Abstract: An abnormal behavior detection system includes a context information reception unit receiving a variety of types of context information from a context information collection system, a context information processing unit generating a corresponding detection request message when context information about web service use is received and transfer the corresponding detection request message to an abnormal detection unit, an abnormal detection unit comparing sequence of a use page and use speed, performed right after user access, with a pattern in the past access through an analysis of an initial use behavior pattern when the detection request message is received and to detect an abnormal use behavior, a profile management unit profiling pieces of context information according to various use behaviors of the user and store and manage the pieces of profiled context information, and an information analysis unit analyzing web site or DB use information.

Abstract: An abnormal behavior detection system includes a context information reception unit receiving a variety of types of context information from a context information collection system, a context information processing unit generating a corresponding detection request message when context information about “termination or access termination” is received and transfer the corresponding detection request message to an abnormal detection unit, the abnormal detection unit detecting an abnormal use behavior by analyze frequency of behaviors in an identical access situation which have occurred during an entire access period through an analysis of a use behavior pattern during the entire access period, a profile management unit profiling pieces of context information according to various use behaviors of the user and store and manage the pieces of profiled context information, and an information analysis unit analyzing web site or DB use information based on the pieces of received context information.

Abstract: Disclosed is a behavior detection system for detecting an abnormal behavior, can perform dynamic control based on situation information and a profile of each user to cope with an element threatening security of an internal infrastructure of an enterprise, such as information leakage, in BYOD and smart work environment. The system calculates probabilities of behaviors occurring for respective connection behavior elements, calculates standard deviations of the probabilities based on weighting factors and determines whether or not the calculated behavior occurrence probabilities and behavior standard deviation correspond to a normal behavior, existence of an abnormal connection behavior in a BYOD and smart work environment is detected and an abnormal user is detected by examining whether or not an average traffic volume, an average use time and traffic volume with respect to a use time exceeds respective standard values.

Abstract: Provided are a system and method for preventing the intrusion of an abnormal GPRS tunneling protocol (GTP) packet. The system includes: a system management unit including a monitoring unit which monitors a state of the system and a mode changing unit which changes an operation mode of the system based on the state of the system; a packet capture unit including a packet management unit which stores information about a GTP packet based on the operation mode of the system and a detection result checking unit which determines whether to drop the GTP packet; and a packet detection unit including a packet parsing unit which parses the information about the GTP packet and a packet analysis unit which analyzes the parsed information about the GTP packet, wherein the operation mode of the system is an intrusion prevention system (IPS) mode or a bypass mode.

Abstract: An IP spoofing detection apparatus is provided. The IP spoofing detection apparatus comprising, a tunnel information extracting unit which extracts a first TEID and a user equipment IP address from a payload of a first GTP packet, and an abnormal packet detecting unit which extracts a second TEID from a header of a second GTP packet, and extracts a source IP address from a payload of the second GTP packet, wherein the abnormal packet detecting unit detects the second GTP packet as an IP spoofing packet if the first TEID and the second TEID are equal to each other, and the user equipment IP address and the source IP address are different from each other.

Abstract: Provided are a system and method for preventing the intrusion of an abnormal GPRS tunneling protocol (GTP) packet. The system includes: a system management unit including a monitoring unit which monitors a state of the system and a mode changing unit which changes an operation mode of the system based on the state of the system; a packet capture unit including a packet management unit which stores information about a GTP packet based on the operation mode of the system and a detection result checking unit which determines whether to drop the GTP packet; and a packet detection unit including a packet parsing unit which parses the information about the GTP packet and a packet analysis unit which analyzes the parsed information about the GTP packet, wherein the operation mode of the system is an intrusion prevention system (IPS) mode or a bypass mode.

Abstract: An automatic management system includes a malicious code group-mutant storage module that receives a malicious codes analysis result from a malicious code collection-analysis system and extracts group information and mutant information of the malicious codes based on the malicious code analysis result, a malicious code group-mutant DB that stores the extracted group information and mutant information, a malicious code group-mutant management module that provides interface to allow a user to detect the group information and mutant information stored in the malicious code group-mutant DB, and a visualizing module that outputs the detection result to the user, wherein the malicious code group-mutant management module that groups malicious codes having action associations using the group information and mutant information stored in the malicious code group-mutant DB, outputs the group information through the visualizing module and outputs the mutant information based on CFG similarity and string similarity throug

Abstract: Provided is seed information collecting device for detecting malicious code landing/hopping/distribution sites. The device comprises: a seed information collecting module collecting social issue keywords from a seed information collecting channel and collecting address information of potential malicious code landing/hopping/distribution sites using the collected social issue keywords; a web source code collecting module collecting web source code of the potential malicious code landing/hopping/distribution sites using the address information of the potential malicious code landing/hopping/distribution sites collected by the seed information collecting module; and a policy management module managing collection policies of the seed information collecting module and the web source code collecting module.

Abstract: In a malware auto-analysis method using a kernel callback mechanism, a function, present in a kernel driver within a PsSetCreateProcessNotifyRoutine function, is registered by a process monitor driver as a callback function when a computer boot. A function present in a registry monitor driver is registered by the registry monitor driver as a callback function in a CmRegisterCallback function when the driver is loaded. A kernel driver is registered by a file monitor driver as a mini-filter driver in a Filter Manager present in a Windows system. At least one of a process event, a registry event, or an Input/Output (I/O) event is received by a behavior event collector from the process monitor driver, the registry monitor driver, or the file monitor driver, respectively.

Abstract: The present invention relates to a malicious traffic isolation system and method using botnet information, and more particularly, to a malicious traffic isolation system and method using botnet information, in which traffics for a set of clients having the same destination are routed to the isolation system based on a destination IP/Port, and botnet traffics are isolated using botnet information based on similarity among groups of the routed and flowed in traffics. The present invention may provide a malicious traffic isolation method using botnet information, which can accommodate traffics received from a PC or a C&C server infected with a bot into a quarantine area, isolate traffics generated by normal users from traffics transmitted from malicious bots, and block the malicious traffics. In addition, the present invention may provide a malicious traffic isolation method using botnet information, which can provide a function of mitigating DDoS attacks of a botnet.

Abstract: A system for analyzing malicious botnet activity in real time is disclosed. This system may include: a control server configured to generate botnet activity information relating to a type of malicious botnet activity, and transmit the botnet activity information to the outside, after receiving bot occurrence information from the outside; and a bot executing server configured to execute a malicious bot corresponding to the bot occurrence information received from the outside in a virtual environment operating system and transmit a real-time botnet detection result to the control server for generating the botnet activity information, according to a control of the control server, wherein the real-time botnet detection result includes information on whether or not the malicious bot performs malicious activity based on a command from a remote command/control server existing independently outside.

Abstract: The invention relates to a system and method that can detect botnets by classifying the communication activities for each client according to destination or based on similarity between the groups of collected traffic. According to certain aspects of the invention, the communication activities for each client can be classified to model network activity by differentiating the protocols of the collected network traffic based on destination and patterning the subgroups for the respective protocols. Those servers that are estimated to be C&C servers can be classified into download and upload, spam servers and command control servers, within a botnet group detected by modeling network activity, i.e. analyzing network-based activity patterns. Also, botnet groups can be detected by way of a group information management function, for generating an activity pattern-based group matrix based on group data, and a mutual similarity analysis, performed on groups suspected to be botnets from the group information.

Abstract: There is provided a system and method for detecting unknown malicious code by analyzing kernel based system actions. More particularly, the system and method provides an advantage of actively countering unknown malicious code or viruses by monitoring kernel based system events in real time, organizing action data based on the collected event data, determining whether the action data corresponds to predetermined malicious actions, backtracking a subject of a malicious action when the action data is determined to correspond to the malicious action, and processing the malicious action.

Abstract: The present invention relates to a security system of managing IRC and HTTP botnets and a method therefor. More specifically, the present invention relates to a system and a method that detects a botnet in an Internet service provider network to store information related to the detected botnet in a database and performs security management of IRC and HTTP botnets, including a botnet management security management (BMSM) system, configured to visualize the information related to the detected botnet and establish an against policy related to the detected botnet.

Abstract: Disclosed are a user agent providing secure VoIP communication and a secure communication method using the same. A user agent of the invention has an additional module for providing a secure function as well as a module for providing general communication, thereby supporting the secure communication. In addition, as a secure communication method using the user agent, a signaling security mechanism negotiation method and a media encryption algorithm negotiation method are provided. Hence, it is possible to provide internet telephone users with a secure VoIP communication service.

Abstract: Disclosed is a device for dropping an attack multimedia packet. An object of the invention is to provide a device, a system and a method for dropping an attack multimedia packet, capable of filtering RTP packets received to selectively drop an attack multimedia packet, thereby providing a stable multimedia service. According to the invention, the received RTP packet is filtered to selectively drop an attack multimedia packet, so that it is possible to provide a stable multimedia service.

Abstract: Disclosed is a security system of a call signaling message. An object of the invention is to provide a security system and a securing method of a call signaling message, in which even when a call signaling message is leaked out and thus modified in a SIP (Session Initiation Protocol) based VoIP (Voice Over Internet Protocol) service, the modified message is blocked in advance to enable the VoIP service to be provided without an attack effect by the packets. When using the security system and the securing method of a call signaling message according to an embodiment of the invention, it is possible to prevent, in the SIP based VoIP service, a call signaling message from being modified to cause a call failure when requesting a call or during the call, and to block an attack on the call signaling message in advance.