-
公开(公告)号：KR1020120066466A
公开(公告)日：2012-06-22
申请号：KR1020100127821
申请日：2010-12-14
Applicant: 한국전자통신연구원
IPC: H04L12/22
CPC classification number: G06F21/55 , H04L63/1458
Abstract: PURPOSE: A DoS(Denial-of-Service) attack prevention method is provided to secure network service to a normal user by preventing only malicious user's operation about various types of ICMP(Internet Control Message Protocol) flooding. CONSTITUTION: A server detects suspicious packet among a plurality of received packets using protocol information of received plural packets, fragmentation property information, and fragmentation location information(S311). The server determines whether the suspicious packet is an attack packet or not using the payload which is included in the detected suspicious packet(S312). The server determines the suspicious packet as the attack packet(S313).
Abstract translation: 目的：通过防止恶意用户对各种类型的ICMP（Internet Control Message Protocol）泛滥的操作，提供DoS（拒绝服务）攻击防范方法来保护网络服务到普通用户。 规定：服务器使用接收到的多个分组的协议信息，分段属性信息和分段位置信息来检测多个接收到的分组中的可疑分组（S311）。 服务器使用检测到的可疑包中包含的有效载荷来确定可疑包是否是攻击包（S312）。 服务器将可疑包确定为攻击包（S313）。
-
公开(公告)号：KR1020110037645A
公开(公告)日：2011-04-13
申请号：KR1020090095173
申请日：2009-10-07
Applicant: 한국전자통신연구원
CPC classification number: H04L63/1458 , G06F21/56 , H04L63/1416
Abstract: PURPOSE: A distributed service denying protecting device and method thereof are provided to reinforcing security of a network and a server system by helping a performance of a abnormal packet detecting function. CONSTITUTION: A session table(232) stores session information for coping with an invasion detection. A flow table(231) stores traffic measurement information by flow. A packet extracting unit(210) extracts packet from an inflow traffic. A detecting unit(220) extracts a field for a session tracking and traffic measurement from the packet. The detecting unit detects an abnormal packet through one between extracted field and the session table. A corresponding unit(240) secludes the abnormal packet.
Abstract translation: 目的：通过帮助执行异常分组检测功能，提供了一种分布式服务拒绝保护设备及其方法，以加强网络和服务器系统的安全性。 构成：会话表（232）存储用于应对入侵检测的会话信息。 流表（231）通过流量存储流量测量信息。 分组提取单元（210）从流入业务中提取分组。 检测单元（220）从分组中提取用于会话跟踪和业务测量的字段。 检测单元通过提取字段和会话表之间的一个检测异常分组。 对应的单元（240）隐藏异常分组。
-
公开(公告)号：KR1020100066170A
公开(公告)日：2010-06-17
申请号：KR1020080124848
申请日：2008-12-09
Applicant: 한국전자통신연구원
CPC classification number: H04L63/1458 , H04L43/16 , H04L63/1416
Abstract: PURPOSE: A method and a device for preventing denial service through session state tracking are provided to trace a session stat in a real time, thereby rapidly detecting generation of DoS/DDos attack. CONSTITUTION: An attach detection engine(20) traces the state of the session according to the packet transmission between a client and a server. If the number of sessions of a particular state exceeds a preset critical value, the attack detection engine determines the DoS(Denial-of-Service)/DDoS(Distributed Denial-of-service) attack. If the DoS/DDoS attack is detected, a correspondence engine(30) determines the drop of a packet according to the presence of the session corresponding with the new packet of client. The correspondence engine deals with the DoS/DDoS attack by the determination of the packet drop.
Abstract translation: 目的：提供一种通过会话状态跟踪来防止拒绝服务的方法和设备，用于实时跟踪会话统计信息，从而快速检测DoS / DDos攻击的产生。 构成：附件检测引擎（20）根据客户端和服务器之间的数据包传输跟踪会话的状态。 如果特定状态的会话数超过预设的临界值，则攻击检测引擎确定DoS（拒绝服务）/ DDoS（分布式拒绝服务）攻击。 如果检测到DoS / DDoS攻击，则通信引擎（30）根据与客户端的新分组对应的会话的存在来确定分组的丢弃。 通信引擎通过确定数据包丢失来处理DoS / DDoS攻击。
-
公开(公告)号：KR1020090066142A
公开(公告)日：2009-06-23
申请号：KR1020070133772
申请日：2007-12-18
Applicant: 한국전자통신연구원
CPC classification number: H04L63/1416 , G06F21/566
Abstract: A polymorphic shell code detection method is provided to reduce operation overhead without missing corresponding instruction by performing a reverse assemble for detecting the instruction searching an address of the encoded code. An execution code address is stored in a register table(S100). In case the register item in which the executable code address is stored is used as the input of an instruction, the instruction defining rest register item is detected(S400). An emulation is performed from the instruction storing the executable code address in a stack or instructions defining rest register items from the first instruction. If the emulation result is stored in the memory, the input data is determined as a polymorphic shell code(S500).
Abstract translation: 提供多态shell代码检测方法以减少操作开销而不丢失对应指令，通过执行用于检测编码代码的地址的指令的反向组合。 执行代码地址存储在寄存器表中（S100）。 在存储可执行代码地址的寄存器项目被用作指令的输入的情况下，检测定义休止寄存器项目的指令（S400）。 从存储堆栈中的可执行代码地址的指令或从第一指令定义休眠寄存器项的指令执行仿真。 如果仿真结果存储在存储器中，则输入数据被确定为多态shell代码（S500）。
-
公开(公告)号：KR100734864B1
公开(公告)日：2007-07-03
申请号：KR1020050120990
申请日：2005-12-09
Applicant: 한국전자통신연구원
IPC: H04L12/22
CPC classification number: H04L12/5602
Abstract: 본 발명은 패턴 매칭 정책 저장 방법 및 경보 제어 방법에 관한 것으로, (a) 패턴 매칭 장치에 새롭게 적용하고자 하는 정책인 저장본 트래픽의 헤더 구조체에 상기 헤더 구조체와 매칭되는 콘텐츠 구조체를 생성하는 단계; (b) 상기 저장본 트래픽의 콘텐츠가 상기 패턴 매칭 장치에 기 저장된 원본 트래픽의 콘텐츠와 동일한지 판단하는 단계; (c) 상기 (b)단계에서 동일한 콘텐츠라고 판단되는 경우에, 상기 저장본 트래픽의 콘텐츠에 상기 원본 트래픽의 콘텐츠와 동일한 콘텐츠 인덱스를 부여하는 단계; 및 (d) 상기 원본 트래픽의 헤더 구조체에 속한 콘텐츠 구조체 개수가 1개인지 판단하고, 1개라고 판단되는 경우에 상기 저장본 트래픽의 헤더 인덱스를 상기 원본 트래픽의 헤더 인덱스로 부여하는 단계로 구성되어, 한정된 하드웨어 메모리를 효율적으로 사용하고 빠르고 효율적인 패턴 매칭 기능을 수행할 수 있다.
-
Patent Agency Ranking
公开(公告)号：KR100490729B1
公开(公告)日：2005-05-24
申请号：KR1020030031992
申请日：2003-05-20
Applicant: 한국전자통신연구원
IPC: H04L12/22
CPC classification number: H04L63/1408
Abstract: 본 발명에 따른 기가급 침입 탐지 기능을 갖는 보안 게이트웨이 시스템은 네트워크 망에서 송수신되는 네트워크 패킷을 수집하고, 보안 게이트웨이 시스템의 하드웨어 영역에서 수집된 패킷의 헤더 부분과 침입 패턴간의 매칭 여부를 판단한 다음 커널 영역에서 헤더 부분이 매칭된 패킷의 데이터 부분과 침입 패턴간의 매칭되는지의 여부를 판단하여 침입을 탐지한다.
-
公开(公告)号：KR1020040099864A
公开(公告)日：2004-12-02
申请号：KR1020030031992
申请日：2003-05-20
Applicant: 한국전자통신연구원
IPC: H04L12/22
CPC classification number: H04L63/1408
Abstract: PURPOSE: A security gateway system and an intrusion detection method using the same are provided to enhance detection efficiency and system stability by effectively and quickly detecting intrusion in a wide area network. CONSTITUTION: A header pattern table(252) of an intrusion pattern table(250) has intrusion header pattern information formed based on header information of each protocol of a packet. A data pattern table(254) of the intrusion pattern table(250) has intrusion data pattern information formed based on a data part except for the intrusion header pattern information. A hardware intrusion detection performing unit(240) collects network packets transmitted/received in a network and determines whether a header part of the collected packet and the intrusion header pattern information are matched. A kernel intrusion detection performing unit(230) detects an intrusion by determining whether a data part of a packet having a header part matched to the intrusion header pattern information and the intrusion data pattern information are matched.
Abstract translation: 目的：提供安全网关系统和使用该安全网关的入侵检测方法，通过有效，快速地检测广域网中的入侵来提高检测效率和系统稳定性。 构成：入侵模式表（250）的报头模式表（252）具有基于分组的每个协议的报头信息形成的入侵报头模式信息。 入侵模式表（250）的数据模式表（254）具有基于除了入侵标题模式信息之外的数据部分形成的入侵数据模式信息。 硬件入侵检测执行单元（240）收集在网络中发送/接收的网络分组，并且确定所收集的分组的报头部分和入侵报头模式信息是否匹配。 内核入侵检测执行单元（230）通过确定具有与入侵头模式信息和入侵数据模式信息匹配的头部部分的分组的数据部分是否匹配来检测入侵。
-
-
-
-
-
-
-
Search Results
77
records
(took 0.025 seconds)
