Abstract:
An apparatus for analyzing weakness of a wireless LAN is disclosed. According to the present invention, the apparatus for analyzing weakness of a wireless LAN comprises: a collecting unit for collecting a packet which transmits and receives from a wireless LAN service, an analyzing unit for analyzing the state of a network by using the collected packet, and an attack unit for executing wireless attacks against an object to be attacked by utilizing the state of the network and for controlling to change a mode of a device driver according to an operating mode.
Abstract:
The present invention relates to a wireless device classifying apparatus for preventing wireless intrusion. The disclosed wireless device classifying apparatus includes an information collecting unit which collects information about a wireless device from an authentication server and a wireless terminal management server, an information storage unit which stores the collected information about the wireless device, and an information analyzing unit which analyzes the information about the wireless device based on a classification policy stored in a classification storage unit and classifies the wireless device according to an analysis result. Therefore, a wireless intrusion preventing service is efficiently performed by minutely classifying the wireless device.
Abstract:
The present invention detects attacks and unauthorized invasions from external or internal sources in a wireless LAN environment. The present invention can cooperate with an AP and invasion detection sensor in the wireless LAN environment to detect various types of invasions more swiftly which are generated in a wireless LAN based network such an unauthorized AP or service denial attack and to enable an AP to transmit a copy of critical message information to a threat management server, thereby increasing the intrusion detection performance.
Abstract:
PURPOSE: An agent device for sharing security information based an anonymous identifier among security management domains and a method thereof are provided to share security information based on an identifier based on hash, thereby preventing leakage of personal information included in the security information. CONSTITUTION: An identifier conversion unit(220) converts a real name identifier included in security information into an anonymous identifier and converts security information based on the real name identifier into security information based on the anonymous identifier. A security information communication unit(240) transmits the security information based on the anonymous identifier to the outside of a security management domain in order that security management domains share the security information. The identifier conversion unit converts the real name identifier included in the security information into a hash identifier which is the anonymous identifier by using a one-way hash function. [Reference numerals] (210) Security information providing unit; (220) Identifier conversion unit; (230) Identifier mapping information storage unit; (242) Security information transmitting unit; (244) Security analyzing information receiving unit; (250) Security analyzing information processing unit; (312) Security information receiving unit; (314) Security analyzing information transmitting unit; (320) Identifier reference storage unit; (330) Security information analyzing unit; (340) Reception agent device determination unit; (AA) Anonymous based security information; (BB) Anonymous based security information analyzing result
Abstract:
PURPOSE: An apparatus and a method for quantitative security policy evaluation are provided to quantitatively evaluate a security polity on a heterogeneous network through a quantitative evaluation model. CONSTITUTION: A security policy analyzing unit(102) analyzes a security policy of a network. An estimation reference defining unit(104) defines an evaluation standard. An estimation result calculating unit(106) calculates an evaluation result of each security component. A weight calculating unit(108) groups the security components according to a security function. A quantitative estimating unit(110) estimates a security polity of each group.
Abstract:
PURPOSE: A system and a method for controlling alert traffic in a network are provided to enable a central management system to effectively manage alert traffic while effectively transmitting main alert information in close cooperation with lower security systems which transmit the alert traffic. CONSTITUTION: Plural lower security systems(200) control an amount of alert information to be transmitted, based on an alert information transmission control policy, determine alert priorities, and transmit the alert information in the order of the highest importance. A central management system(100) receives the transmitted alert information while periodically monitoring an amount of alert traffic transmitted from the lower security systems(200), and sends the alert information transmission control policy which considers a processing capacity and availability of the lower security systems(200) to the lower security systems(200).
Abstract:
An alert transmission apparatus for a policy-based intrusion detection and response has a central policy server (CPS) and an intrusion detection and response system (IDRS). In the CPS, a policy management tool generates security policy information and then stores the generated security policy information in a policy repository. A COPS-IDR server sends the information to the IDRS and an IDMEF-XML-type alert transmission message to a high-level module. An IDMEF-XML message parsing and translation module stores a parsed and translated IDMEF-XML-type alert transmission message in an alert DB or provides the message to an alert viewer. In the IDRS, a COPS-IDR client generates the IDMEF-XML-type alert transmission message and provides the message to the CPS. An intrusion detection module detects an intrusion. An intrusion response module responds to the intrusion. An IDMEF-XML message building module generates an IDMEF-XML alert message and provides the message to the COPS-IDR client.