Abstract: An apparatus and method for visualizing a network condition related to a network security are provided. The apparatus includes a traffic feature extracting unit, a network condition displaying unit, and a traffic abnormal condition determining unit. The traffic feature extracting unit extracts information including source address, source port, destination address, and destination port from network traffics, selects two of the extracted information, and calculates unique dispersion degrees of two unselected information. The network condition displaying unit displays a two-dimensional cube expressed using the calculated unique dispersion degrees for the classified traffics. The traffic abnormal condition determining unit determines whether the traffics are in an abnormal condition or not based on the two-dimensional security cube.

Abstract: Provided are an apparatus and method for detecting illegal motion picture data. The apparatus includes a key frame extractor for extracting a plurality of key frames from motion picture data, a characteristic value file generator for detecting characteristic values of the extracted key frames and generating a characteristic value file, and an illegality determiner for measuring degree of similarity between a previously stored learning model file and the characteristic value file and determining whether or not the motion picture data is legal according to the degree of similarity.

Abstract: Disclosed is a GIS based network information monitoring system that intuitively combines GIS based geographic information with traffic information and a security event, expresses the combined geographic information on a display, and does not need position calibration of network information when the traffic information and the security event are expressed.

Abstract: Provided are a web-based traceback system and method using reverse caching proxy, which can effectively protect a web server against various attacks launched by illegitimate user by acquiring network information and location information of users who attempt to access the web server through an anonymous server, without a requirement of installing any agent program in the users' clients.

Abstract: An apparatus for filtering malicious multimedia data using sequential processing and a method thereof are provided. The apparatus includes: a maliciousness classification model training unit extracting a predetermined feature from at least one or more types of moving pictures and then, through machine training, generating a maliciousness determination model for each of at least one or more classes; a malicious data classification unit sequentially inputting input moving pictures for which maliciousness is required to be determined, to the maliciousness determination model, and determining the maliciousness class of the input moving pictures, based on a probability that data at a determination time of the input moving pictures belongs to a predetermined maliciousness class, and an accumulated maliciousness probability to a current time; and a malicious information filtering unit cutting off service if the maliciousness class belongs to a predetermined reference maliciousness class.

Abstract: An apparatus and a method for blocking access to a phishing web page are provided. The apparatus includes a media collection unit collecting media having a function of connecting to a web page, a management unit managing phishing information comprising at least one of location information on phishing web pages, location information on web pages targeted for phishing, and features of the phishing web pages, a phishing determination unit determining whether a collected medium is connected to a phishing web page and a phishing blocking unit blocking a link connecting to the phishing web page by editing the medium determined to connect to the phishing web page by the phishing determination unit. According to the present invention, damage caused by phishing can be prevented, even when a web page or an e-mail provided by a web site or an e-mail server includes a link connecting to a phishing web page.

Abstract: An apparatus and method for blocking harmful multimedia contents in a personal computer using intelligent screen monitoring are provided. The apparatus includes a screen capture determination unit determining a screen capture time based on the status of a personal computer; an active screen capture unit capturing a screen displaying an active program at the screen capture time; an image harmfulness determination unit determining the harmfulness of the captured screen; and a harmful program blocking unit blocking the program displayed on the captured screen, if the screen is determined to be harmful. The method and apparatus can be used to block access to harmful multimedia contents in real time using a screen capture method in which a screen of the personal computer is captured intelligently, harmfulness of the captured screen is determined, and a corresponding program using the captured screen is blocked.