Abstract: Disclosed herein are an apparatus and method for providing sensor data in a sensor device based on a blockchain. A method for providing sensor data in a sensor device based on a blockchain may include creating a device record using encrypted device identification information, registering the device record in the blockchain, creating an event record using event information collected from a sensor, registering the header of the event record, including information about a link to the device record, in the blockchain, and distributing the body of the event record, the body being linked to the header of the event record.

Abstract: Disclosed are an apparatus and a method for Internet of Things (IoT) device security. The method includes unifying a port in a first IoT device for communication, receiving, by the first IoT device, a packet from a second IoT device through the port, identifying whether the packet in the first IoT device is in a preset packet form, verifying content of the packet in the first IoT device when the packet is in the preset packet form, and opening the port for providing a service in the first IoT device when the verifying of the packet content is successful.

Abstract: Provided are an apparatus and method for performing remote attestation by taking into account mobility. The method includes obtaining, by each node constituting a network, a remote attestation result value by performing self-remote attestation, obtaining, by each of the nodes, remote attestation result values from the other nodes by broadcasting the obtained remote attestation result value to at least one neighboring node, and monitoring, by each of the nodes, remote attestation of each of the nodes on the basis of the obtained remote attestation result values of the nodes.

Abstract: Disclosed herein are an apparatus for determining a device group to be isolated using similarity of features between devices and a method using the apparatus. The method includes generating device groups in consideration of respective features of all devices, generating a security threat device group based on devices in which a security threat has occurred, among all of the devices, calculating the cosine similarity between the security threat device group and all of the device groups, and determining at least one device group to be isolated, among all of the device groups, in consideration of the cosine similarity.

Abstract: Disclosed are an apparatus and a method for Internet of Things (IoT) device security. The method includes unifying a port in a first IoT device for communication, receiving, by the first IoT device, a packet from a second IoT device through the port, identifying whether the packet in the first IoT device is in a preset packet form, verifying content of the packet in the first IoT device when the packet is in the preset packet form, and opening the port for providing a service in the first IoT device when the verifying of the packet content is successful.

Abstract: Disclosed herein are an apparatus and method for managing remote attestation. The apparatus includes one or more processors and executable memory for storing at least one program executed by the one or more processors. The at least one program may request a gateway to verify the integrity of devices connected with the gateway, receive a verification result about whether the integrity of the devices is damaged from the gateway, identify a device, the integrity of which is damaged, using the verification result, perform detailed integrity verification on the device, the integrity of which is damaged, in order to identify an object, the integrity of which is damaged, and perform an operation for responding to the object, the integrity of which is damaged.

Abstract: Disclosed herein are a dynamic segmentation apparatus and method for preventing a spread of a security threat. The dynamic segmentation apparatus includes one or more processors and execution memory for storing at least one program executed by the processors, wherein the program is configured to register feature information of a first device, which is a target for which a security threat is to be managed, generate a first segment from the feature information of the first device, receive security threat information from an external system, extract feature information of a second device, in which a security threat has occurred, from the security threat information, perform clustering on the feature information of the second device using at least one clustering algorithm, generate at least one segment set by identifying segments from clustering results, and determine a security threat segment based on an inclusion relationship between segments in the segment set.

Abstract: Disclosed herein are an apparatus and method for providing sensor data in a sensor device based on a blockchain. A method for providing sensor data in a sensor device based on a blockchain may include creating a device record using encrypted device identification information, registering the device record in the blockchain, creating an event record using event information collected from a sensor, registering the header of the event record, including information about a link to the device record, in the blockchain, and distributing the body of the event record, the body being linked to the header of the event record.

Abstract: A communication method and an IoT device in a multi-MAC (Media Access Control)-operating environment. The communication method in the multi-MAC-operating environment, including synchronous MAC and asynchronous MAC, includes periodically transmitting, by the IoT device included in the multi-MAC-operating environment, a first message to a first device; determining, by the IoT device, whether to transmit a second message; transmitting, by the IoT device, a preamble packet to a second device, to which the second message is to be transmitted, when the second message is determined to be transmitted; and transmitting, by the IoT device, the second message to the second device.

Abstract: Provided is an apparatus and method for security control that is capable of preventing a security threat from spreading on the basis of a security control policy established for each device (or a device group) in a network infrastructure environment, such as IoT. In a network infrastructure including a service server, a gateway, and a device, the apparatus and method for security control, in response to detecting a security threat, such as distributed denial of service (DDoS) attacks, malicious code propagation, or the like, perform a security control and a security control release on a device in which the security threat has occurred and/or a device group having an identical or similar property to the device to prevent the security threat from spreading and block the security threat in an early stage.

Abstract: A method for security of an Internet of things (IoT) device includes transmitting, by a server, a key value determined based on a reliability level of a user device and a key identification (ID) of the key value to the user device, encrypting, by the user device, a command representing a service requested by a user by using the key value and transmitting the encrypted command and the key ID to the IoT device, and extracting, by the IoT device, the key value corresponding to the key ID received from the user device from pre-stored key list information, decrypting the encrypted command by using the extracted key value, executing the decrypted command to generate information requested by the user, encrypting the generated information by using the extracted key value, and transmitting the encrypted information to the user device.

Abstract: A communication method and an IoT device in a multi-MAC (Media Access Control)-operating environment. The communication method in the multi-MAC-operating environment, including synchronous MAC and asynchronous MAC, includes periodically transmitting, by the IoT device included in the multi-MAC-operating environment, a first message to a first device; determining, by the IoT device, whether to transmit a second message; transmitting, by the IoT device, a preamble packet to a second device, to which the second message is to be transmitted, when the second message is determined to be transmitted; and transmitting, by the IoT device, the second message to the second device.

Abstract: Disclosed herein are a one-way data transmission apparatus, a one-way data reception apparatus, and a one-way data transmission/reception method using the apparatuses. The one-way data transmission/reception method uses a one-way data transmission apparatus and a one-way data reception apparatus, and includes receiving data from a high-security zone through a one-way path, generating tag information of the data, sending a message in which the tag information is added to the data to the one-way data reception apparatus, receiving the message from the one-way data transmission apparatus, checking the tag information of the message, and transmitting the data to a low-security zone.

Abstract: Disclosed herein are a one-way data transmission apparatus, a one-way data reception apparatus, and a one-way data transmission/reception method using the apparatuses. The one-way data transmission/reception method uses a one-way data transmission apparatus and a one-way data reception apparatus, and includes receiving data from a high-security zone through a one-way path, generating tag information of the data, sending a message in which the tag information is added to the data to the one-way data reception apparatus, receiving the message from the one-way data transmission apparatus, checking the tag information of the message, and transmitting the data to a low-security zone.

Abstract: An apparatus and method of displaying a network security situation is provided. The apparatus includes an extraction unit configured to classify a characteristic factor including IP addresses of a transmission node and a reception node from a traffic flow, a network visualization unit configured to generate a domain circle visualizing each of a transmission domain and a reception domain as a circle shape by mapping the IP addresses of the transmission node and the reception node to points on circumference as one to one, arrange the generated domain circle on an axis, and visualize each of a transmission network area and a reception network area as a sphere shape, a session construction unit configured to a session of the visualized transmission network area and reception network visually, and a display unit configured to display the session which is visually constructed.

Abstract: An abnormal traffic detection apparatus and method based on Modbus communication pattern learning is provided. The abnormal traffic detection apparatus based on the Modbus communication pattern learning previously detects and responds to abnormal traffic on a Modbus/TCP protocol. According to the present invention, a communication service between control systems can be stably provided by previously detecting the abnormal traffic capable of interfering with a stable operation of the control system. Particularly, since the effective abnormal traffic on the Modbus/TCP protocol can be previously detected, security of the control system can be increased by rapid detection and response with respect to security threats on the Intranet of the control system, and availability can be secured.

Abstract: Provided is a packet monitoring method for a communication packet transmitted and received between a server and a control device including receiving the communication packet transmitted and received between the server and the control device; determining whether the received communication packet is abnormal, based on a history table including control information on communication packets received before the received communication packet and control information on the received communication packet; and performing a security operation according to results of the determination.

Abstract: A method for detecting an abnormal traffic on a control system protocol, includes: checking whether session information exists in a management table; adding a new entry to the management table; checking whether a transaction ID in a table entry is the same as that of the received MODBUS request message; and checking whether data and length thereof of the received MODBUS request message are the same as those in the table entry. Further, the method includes detecting an abnormal traffic; and updating the table entry with packet information of the MODBUS request message.