Abstract: A cache folder identification method and device, the method comprising: in the process of running target software, acquiring a plurality of sample values x1, x2, . . . xn of the number of files in the target folder according to a preset rule, the target folder being a folder used in the process of running the target software, n?2; according to a preset algorithm, calculating the statistical value of the plurality of sample values, the statistical value being used to represent the degree of dispersion of the sample values; determining whether the statistical value is greater than a preset first threshold; if so, identifying the target folder as a cache folder. The method has high identification efficiency, and can continuously monitor specific software without missing a cache folder.

Abstract: Disclosed is a method of detecting anomalies suspected of an attack based on time series statistics according to the present invention. The method of detecting anomalies suspected of an attack according to the present invention includes the steps of: collecting log data and traffic data in real-time and extracting at least one piece of preset traffic feature information from the collected log data and traffic data; and training through a time series analysis-based normal traffic training model using the extracted traffic feature information, and detecting abnormal network traffic according to a result of the training.

Abstract: Provided are a system and method for preventing the intrusion of an abnormal GPRS tunneling protocol (GTP) packet. The system includes: a system management unit including a monitoring unit which monitors a state of the system and a mode changing unit which changes an operation mode of the system based on the state of the system; a packet capture unit including a packet management unit which stores information about a GTP packet based on the operation mode of the system and a detection result checking unit which determines whether to drop the GTP packet; and a packet detection unit including a packet parsing unit which parses the information about the GTP packet and a packet analysis unit which analyzes the parsed information about the GTP packet, wherein the operation mode of the system is an intrusion prevention system (IPS) mode or a bypass mode.

Abstract: Hypervisor-based intrusion prevention platform is provided. The hypervisor-based intrusion prevention platform comprises a virtual network intrusion prevention system (vIPS) framework which obtains internal information of a virtualization system from a hypervisor and performs security control on the hypervisor in response to the result of intrusion detection carried out by using the internal information of the virtualization system, a hypervisor security application programming interface (API) module which provides an API used by the vIPS framework to access the hypervisor, an administrator account management and authentication module which manages an administrator account of a vIPS and authenticates the administrator account, an environment setting management module which manages environment setting values of modules within the vIPS, and an external interface module which provides an interface for system control and security control.

Abstract: The present invention relates to an application distribution system and method, and the application distribution system according to the present invention includes a developer terminal for requesting registration of an application; and an application trading server for registering and posting the application in an application store in response to the request of the developer terminal, in which if the application does not have an electronic signature, the application trading server performs security verification on the application based on preset application security verification criteria, generates an electronic signature for the application and transmits the electronic signature to the developer terminal, and if the application has an electronic signature, the application trading server performs security verification on the application by verifying the electronic signature.

Abstract: A detection system of a suspicious malicious website using the analysis of a JavaScript obfuscation strength, which includes: an entropy measuring processor of measuring an entropy of an obfuscated JavaScript present in the website, a special character entropy, and a variable/function name entropy; a frequency measuring processor of measuring a specific function frequency, an encoding mark frequency and a % symbol frequency of the JavaScript; a density measuring processor of measuring the maximum length of a single character string of the JavaScript; and a malicious website confirming processor of determining whether the relevant website is malicious by comparing an obfuscation strength value, measured by the entropy measuring processor, the frequency measuring processor and the density measuring processor, with a threshold value.

Abstract: Disclosed is a method of inspecting mass websites at a high speed, which visits and inspects the mass websites at a high speed and, at the same time, correctly detects unknown attacks, detection avoidance attacks and the like and extracts URLs related to vulnerability attacks. The method of inspecting mass websites at a high speed includes the steps of: simultaneously visiting, if a list of inspection target websites is received, a plurality of inspection target websites using multiple browsers; inspecting whether or not malicious code infection is attempted at the plurality of inspection target websites visited through the multiple browsers; extracting a malicious website where the attempt of malicious code infection is generated among the plurality of inspection target websites; and visiting the malicious website and tracing a malicious URL distributing a malicious code.

Abstract: An IP spoofing detection apparatus is provided. The IP spoofing detection apparatus comprising, a tunnel information extracting unit which extracts a first TEID and a user equipment IP address from a payload of a first GTP packet, and an abnormal packet detecting unit which extracts a second TEID from a header of a second GTP packet, and extracts a source IP address from a payload of the second GTP packet, wherein the abnormal packet detecting unit detects the second GTP packet as an IP spoofing packet if the first TEID and the second TEID are equal to each other, and the user equipment IP address and the source IP address are different from each other.

Abstract: A method, an apparatus and a mobile device estimate remaining time required to fully charge a battery. The method may include (a) determining from one or more of the mobile device's charging records the time required for charging the battery of the mobile device by one unit of charge (“unit charging time”); and (b) based on the time so determined, calculating the remaining time required for fully charging the mobile device's battery. In this manner, an accurate estimate of the remaining charging time is achieved. In one instance, the charging record includes the initial charge (A) in the battery, expressed as a percentage of the full capacity, the final charge (B) in the battery at the end of the charging, also expressed as a percentage of full capacity, and the total charging time required (T). Each unit of charge may be, for example, 1% of the full charge of the battery.

Abstract: A method and a system for preserving sensor data based on a time key, and a recording medium thereof are provided. The time key based sensor data security preserving method includes encrypting the sensor data with an encryption key obtained using a time key based polynomial derived using random numbers and a secret key which is shared by a sensor node and an application system; and decrypting the encrypted sensor data with a decryption key obtained by deriving the same polynomial as the time key based polynomial using the random numbers and the secret key. Thus, integrity and confidentiality of the sensor data can be preserved.

Abstract: A method for controlling audio sessions associated with a web browser and an audio endpoint device is implemented at a computer having memory and one or more processors. The computer system provides a unified audio session channel between the web browser and the audio endpoint device, the unified audio session channel including information of an audio session manager for the audio endpoint device and a set of audio sessions that are active on the audio endpoint device. Upon receiving a user instruction for controlling audio outputs of the web browser, the computer system selects one or more audio sessions between the web browser and the audio endpoint device among the set of audio sessions that are active on the audio endpoint device. The computer system then updates the audio sessions between the web browser and the audio endpoint device according to the user instruction.

Abstract: Disclosed herein is a PDF document type malicious code detection system for efficiently detecting a malicious code embedded in a document type and a method thereof. The present invention may perform a dynamic and static analysis on JavaScript within a PDF document, and execute the PDF document to perform a PDF dynamic analysis, thereby achieving an effect of efficiently extracting a malicious code embedded in the PDF document.

Abstract: Disclosed is a DDoS attack detection and response apparatus. The DDoS attack detection and response apparatus comprises: a receiver unit receiving HTTP requests from a client terminal which is characterized as an IP address; a data measuring unit computing the number of HTTP requests by IP and the number of URIs per HTTP over a certain time period; a DDoS discrimination unit comparing the number of HTTPs per URI with a threshold value and defining an access of the client terminal having the IP address as a DDoS attack when the number of HTTPs per URI is larger than the threshold value; and a blocking unit blocking packets from the IP address when the DDoS discrimination unit detects a DDoS attack.

Abstract: The present invention relates to a password input algorithm, more particularly to a password input system and method using alphanumeric matrices. An aspect of the invention can provide a password input system and method using alphanumeric matrices that can defend against keylogging attacks and shoulder surfing attacks by including a movable second alphanumeric matrix and a fixed first alphanumeric matrix and enabling a user to input a password by moving the password letters of the second alphanumeric matrix to the user-defined value of the first alphanumeric matrix. Another aspect of the invention can provide a password input system and method using alphanumeric matrices that can defend against shoulder surfing attacks by enabling a user to input a password by dividing the password by every two digits and moving the cross-points for the two digits, respectively, to the user-defined value of the first alphanumeric matrix.

Abstract: A statistical information generator for VoIP traffic analysis is provided, which comprises a packet collection module collecting packets from a network; and a statistical information generation module analyzing information of a call setup packet or a media packet among the packets collected by the packet collection module, and generating statistical information of the network; wherein if the packet collected by the packet collection module is the call setup packet, the statistical information generation module generates the statistical information of the network using at least one of transmitter identification information, receiver identification information, and call identification information among information of the call setup packet as a key value, while if the packet collected by the packet collection module is the media packet, the statistical information generation module generates the statistical information of the network using media session identification information among information of the media p

Abstract: An identification system 1 used for authenticating a user at a user station 30 requesting access to secure information at a base station 20, wherein the system 1 includes one or more base stations 20, one or more user stations 30, and one or more identification devices 10 used for authenticating the user of the user station 30. The identification device 10 is coupled to a user station 30. The device 10 includes a plurality of device codes and identity data, to receive an identification request from the base station 20, generate an identification response including an identification code using the plurality of device codes and a plurality of algorithms, and, transfer the identification response back to the base station 20. The base station 20 authenticates the user's request for secure information by using the identification response.

Abstract: A probe attached to a customer's network collects status data and other audit information from monitored components of the network, looking for footprints or evidence of unauthorized intrusions or attacks. The probe filters and analyzes the collected data to identify potentially security-related events happening on the network. Identified events are transmitted to a human analyst for problem resolution. The analyst has access to a variety of databases (including security intelligence databases containing information about known vulnerabilities of particular network products and characteristics of various hacker tools, and problem resolution databases containing information relevant to possible approaches or solutions) to aid in problem resolution. The analyst may follow a predetermined escalation procedure in the event he or she is unable to resolve the problem without assistance from others.

Abstract: A security management system can log, investigate, respond, and track computer security incidents that can occur in a networked computer system. In other words, the security management system can produce a security record of information related to the tracking of suspicious computer activity or actual computer security threats, such as denial of service attacks or other similar compromises to computers or computer networks. The security record can include, but is not limited to, date and times of computer security incidents, a name for a particular security incident, a security management system user, and a potential source of the computer security incident. The security record can be designed as a running log that saves or records all activity of a computer incident source as well as the activity of the security team responding to the computer incident source.

Abstract: Managing and controlling the execution of software programs with a computing device to protect the computing device from malicious activities. A protector system implements a two-step process to ensure that software programs do not perform malicious activities which may damage the computing device or other computing resources to which the device is coupled. In the first phase, the protector system determines whether a software program has been previously approved and validates that the software program has not been altered. If the software program is validated during the first phase, this will minimize or eliminate security monitoring operations while the software program is executing during the second phase. If the software program cannot be validated, the protector system enters the second phase and detects and observes executing activities at the kernel level of the operating system so that suspicious actions can be anticipated and addressed before they are able to do harm to the computing device.

Abstract: A system and method for preventing misuse conditions on a data network are described. Embodiments of the system and method evaluate potential network misuse signatures by analyzing variables such as the state of the network and/or target, the context in which the potential misuse signatures are detected, the response/reaction of the target and/or the fingerprint of the target. These and other variables may be factored in to the misuse determination, either alone, or in combination.