-
公开(公告)号：KR101737914B1
公开(公告)日：2017-05-19
申请号：KR1020140067734
申请日：2014-06-03
Applicant: 한국전자통신연구원
CPC classification number: H04L63/1408
Abstract: 네트워크보안상황표시장치및 그방법을개시한다. 네트워크보안상황표시장치로서, 트래픽플로우로부터송신노드와수신노드의 IP 주소를포함하는특성인자를추출하는추출부, 송신노드와수신노드의 IP 주소를원주위의점에일대일로매핑하여, 송신도메인과수신도메인을각각원의형태로시각화하는도메인원을생성하고, 상기생성된도메인원을축을중심으로배치하여, 송신네트워크영역과수신네트워크영역을각각구의형태로시각화하는네트워크구를생성하는네트워크영역시각화부, 시각화된송신네트워크영역과수신네트워크영역의세션을시각적으로구성하는세션구성부; 및시각적으로구성된세션을표시하는표시부를포함한다.
-
公开(公告)号：KR1020150021282A
公开(公告)日：2015-03-02
申请号：KR1020130098443
申请日：2013-08-20
Applicant: 한국전자통신연구원
CPC classification number: H04L63/1416 , G06F17/16 , H04L41/00 , H04L43/00 , H04L63/1466 , H04L67/12
Abstract: 본 발명은 제어 네트워크에서의 스캐닝 공격 탐지 장치에 관한 것으로, 제어 네트워크 또는 시스템에서 발생하는 NSM(Network and Security Management) 이벤트를 수집하여 벡터 공간으로 구성하는 벡터공간 생성 모듈; 및 상기 벡터공간 생성 모듈에 의해 구성된 벡터간 거리를 기반으로 군집화하고 군집의 구성 요소들 간의 연관성을 분석하여 이상징후를 탐지하는 연관성 분석 모듈을 포함하여 구성된다.
Abstract translation: 本发明涉及一种控制网络中的扫描攻击检测装置。 扫描攻击检测装置包括：向量空间产生模块收集网络和在控制网络中生成的安全管理事件或组成向量空间的系统; 以及相关分析模块，用于基于由向量空间生成模块所包括的向量之间的距离进行分组，并分析组合的组成元素之间的相关性以检测异常事件。
-
公开(公告)号：KR1020140147583A
公开(公告)日：2014-12-30
申请号：KR1020130071138
申请日：2013-06-20
Applicant: 한국전자통신연구원
IPC: H04L29/06 , H04L29/08 , H04L29/10 , H04L12/813
CPC classification number: H04L63/0227 , H04L67/12 , H04L12/16 , H04L12/18 , H04L12/22 , H04L29/10 , H04L47/20
Abstract: Disclosed are an apparatus for preventing an unauthorized access to an industrial control system and a method thereof. The apparatus for preventing an unauthorized access to an industrial control system according to the present invention comprises a first interface transmitting and receiving packets by interworking with a management network group requesting a control command; a second interface transmitting and receiving packets by interworking with a control network group receiving a control command from the management network group and processing the received control command; and a control unit determining whether a rule has been set for at least one filter when a packet is introduced from the management network group or the control network group, and controlling a packet flow between the management network group and the control network group by using a corresponding filter with the preset rule according to the determination result.
Abstract translation: 公开了一种用于防止未经授权的访问工业控制系统的装置及其方法。 根据本发明的用于防止对工业控制系统的未经授权的访问的装置包括：通过与请求控制命令的管理网络组交互来发送和接收分组的第一接口; 第二接口，通过与从所述管理网络组接收到控制命令的控制网络组进行交互操作来发送和接收分组，并处理所接收的控制命令; 以及控制单元，当从所述管理网络组或所述控制网络组引入分组时，确定是否为至少一个过滤器设置了规则，并且通过使用所述管理网络组和所述控制网络组来控制所述管理网络组与所述控制网络组之间的分组流 根据确定结果，使用预设规则对应的过滤器。
-
公开(公告)号：KR1020140118494A
公开(公告)日：2014-10-08
申请号：KR1020130034526
申请日：2013-03-29
Applicant: 한국전자통신연구원
CPC classification number: H04L63/1416
Abstract: The present invention provides an apparatus for detecting anomaly in a control system in order to protect the control system against various cyber attacks that cause the malfunction of equipment in a system and a network required for control and operation of industrial facilities. The provided apparatus includes an information collection unit for collecting system information, network information, security event information, or transaction information in conjunction with control equipment, network equipment, security equipment, or server equipment in the control system; a storage unit for storing the information which is collected by the information collection unit; and an anomaly detecting unit for detecting occurrence of abnormality in the control system by executing a relevant analysis between the predetermined security policy and the collected information.
Abstract translation: 本发明提供了一种用于检测控制系统中的异常的装置，以便保护控制系统免受各种网络攻击，导致系统中的设备故障和工业设施的控制和操作所需的网络。 所提供的装置包括与控制系统中的控制设备，网络设备，安全设备或服务器设备一起收集系统信息，网络信息，安全事件信息或交易信息的信息收集单元; 存储单元，用于存储由所述信息收集单元收集的信息; 以及异常检测单元，通过执行预定安全策略和收集的信息之间的相关分析来检测控制系统中的异常发生。
-
公开(公告)号：KR100979200B1
公开(公告)日：2010-08-31
申请号：KR1020080074726
申请日：2008-07-30
Applicant: 한국전자통신연구원
CPC classification number: H04L63/1416 , H04L63/1441
Abstract: 본 발명은 보안정보, 및 네트워크 구성정보를 GIS(Grographic Information System) 기반의 지리정보와 매핑하여 표시함으로써 정확한 위치에 네트워크 정보를 표현 가능하며, 네트워크 관리자가 별도의 작업을 통해 지도상에 네트워크 장치, 및 상황을 표시할 필요가 없도록 하는 GIS 기반의 네트워크 정보 표시장치에 관한 것이다. 이를 위해 본 발명은, 외부 네트워크 장치로부터 네트워크 정보를 수신하며, GIS 기반의 지리정보를 구비하고, 위치정보에 응답하여 위치정보에 해당하는 지리정보를 생성하는 지리정보 처리모듈, 및 위치정보에 대응되는 지리정보에 네트워크 정보를 매핑하여 표현하며, 보안 문제를 유발하는 패킷의 공격 위치, 경유지, 및 목표위치를 라인으로 연결하고, 패킷의 공격 유형과 위험 수준에 따라 라인의 폭과 색상을 미리 정해진 폭과 색상으로 가변하여 네트워크 정보를 직관적으로 표현하는 네트워크 정보 처리모듈을 포함한다.
GIS, 네트워크 정보, 보안 이벤트, 트래픽, 지리정보-
Patent Agency Ranking
公开(公告)号：KR1020090113745A
公开(公告)日：2009-11-02
申请号：KR1020080100299
申请日：2008-10-13
Applicant: 한국전자통신연구원
Abstract: PURPOSE: A network attack location searching method and system using a spy-bot agent is provided to detect and trace the attacker over wide place by obtaining the packet information of the packet which accesses the each host from a remote place. CONSTITUTION: A back tracking server(300) detects one or more dangerous host through host scanning. A spy-bot management server(200) transmits the spy-bot agents(100) to the detected dangerous host. The spy-bot management server obtains packet information of the packet which accesses the each dangerous host through spy-bot agents. The back tracking server references the obtained packet information and reversely traces the starting point of the hacking code.
Abstract translation: 目的：提供使用间谍机构代理的网络攻击位置搜索方法和系统，通过从远程地点获取每个主机访问的数据包的数据包信息，在广泛的位置检测和跟踪攻击者。 构成：后跟踪服务器（300）通过主机扫描来检测一个或多个危险的主机。 间谍机器人管理服务器（200）将间谍机构代理（100）发送到检测到的危险主机。 间谍机器人管理服务器通过间谍机构代理获取访问每个危险主机的数据包的数据包信息。 后跟踪服务器引用获取的数据包信息，并反向跟踪黑客代码的起点。
-
公开(公告)号：KR100856924B1
公开(公告)日：2008-09-05
申请号：KR1020070022971
申请日：2007-03-08
Applicant: 한국전자통신연구원
IPC: H04L12/26
CPC classification number: H04L41/22 , H04L43/045 , H04L63/1408
Abstract: An apparatus and a method for displaying a network state are provided to determine an abnormal state which deteriorates the performance of a network by using information about distinct dispersion, entropy, and clustering as a result of a combination of important properties in a traffic event, and detect a harmful traffic or an abnormal traffic. A method for displaying a network state comprises the following steps of: grouping traffics according to a protocol(S100); selecting and combining three of a resource address, a resource port, a destination address, and a destination port, and calculating distinct dispersion and entropy for a remaining element(S200); displaying the calculated distinct dispersion and entropy on a security radar that an angle of a circle is divided into N and a radius of the circle is divided into M(S300); and detecting the abnormality of a network by referring to a displayed radar state and detecting and reporting a harmful traffic or an abnormal traffic which causes an abnormal state(S400).
Abstract translation: 提供一种用于显示网络状态的装置和方法，用于通过使用关于交通事件中的重要属性的组合的结果，通过使用关于不同色散，熵和聚类的信息来确定恶化网络性能的异常状态，以及 检测到有害的流量或异常流量。 一种用于显示网络状态的方法包括以下步骤：根据协议对流量进行分组（S100）; 选择和组合资源地址，资源端口，目的地地址和目的地端口中的三个，并为剩余元素计算不同的色散和熵（S200）; 在安全雷达上显示计算出的不同色散和熵，将圆的角度分为N和圆的半径分为M（S300）; 以及通过参照所显示的雷达状态来检测和检测网络的异常，并检测并报告导致异常状态的有害通信或异常业务（S400）。
-
公开(公告)号：KR100786392B1
公开(公告)日：2007-12-17
申请号：KR1020060096570
申请日：2006-09-29
Applicant: 한국전자통신연구원
CPC classification number: G06F17/30283 , G06F17/30401 , G06F17/30539 , G06Q50/26
Abstract: A method for deciding a policy enforcement target of a policy client in a policy-based management framework is provided to rightly and efficiently decide an applicable object resource in case of executing a policy provided from a policy server. A method for deciding a policy enforcement target of a policy client in a policy-based management framework includes the following steps: a step that the policy client confirms capability set of policy information base received from policy serer(101); a step to confirm role-combination of the policy information base received from a policy server(103); a step to search resource satisfying the confirmed capability set and role-combination(105,106); and a step to apply and execute policy received on the searched resource(107).
Abstract translation: 提供了一种用于在基于策略的管理框架中决定策略客户端的策略执行目标的方法，以在执行从策略服务器提供的策略的情况下正确有效地确定适用的对象资源。 一种用于在基于策略的管理框架中决定策略客户端的策略执行目标的方法包括以下步骤：策略客户端确认从策略策略器（101）接收的策略信息库的功能集合的步骤; 确认从策略服务器（103）接收的策略信息库的角色组合的步骤; 搜索满足确认能力集和角色组合的资源的一个步骤（105,106）; 以及在搜索到的资源（107）上应用和执行收到的策略的步骤。
-
公开(公告)号：KR1020030056651A
公开(公告)日：2003-07-04
申请号：KR1020010086925
申请日：2001-12-28
Applicant: 한국전자통신연구원
IPC: H04L12/851
CPC classification number: H04L47/2441 , H04L69/22
Abstract: PURPOSE: A mixed active network model and a packet processing method in an active network model are provided to classify packets into an 'Aflow' packet, a 'non-Aflow' packet, and a 'sigAflow' packet according to the continuity of a packet delivery cycle, so as to actively load resources necessary for performing active packets on an active node. CONSTITUTION: If an optional packet is received to a packet classifier(S200), the packet classifier decides whether a protocol field of a header of the packet is set as active(S202). If not, the packet classifier regards the received packet as a general IP(Internet Protocol) packet(S204), and if set as active, the packet classifier regards the received packet as an active packet(S206). The active packet is provided to a flow classifier(S208). The flow classifier decides whether the packet matches with a demux key field(S210). If so, the flow classifier classifies the packet as an 'Aflow' packet(S212). If the packet does not match with the demux key field, a performance environment block detects a type field of the active packet header(S214). If a detected type value is '0'(S216), the performance environment block classifies the packet as a 'sigAflow' packet(S218). And if the detected type value is '2'(S220), the performance environment block classifies the packet as a 'non-Aflow' packet(S222).
Abstract translation: 目的：提供一种主动网络模型中的混合有源网络模型和分组处理方法，以根据分组的连续性将分组分类为“Aflow”分组，“非Aflow”分组和“sigAflow”分组 交付周期，以便主动加载在主动节点上执行活动分组所需的资源。 构成：如果对分组分类器接收到可选分组（S200），则分组分类器决定分组报头的协议字段是否被设置为活动（S202）。 如果不是，则分组分类器将接收到的分组视为通用IP（因特网协议）分组（S204），如果设置为活动，则分组分类器将接收到的分组视为活动分组（S206）。 将活动分组提供给流分类器（S208）。 流分类器决定分组是否与解码密钥字段匹配（S210）。 如果是，则流分类器将分组分类为“Aflow”分组（S212）。 如果分组与解密密钥字段不匹配，则性能环境块检测活动分组报头的类型字段（S214）。 如果检测到的类型值为“0”（S216），则性能环境块将该分组分类为“sigAflow”分组（S218）。 如果检测到的类型值为“2”（S220），则性能环境块将该分组分类为“非Aflow”分组（S222）。
-
公开(公告)号：KR101889502B1
公开(公告)日：2018-08-20
申请号：KR1020130032212
申请日：2013-03-26
Applicant: 한국전자통신연구원
CPC classification number: G05B15/02 , H04L63/0263 , H04L63/1408 , H04L63/1425 , H04L63/1441 , H04L63/20 , H04L2012/40228
Abstract: 본발명은제어시스템프로토콜상의비정상트래픽탐지방법에관한것이다. 개시된비정상트래픽탐지방법은수신된패킷이 MODBUS 요청메시지이면세션정보가관리테이블에존재하는지검사하는단계와, 관리테이블에세션정보가존재하지않으면새로운엔트리를관리테이블에추가하는단계와, 관리테이블에세션정보가존재하면해당테이블엔트리내의트랜잭션 ID가수신된 MODBUS 요청메시지의트랜잭션 ID와동일한지여부를검사하는단계와, 테이블엔트리와 MODBUS 요청메시지의트랜잭션 ID가동일하지않으면수신된 MODBUS 요청메시지의데이터와테이블엔트리내의데이터가동일한지를검사하는단계와, 테이블엔트리와 MODBUS 요청메시지의트랜잭션 ID가동일하거나데이터가동일하면비정상트래픽으로탐지하는단계와, 테이블엔트리와 MODBUS 요청메시지의데이터가동일하지않으면테이블엔트리를 MODBUS 요청메시지의패킷정보로갱신하는단계를포함한다. 따라서, 제어시스템프로토콜상의정상적인서비스연결을방해하거나오류를유발할수 있는형태의비정상트래픽을조기에탐지하고대응할수 있도록하여제어시스템간의안정적인연결서비스를제공하며, 이는공격자에의한의도적인행위뿐만아니라, 시스템및 네트워크오류로인한비정상트래픽에대해서도신속하게탐지, 대응할수 있도록한다.
-
-
-
-
-
-
-
-
-
Search Results
82
records
(took 0.028 seconds)
