-
公开(公告)号：KR1020090034648A
公开(公告)日：2009-04-08
申请号：KR1020070100009
申请日：2007-10-04
Applicant: 한국전자통신연구원
IPC: G06F15/00
CPC classification number: G06F9/455 , G06F21/566
Abstract: A method and an apparatus for analyzing the malware software within a non-executable file which uses the virtual environment use the object program having the weak point in the virtual environment are provided to analyze the malware included in the non-executable file safely. A program execution part(114) outputs register value of an object program by loading non-executable file analyzed in an object program. A program run analysis part(122) analyzes the outputted register value. In case the register value indicates a domain except a normal code domain, the program run analysis part stores log information about the operation of the object program in the log information database(124). A malware analyze part(126) extracts and analyzes malware included in the non-executable file based on log information. When the outputted register value begins to indicate domain except the normal code area, the program run analysis part begins to store the log information.
Abstract translation: 提供一种用于分析使用虚拟环境的非可执行文件中的恶意软件的方法和装置，使用虚拟环境中具有弱点的对象程序来安全地分析非可执行文件中包含的恶意软件。 程序执行部件（114）通过加载在对象程序中分析的不可执行文件来输出对象程序的寄存器值。 程序运行分析部分（122）分析输出的寄存器值。 在寄存器值指示除了正常代码域之外的域的情况下，程序运行分析部件将关于对象程序的操作的日志信息存储在日志信息数据库（124）中。 恶意软件分析部分（126）基于日志信息提取并分析包含在不可执行文件中的恶意软件。 当输出的寄存器值开始指示除正常代码区域之外的域时，程序运行分析部件开始存储日志信息。
-
公开(公告)号：KR100872435B1
公开(公告)日：2008-12-05
申请号：KR1020070058327
申请日：2007-06-14
Applicant: 한국전자통신연구원
CPC classification number: H04L41/0893
Abstract: A network management system and a method thereof are provided to manage a network based on the value of a network apparatus, thereby making network management considering characteristics of the network apparatus possible. A value-based network management system(10) comprises the followings: a value estimating part(101) collecting information about the value of network equipment; a storage(102) storing the value of the network equipment delivered from the value estimating part; a policy judging part(103) which compares the value of the network equipment, estimated at present, with the required value of the network equipment, delivered from a manager, to judge whether to apply the required value of the network equipment; and a policy executing part(104) which transmits a command for requesting the change into the required value to the network equipment, if the application is decided.
Abstract translation: 提供一种网络管理系统及其方法，用于基于网络装置的价值来管理网络，从而使网络管理考虑到网络装置的特性。 一种基于价值的网络管理系统（10）包括：收集关于网络设备价值的信息的价值估计部分（101）; 存储从所述值估计部输出的所述网络设备的值的存储部（102） 策略判断部（103），其将目前估计的网络设备的值与从管理者发送的网络设备的所需值进行比较，判断是否应用网络设备的所需值; 以及策略执行部（104），如果应用被决定，则向网络设备发送用于请求改变为所需值的命令。
-
公开(公告)号：KR100474155B1
公开(公告)日：2005-03-08
申请号：KR1020020026405
申请日：2002-05-14
Applicant: 한국전자통신연구원
IPC: H04L12/22
Abstract: 본 발명은 지역적으로 분산된 네트워크 환경에서 취약성(Vulnerability)을 중앙 집중식으로 감사 및 분석할 수 있도록 한 취약성 분석 시스템 및 방법에 관한 것으로, 침입차단 시스템(Firewall)으로 보호된 네트워크에서도 내부망에 대한 취약성을 분석할 수 있다.
본 발명은 취약성 분석 대상 네트워크의 내부망에 대한 점검을 수행하는 에이전트와, 각 에이전트들로부터 결과를 제공받아 분석하고 DMZ(De-Militarized Zones)에 대한 취약성을 탐지하는 매니저, 그리고 매니저와 에이전트간의 통신을 위한 보안 프로토콜로 구성된다. 매니저는 에이전트가 보내온 각각의 정보를 분석하고 호스트별, 네트워크별 취약성 탐지결과에 대한 차등 분석을 수행하여 비교결과를 생성하는 기능을 가지며, 에이전트를 기반으로 하여 네트워크별로 취약성에 대한 정보를 전체적으로 관리하고, 매니저에 새로운 취약성을 탐지하기 위한 코드를 설치하면 자동으로 각 에이전트에 분배되므로 네트워크 전체에 대한 취약성 분석이 효율적으로 이루어질 수 있다.-
-
-
Patent Agency Ranking
公开(公告)号：KR101775518B1
公开(公告)日：2017-09-06
申请号：KR1020160021217
申请日：2016-02-23
Applicant: 한국전자통신연구원
CPC classification number: H04L63/101 , G06F17/30867 , G06F21/55 , H04L63/08 , H04L63/105 , H04L63/168
Abstract: 접근권한별로분리된브라우저프로세스를이용한브라우저제공방법및 이를이용한장치가개시된다. 제1 웹페이지에상응하는제1 주소를획득하는단계; 권한제어목록에서제1 주소를기반으로제1 단말접근권한을획득하고, 제1 단말접근권한에상응하는제1 브라우저프로세스를실행하는단계; 제1 브라우저프로세스가제2 웹페이지의렌더링을시도하는경우에, 제1 단말접근권한과제2 웹페이지에상응하는제2 단말접근권한을비교하여렌더링허용여부를판단하는단계; 및렌더링이허용되지않은경우에제1 브라우저프로세스의렌더링시도를차단하고, 제2 단말접근권한에상응하는제2 브라우저프로세스를실행하여제2 웹페이지를렌더링하는단계를포함한다.
Abstract translation: 公开了使用通过访问权限分离的浏览器处理的浏览器提供方法以及使用该方法的装置。 获取与第一网页对应的第一地址; 根据权限控制列表中的第一地址获取第一终端访问权限，并执行第一终端访问权限对应的第一浏览器进程; 当第一浏览器进程尝试呈现第二网页时，通过比较与第一终端访问权限分配2网页对应的第二终端访问权来确定是否允许呈现; 如果渲染不被允许，则阻止第一浏览器进程的渲染尝试，并且执行与第二终端访问权对应的第二浏览器进程以渲染第二网页。
-
公开(公告)号：KR101259910B1
公开(公告)日：2013-05-02
申请号：KR1020110119112
申请日：2011-11-15
Applicant: 한국전자통신연구원
CPC classification number: H04L63/1483
Abstract: PURPOSE: An apparatus for detecting a modulated URL by HTTP header analysis and a method thereof are provided to remove a threat connected to a malicious site without the consent of a user by checking whether a corresponding URL is modulated or not before connecting the URL which is possibly modulated on a webpage of a connected website. CONSTITUTION: An apparatus for detecting modulated URL includes a control unit(10), a URL information collecting unit(40), a URL HTTP header analyzing unit(50), and a URL modulation checking unit(60). The control unit controls the operation of each unit of the apparatus for detecting the modulated URL. The URL information collecting unit collects URL information linked with a webpage selected by a user on a connected website if the user terminal executes a web browser and connects to the website of which URL is inputted by a user. The URL HTTP header analyzing unit analyzes HTTP header information from collected URL information if the URL information is collected by the URL information collecting unit. The URL modulation checking unit determines a corresponding URL if retransmission information from the corresponding URL to different URL does not exist in a HTTP header as a result of the HTTP header information analysis of the URL HTTP header analyzing unit. [Reference numerals] (10) Control unit; (20) Input unit; (30) Output unit; (40) URL information collecting unit; (50) URL HTTP header analyzing unit; (60) URL modulation checking unit
Abstract translation: 目的：提供一种用于通过HTTP头部分析检测调制的URL的方法及其方法，用于通过在连接URL之前检查对应的URL是否被调制来消除连接到恶意站点的威胁，而不是由用户同意 可能调制在连接网站的网页上。 构成：用于检测调制URL的装置包括控制单元（10），URL信息收集单元（40），URL HTTP头分析单元（50）和URL调制检查单元（60）。 控制单元控制用于检测调制URL的设备的每个单元的操作。 如果用户终端执行网络浏览器并且连接到用户输入的URL的网站，则URL信息收集单元收集与连接的网站上的用户所选择的网页链接的URL信息。 如果URL信息由URL信息收集单元收集，则URL HTTP头分析单元从收集的URL信息中分析HTTP头信息。 作为URL HTTP头分析单元的HTTP头信息分析的结果，URL调制检查单元确定对应的URL，如果来自不同URL的对应URL的重传信息不存在于HTTP报头中。 （附图标记）（10）控制单元; （20）输入单元; （30）输出单元; （40）URL信息收集单元; （50）URL HTTP头分析单元; （60）URL调制检查单元
-
公开(公告)号：KR101151367B1
公开(公告)日：2012-08-07
申请号：KR1020110142652
申请日：2011-12-26
Applicant: 한국전자통신연구원
CPC classification number: G06Q20/405
Abstract: PURPOSE: An online financial transaction authentication method and apparatus thereof are provided to confirm the recognition state of a user randomly using a part of main transaction information as authentication information. CONSTITUTION: An authentication information generation unit(110) randomly selects a part of main transaction information corresponding to a user. The authentication information generation unit generates authentication information by combining the selected information. A display unit(140) provides the converted authentication information and the main transaction information to the user. A user recognition determination unit(160) determines whether the user recognizes the authentication information.
Abstract translation: 目的：提供一种在线金融交易认证方法及其装置，用于使用主交易信息的一部分随机地确认用户的识别状态作为认证信息。 构成：认证信息生成单元（110）随机选择与用户对应的主要交易信息的一部分。 认证信息生成单元通过组合所选择的信息来生成认证信息。 显示单元（140）向用户提供转换的认证信息和主交易信息。 用户识别确定单元（160）确定用户是否识别认证信息。
-
公开(公告)号：KR100879123B1
公开(公告)日：2009-01-19
申请号：KR1020070038384
申请日：2007-04-19
Applicant: 한국전자통신연구원
CPC classification number: G06F9/547
Abstract: 본 발명은 DCE(Distributed Computing Environment) RPC(Remote Procedure Call) 객체의 퍼징 시스템 및 방법에 관한 것으로서, 파일 매니저(File Manager)에서 DCE RPC 퍼징 및 통신시 필수적으로 요구되는 UUID(Universal Unique IDentifier), 인터페이스 버전(version), Op number를 idl 파일을 참조하여 획득하고, 획득한 정보들을 통신 메커니즘을 구성하는 패킷 크리에이터(Packet Creator)에서 사용하고 DCE RPC 접근 메커니즘을 완성하며, 이후 난수를 처리하는 랜덤 데이터 제너레이터(Random Data Generator)의 난수를 주입하고 패킷 인젝터(Packet Injector)에 구성된 데이터를 인자로 하여 함수를 호출하여 퍼징을 수행함으로써, 기존의 DCE RPC 객체 퍼징 시 전문가의 개입이 필요한 부분을 자동화하여 퍼징 시간 및 비용을 감소할 수 있다.
DCE(Distributed Computing Environment), RPC(Remote Procedure Call), 퍼징(fuzzing)-
公开(公告)号：KR1020080094230A
公开(公告)日：2008-10-23
申请号：KR1020070038384
申请日：2007-04-19
Applicant: 한국전자통신연구원
CPC classification number: G06F9/547
Abstract: A DCE RPC(Distributed Computing Environment Remote Procedure Call) object fuzzing system and method are provided to analyze an idl file to acquire necessary information in a DCE RPC object fuzzing operation and construct an RPC based access mechanism by using the information to reduce the cost and time required for system fuzzing. A DCE RPC object fuzzing system includes a file manager, a random data generator, an RPC packet creator, and a packet injector. The file manager parses and analyzes a file having information including an idl file and a named pipe file with respect to an object of fuzzing to acquire necessary information. The random data generator generates a random number by using a system clock signal as a factor. The RPC packet creator constructs a protocol used for RPC communication for each function and creates an RPC packet for RPC communication. The packet injector injects the necessary information and the random number into the generated RPC packet and transmits the RPC packet to the object of fuzzing.
Abstract translation: 提供DCE RPC（分布式计算环境远程过程调用）对象模糊系统和方法来分析idl文件以获取DCE RPC对象模糊操作中的必要信息，并通过使用该信息来降低成本并构建基于RPC的访问机制， 系统模糊所需的时间。 DCE RPC对象模糊系统包括文件管理器，随机数据生成器，RPC分组创建器和分组注入器。 文件管理器解析和分析具有关于模糊对象的idl文件和命名管道文件的信息的文件以获取必要的信息。 随机数据生成器通过使用系统时钟信号作为因子生成随机数。 RPC数据包创建者构建用于每个功能的RPC通信的协议，并为RPC通信创建一个RPC数据包。 分组注入器将必要的信息和随机数注入到生成的RPC分组中，并将RPC分组发送到模糊对象。
-
-
-
-
-
-
-
-
-
Search Results
37
records
(took 0.024 seconds)
