 AI를 결합한 하이브리드 웹 보안 프레임워크를 제안한다. 기본 정적 도구는 단계에서 알려진 취약점(CVE) 매핑을 수행한 후, AI 기반으로 동적 테스트 케이스(SQLi/XSS 페이로드 등)를 실시간 으로 스캐닝한다. 취약점 패턴 분석 결과, 기존 정적 분석 대비 40% 향상된 탐지율(F1-Score 0.91)과 AI의 문맥 이해 능력을 활용해 오탐지율을 25% 감소시켰다. 본 연구는 향후 오픈소스(Nmap)와 클라우드 기반 ChatGPT API의 연동을 통해 저비 용·고효율 보안 솔루션 개발을 위한 기초연구로서 의의가 있다.

The increasing complexity of modern web applications has led to the continuous emergence of new security vulnerabilities. However, existing static analysis tools rely heavily on vulnerability (CVE) databases, limiting their ability to effectively counter zero-day attacks and complex threats. Therefore, this study proposes a hybrid web security framework that combines Nmap-based static analysis with generative AI. The basic static tool performs known vulnerability (CVE) mapping in a step, and then AI-based dynamic test cases (SQLi/XSS payloads, etc.) are scanned in real-time. Analysis of vulnerability patterns showed a 40% improvement in detection rate (F1-Score 0.91) compared to existing static analysis, while leveraging AI's contextual understanding capability reduced false positive rates by 25%. This research holds significance as foundational work for developing low-cost, high-efficiency security solutions through future integration with open-source tools (Nmap) and cloud-based ChatGPT APIs.

운영 체제의 코어에 Intel PT가 포함된 경우, 크래시 발생 시 디버거는 프로그램 상태를 검사할 수 있을 뿐만 아니라 크래 시를 발생시킨 제어 플로우를 재구성할 수 있다. 또한, 커널 패닉 및 기타 시스템 정지와 같은 상황을 디버그하기 위해 실행 트레이스 범위를 전체 시스템으로 확장할 수도 있다. 2세대 PT인 WinIPT 라이브러리는 Windows 10 (버전 1809/Redstone 5) 에서 제공하는 IOCTL 및 레지스트리 메커니즘을 통해 프로세스 별 및 코어 별 트레이스를 실행할 수 있는 추가 코드가 포함 된 Intel PT 드라이버를 포함하고 있다. 즉 기존 1세대 PT에서 비정규화된 방식으로만 제한적인 접근이 가능했던 PT 트레이 스 정보를 2세대 PT에서는 운영 체제에서 제공하는 IOCTL 및 레지스트리 메커니즘을 통해 프로세스 별 및 코어 별 트레이 스를 실행할 수 있게 되었다. 본 논문에서는 1/2세대 PT를 이용하여 윈도우 환경에서 PT 데이터 패킷의 수집·저장·디코딩 및 악성코드 검출을 위한 방법을 비교·설명하였다.

If the operating system's core file contains an Intel PT, the debugger can not only check the program state at the time of the crash, but can also reconfigure the control flow that caused the crash. We can also extend the execution trace scop e to the entire system to debug kernel panics and other system hangs. The second-generation PT, the WinIPT library, inc ludes an Intel PT driver with additional code to run process and core-specific traces through the IOCTL and registry mec hanisms provided by Windows 10 (RS5). In other words, the PT trace information, which was limited access only by the first generation PT, can be executed by process and core by the IOCTL and registry mechanism provided by the operatin g system in the second generation PT. In this paper, we compare and describe methods for collecting, storing, decoding an d detecting malicious codes of data packets in a window environment using 1/2 generation PT.

최근 다양한 형태의 악성코드 등장으로 인해 기존의 정적 분석은 많은 한계를 노출하고 있다. 정적분석 은 (악성)코드를 실제로 실행하지 않고 원시 코드나 목적 코드를 가지고 코드나 프로그램의 구조를 분석 하는 것을 의미한다. 한편 정보보안 분야에서의 동적 분석이란 일반적으로 (악성)코드를 직접 실행하여 분석하는 형태로 프로그램의 실행 플로우를 파악하기 위해 (악성)코드의 실행 전후 상태를 비교·조사하여 분석하는 형태를 의미한다. 그러나 동적 분석을 위해서는 막대한 양의 데이터와 로그를 분석해야 하며 모 든 실행 플로우를 실제로 저장하기도 어려웠다. 본 논문에서는 윈도우 환경(윈도우 10 R5 이상)에서 2세 대 PT를 기반으로 악성코드 탐지 및 실시간 다중 동적 분석을 수행하는 시스템의 전처리기 구조를 제안 하였고 이를 구현하였다.

Recently, due to the appearance of various types of malware, the existing static analysis expose s many limitations. Static analysis means analyzing the structure of a code or program with sourc e code or object code without actually executing the (malicious) code. On the other hand, dynamic analysis in the field of information security generally refers to a form that directly executes and a nalyzes (malware) code, and compares and examines and analyzes the state before and after execu tion of (malware) code to grasp the execution flow of the program. However, dynamic analysis req uired analyzing huge amounts of data and logs, and it was difficult to actually store all execution flows. In this paper, we propose and implement a preprocessor architecture of a system that performs malware detection and real-time multi-dynamic analysis based on 2nd generation PT in Windows environment (Windows 10 R5 and above).

Renewable energy and energy storage system are a hot topic today since the global warming is related to the burning of fossil fuels. Renewable generations using wind, solar and wave sources are integrated into power system for securing economic feasibility. However, grid-connected wind power having its natural variability greatly may affect stability of power system, and TSO (Transmission System Operator) and ISO (Independent System Operator) have developed grid code for wind power. Especially, technical requirements for testing and simulation are specified in grid code because GCC (Grid Code Compatibility) is ascertained through onsite testing and computer simulation. Therefore, the simulation model requirements should be understood clearly from the early stage of project, and the exact models and reports can be delivered to TSO and certification body on time. Namely, wind turbine manufacturer should deliver its dynamic models, model validation report and test report, on the other hand, wind power plant owner should deliver its dynamic models and commissioning report. The accurate understanding of different simulation model requirements presented from various national grid code avoids simulation modeling error.

The structural integrity of either a passenger car or a light truck is one of the basic requirements for a full vehicle engineering and development program. The results of the vehicle product performance are measured in terms of ride and handling, durability, Noise/Vibration/Harshness (NVH), crashworthiness, and occupant safety. The level of performance of a vehicle directly affects the marketability, profitability and, most importantly, the future of the automobile manufacturer. In this study, the Virtual Proving Ground (VPG) approach has been developed to simulate dynamic nonlinear events as applied to automotive ride & handling. The finite element analysis technique provides a unique method to create and analyze vehicle system models, capable of including vehicle suspensions, powertrains, and body structures in a single simulation. Through the development of this methodology, event-based simulations of vehicle performance over a given three-dimensional road surface can be performed. To verify the predicted dynamic results, a single lane change test was performed. The predicted results were compared with the experimental test results, and the feasibility of the integrated CAE analysis methodology was verified.

Lately, ocean nuclear power plants have attracted attention as one of diverse uses of nuclear power plants. Because ocean nuclear power plants are movable or transportable, it is necessary to analyze the thermal hydraulics in a moving frame of reference, and computer codes have been developed to predict thermal hydraulics in large moving systems. The purpose of this study is to incorporate a three dimensional dynamic motion model into the SPACE code (Safety and Performance Analysis CodE) so that the code is able to analyze thermal hydraulics in an ocean nuclear power plant. A rotation system that describes three-dimensional rotations about an arbitrary axis was implemented, and modifications were made to the one-dimensional momentum equations to reflect the rectilinear and rotational acceleration effects. To demonstrate the code's ability to solve a problem utilizing a rotational frame of reference, code calculations were conducted on various conceptual problems in the two-dimensional and three-dimensional pipeline loops. In particular, the code results for the three-dimensional pipeline loop with a tilted rotation axis agreed well with the multi-dimensional CFD results.

최근에는 GPGPU(General-Purpose computing on Graphics Processing Units)와 같은 고성능 연산장치의 보급과 함께 국방, 우주항공분야에서 암질재료에 대한 충격실험을 대신할 수 있는 3차원 동적해석기법의 개발이 활발하게 진행되고 있다. 그러나 높은 충격하중을 수반하는 암 발파 또는 소형미사일 등의 지중 관통과 같은 과정을 실험적으로 관찰하거나 계측하는 것은 암질재료의 비 균질성 및 불투명성 때문에 어려움이 있었다. 본 연구에서는 고속충돌에 의한 암석의 파괴 거동을 모사하기 위하여 3차원 동적 파괴 과정 해석 기법 (3D-DFPA)를 개발하였으며, 연산속도를 향상시키기 위하여 순차해석(explicity analysis) 및 접촉요소검색(Searching algolitm of contact elements)에 GPGPU연산이 가능한 알고리듬을 적용하였다. 제안된 동적파괴과정해석 기법에 대한 검증을 위해 Straight Notched Disk Bending (SNDB) 석회암시료에 대한 동적파괴인성시험을 모사하였고, 충격응력파의 전파과정, 암석-충격봉 경계면에서 반사 및 전달과정, 암석 시료의 파괴과정을 비교분석하여, 개발된 해석기법에 대한 검증을 수행하였다.

Recently, with the development of high-performance processing devices such as GPGPU, a three-dimensional dynamic analysis technique that can replace expensive rock material impact tests has been actively developed in the defense and aerospace fields. Experimentally observing or measuring fracture processes occurring in rocks subjected to high impact loads, such as blasting and earth penetration of small-diameter missiles, are difficult due to the inhomogeneity and opacity of rock materials. In this study, a three-dimensional dynamic fracture process analysis technique (3D-DFPA) was developed to simulate the fracture behavior of rocks due to impact. In order to improve the operation speed, an algorithm capable of GPGPU operation was developed for explicit analysis and contact element search. To verify the proposed dynamic fracture process analysis technique, the dynamic fracture toughness tests of the Straight Notched Disk Bending (SNDB) limestone samples were simulated and the propagation of the reflection and transmission of the stress waves at the rock-impact bar interfaces and the fracture process of the rock samples were compared. The dynamic load tests for the SNDB sample applied a Pulse Shape controlled Split Hopkinson presure bar (PS-SHPB) that can control the waveform of the incident stress wave, the stress state, and the fracture process of the rock models were analyzed with experimental results.

최근 채석장 및 광산의 파쇄설비로부터 발생되는 소음 및 분진에 의한 민원과 환경적인 문제가 대두되고 있으며, 이러한 파쇄설비를 지하공동으로 옮기는 사례가 증가하고 있다. 파쇄설비 및 가공시설을 갱내에 설치하기 위해서는 넓은 공간의 굴착이 이루어져야 하고, 대형공동 주변암반의 안정성이 확보되어야 한다. 지하공동 주변암반의 안정성은 굴착 시공 시 발생되는 굴착손상영역과 밀접한 관계가 있어, 최종파단면을 형성시키는 최외곽 발파공에 대한 정밀한 설계가 필요하다. 본 연구에서는 석회석 지하광산에서 대형공동 및 영구갱도 굴착시 발생 가능한 발파균열길이 및 손상영역을 예측하기 위한 수치해석기법을 제안하였다. 먼저 석회암블록에 대한 발파실험을 수행하고 발생된 인장균열수 및 길이를 분석하여, 동적파괴과정해석코드의 주요 입력변수인 평균 미시적 인장강도를 결정하였다.

Recently, complaints or environmental problems caused by the noise and dust generated from crusher of the mine and quarry are emerging. Therefore mining facilities such as crushers and mills have been installed in an underground. In order to facilitate crusher equipments in the underground, excavation of large space is required and then the stability of the large space underground structure is an important issue. In this study, the blast experiments, which use a block of the limestone, are performed. Based on the blast experiments, the numerical model was prepared and simulated using dynamic fracture process analysis code(DFPA) with considering the rising time of applied borehole pressure and microscopic tensile strength variation. Comparing the non-dimensional crack length and no-dimensional tensile strength obtained from blast experiments and numerical analyses, the input parameters of DFPA code for predicting a radial tensile crack in limestone blasting were determined.