Search

Efforts to cope jointly with the ever-increasing number of breach incidents have resulted in the establishment of the standard format and protocol and given birth to many consultative groups. In addition, various channels that distribute Cyber Threat Intelligence information free of charge have emerged, and studies on utilizing such channels have spread. As the market for sharing information professionally is expanding, the need to manage the shared information in various ways in order to achieve better result has arisen. This paper proposes a standardized management structure and method based on the standardized format and a meaning and standard of Cyber Threat Intelligence that can be shared outside when loading OSINT information collected from various channels into the graph database. This paper also proposes a method of supporting the detection provided by existing security equipment with the information saved in the graph database and an effective method of analysis. Lastly, the paper discusses the advantages that can be expected from saving cyber threat information in the graph database developed using information collected from the outside.

Nowadays, the number of cyber threats is increasing continuously, and attack techniques are becoming increasingly advanced and intelligent. One important thing that should be noted with regard to this situation is the marked increase in similar cyber incidents which use the same IP, domain, and malicious code for one cyberattack. Therefore, it is essential to understand the correlation between cyberattacks that occur due to the re-use of the same attack infrastructure (IP, domain, malicious code, etc.) for different cyberattacks, in order to detect and respond promptly to similar cyberattacks. To understand the correlation between cyberattacks, it is necessary to collect the related data concerning the procedures and techniques of cyberattacks. This paper proposes the design details of the cyber threat information collection system according to such needs. The proposed system performs the function of collecting the attack infrastructure data (IoCs) exploited for the cyberattack from various open data sources (OSINT, Open Source INTelligence), and uses the collected data as an input value to collect more data recursively. The relationship of the collected data can also be collected, saved, and managed, so that the data can be used to analyze the collection of cyberattacks. The proposed system uses a virtualization structure and distributed processing technology to collect data stably from various collection channels.

As a large quantity of new and varied attacks occur in Korea, it is difficult to analyze and respond to them with limited security experts and existing equipment. This paper proposes a method of analyzing the threat of Indicator of Compromise (IoC) used for cyber incidents and calculating it as a quantitative value in order to check the analysis priority of cyber incidents that occur in large quantities. Using this method, a large quantity of cyber incidents can be efficiently responded to by checking the quantification of cyber threat objectively to quickly determine the response level of the cyber incident and actively analyze cyber incidents with high threat levels.

This paper proposes an automated cyberattack analysis platform that is designed to analyze and respond to cyberattacks, which are becoming ever more intelligent and advanced. The ICT information generated during previous cyberattacks will be collected to analyze cyberattacks automatically, and the relationship between the collected information, level of re-exploitation, and similar ICT information among cyberattacks will be automatically analyzed. If the values that are currently being monitored are entered into the developed platform, the most similar cyberattacks in the past and the current phase of attacks will be provided to the analyst. In addition, a system capable of blocking attacks in advance before damages are caused could be developed by providing response/analysis guideline information on the potential future attack inflow.

The purpose of the recent cyber-incidents and violations are social chaos and political purposes beyond a simple behavior such as personal show of and try to achieve the financial objectives. But analyses of the single cyber incident, because they cannot organically establish a connection with each cyber incident, have limits to find relations with other attacks and predict a possible next attack based on similar types of incidents. This paper will suggest a way to index the cyber-threat data to find relations with each cyber-attacks. For getting related information with each cyber-attack data, we suggest the system of collecting and managing cyber-threat resource.

Currently, we are faced with a major problem concerning the use of malicious codes in hacking attacks, which is becoming increasingly intelligent. We became curious about the major factors behind the cyber incident, which prompted us to conduct research about the weighted value of resources that are used to commit malicious acts. The major approach of this paper consists in calculating the weighted value based on the total amount of information collected from various channels. The weighted value based on the PageRank algorithm is the outcome of complex arithmetic operations about correlations among resources. This study proposes a methodology for calculating a malicious citation index using Googles' PageRank algorithm, such as replacing PageRank's link with a correlation.

Due to the rapid development of the IT industry, the threat of cyber-attacks has been increasing gradually and more intelligent. These days, the same attack groups carry out cyber-attack continuously by using their resources that are necessary to the attack. To respond more effectively to cyber terrors occurred by same the attack groups with the same purpose, we need to detect the same attack groups by comparing similarity of attack-resources. In this paper, we propose the prediction of the same group by comparing similarity of distributed domain (that is one of attack resources).

In this study, an engine on/off and engine operation control algorithm to improve the fuel economy was proposed for a PHEV(plug-in hybrid electric vehicle) considering driver tendency. To identify the driver tendency, a driver model was developed using VIDE(virtual integrated development environment). The target vehicle model was developed based on MATLAB/Simulink and validation of the vehicle model was performed by experiments. Using the VIDE, real drivers who have different tendency drive the PHEV in virtual environment and driving data were accumulated. Using the driving data, the driver model which can reflect the driver tendency was developed. To describe the driver tendency, degree of driver aggression(DDA) was proposed, which was determined by fuzzy logic. The DDA was applied to the PHEV control algorithm to improve the fuel economy. This algorithm controls the engine on/off and engine operation, which provides the improved fuel economy.

An android is a robot which resembles human especially appearance and behavior. This robot is usually used for an emcee, a desk clerk, a teacher and so on. Its motion should be accurate and correspond to what it tells because a little difference of motion may bring misunderstanding. Comparing a humanoid, an android should resemble human more strictly because not-quite-high quality of mimicry leads peoplepsilas hatred.