Abstract: Collecting the topology and asset information of the virtual generated computer network, converting the topology and asset information into a training data set for training the neural network model, training the neural network model based on the training data set, and training A method and apparatus for predicting an attack vulnerability of a computer network through the step of inferring an attack vulnerability of a target computer network using a neural network model are provided.

Abstract: Disclosed herein are an apparatus and method for device authentication. The method for device authentication based on a certificate using a PUF, performed by an apparatus for device authentication based on a certificate using a PUF, includes acquiring previously stored first Challenge-Response-Pair (CRP) information corresponding to identification information received from a device that requests authentication and generating a certificate including a public key generated using the first CRP information; transmitting a message in which the certificate encrypted using the first response value of the first CRP information as a server secret key and the first challenge value of the first CRP information are included to the device; and authenticating the device by verifying an encrypted signature message received from the device through a secure channel.

Abstract: Disclosed herein are a server apparatus, a client apparatus, and a method for communication based on network address mutation. The method for communication based on network address mutation, performed by the server apparatus and the client apparatus, includes setting the external address of a network interface for receiving a packet from the client apparatus; setting the internal address of a hidden interface in order to forward the packet received through the network interface to the hidden interface; modifying the external address based on a preset network address mutation rule; and communicating with the client apparatus by forwarding the packet, received from the client apparatus based on the modified external address, to the hidden interface.

Abstract: Disclosed is a method of generating secret information on the basis of a ring oscillator. According to an embodiment of the present disclosure, there is provided an apparatus for generating secret information on the basis of a ring oscillator, the apparatus including: multiple PUF information generation units each including at least one ring oscillator cell and generating physically unclonable function (PUF) information generated by the at least one ring oscillator cell; a phase checking unit cross-checking phases for the multiple pieces of the PUF information that are output from the multiple PUF information generation units, respectively; and a secret key generation unit outputting secret key information based on a result of comparing the multiple phases received from the phase checking unit.

Abstract: Disclosed herein are an apparatus and method for detecting a malicious script. The apparatus includes one or more processors and executable memory for storing at least one program executed by the one or more processors. The at least one program is configured to extract token-type features, each of which corresponds to a lexical unit, and tree-node-type features of an abstract syntax tree from an input script, to train two learning models to respectively learn two pieces of learning data that are generated in consideration of features extracted respectively from the token-type features and the node-type features as having the highest frequency, and to detect whether the script is a malicious script based on the result of ensemble-based malicious script detection performed for the script, which is acquired using an ensemble detection model generated from the two learning models.

Abstract: An electronic device includes a peripheral device, a processor, an interrupt controller configured to manage interrupts generated by the peripheral device and the processor on the basis of a register, and a virtualizer, wherein the virtualizer may be configured to virtualize a portion of the processor and a portion of the at least one peripheral device to generate a first partition, generate first interrupt information corresponding to an interrupt usable in the first partition, generate first processor information corresponding to a portion of the processor usable in the first partition, check whether a configuration of the register is related to at least one of the first interrupt information and the first processor information when the register is configured by the first partition, and allow the configuration of the register when the configuration of the register is related to the at least one information.

Abstract: Disclosed herein is a method of operating a data management apparatus. The method may include segmenting, by a client device, data into multiple data blocks, generating, by the client device, tags corresponding to the multiple data blocks, generating, by the client device, a representative value by accumulating the tags, generating, by the client device, a client signature value by signing the representative value and a counter value corresponding to the last updated data block, among the multiple data blocks, and transmitting, by the client device, the data and the client signature value to a server.

Abstract: Disclosed herein are an apparatus and method for authenticating an IoT device. The method, performed by the IoT device authentication apparatus, includes transmitting, by the IoT device authentication apparatus, a random number to the IoT device and encrypting, by the IoT device authentication apparatus, the random number using a previously registered first white-box cryptography value through a white-box cryptography method; generating, by the IoT device, a first device response value from a previously registered first device challenge value using a Physical Unclonable Function (PUF) and encrypting, by the IoT device, the random number, received from the IoT device authentication apparatus, using the first device response value; and performing, by the IoT device authentication apparatus, authentication of the IoT device by checking whether the random number encrypted using the white-box cryptography method matches the random number encrypted using the PUF, which is received from the IoT device.

Abstract: In the present invention, by providing an apparatus for securing data comprising a memory for storing information for data processing, a processor configured to partition original data into a plurality of partial data and generate a plurality of divided data by randomly determining positions of each of the plurality of partial data within the original data, and a communication interface configured to transmit each of the plurality of divided data to each of a plurality of servers, respectively, if an attacker obtains a portion of the divided data, it prevents the entire original data from being restored, and the legitimate user can restore the original data accurately even if some divided data is corrupted, and provides an efficient data polymorphic dividing technique that can minimize the amount of calculation required to secure data.

Abstract: Disclosed herein is a method of operating an authentication server based on a Physical Unclonable Function (PUF), which includes transmitting a Challenge-Response Pair (CRP) update request message to a user device when a CRP update event occurs, receiving a CRP update response message from the user device in response to the CRP update request message, generating a secret key corresponding to the CRP update request message, decrypting the CRP update response message with the secret key, and updating a CRP corresponding to the secret key in a database using the decrypted CRP update response message.

Abstract: Disclosed herein are a stepping-stone detection apparatus and method. The stepping-stone detection apparatus includes a target connection information reception unit for receiving information about a target connection from an intrusion detection system (IDS), a fingerprint generation unit for generating a target connection fingerprint based on the information about the target connection, and generating one or more candidate connection fingerprints using information about one or more candidate connections corresponding to one or more flow information collectors, and a stepping-stone detection unit for detecting a stepping stone by comparing the target connection fingerprint, in which a maximum allowable delay time is reflected, with the candidate connection fingerprints.

Abstract: A method for secure distributed data management for dynamic data includes segmenting original data into multiple pieces, generating state information pertaining to row-based data configured with data blocks, and generating additional information for recovering the state information and the row-based data. The data blocks, corresponding to the segmented data, are stored in data servers, and each of the data servers stores data blocks selected at an interval corresponding to the number of data servers in order to store the segmented data.

Abstract: Disclosed herein is an apparatus for enhancing network security, which includes an information collection unit for collecting information about states of hosts that form a network and information about connectivity in the network; an attack surface analysis unit for analyzing attack surfaces by creating an attack graph using the information about the states and the information about connectivity; a security-enhancing strategy establishment unit for establishing a security-enhancing strategy based on the attack graph; and a security-enhancing strategy implementation unit for delivering a measure based on the security-enhancing strategy to a corresponding host, thereby taking a security-enhancing measure.

Abstract: A secret information generation apparatus and a method for operating the secret information generation apparatus. The secret information generation apparatus includes a resistor-capacitor circuit, and a microcontroller unit including a first pin connected to an input terminal of the resistor-capacitor circuit and a second pin connected to an output terminal of the resistor-capacitor circuit, wherein the microcontroller unit is configured to transmit a digital value corresponding to a challenge to the resistor-capacitor circuit through the first pin, receive an output value of the resistor-capacitor circuit corresponding to the digital value through the second pin, convert the received value into a digital value using an analog-to-digital converter, extract one or more valid bits from the converted digital value, and then generate a response.

Abstract: Disclosed herein are an apparatus and method for detecting a Distributed Reflection Denial of Service (DRDoS) attack. The DRDoS attack detection apparatus includes a network flow data reception unit for receiving network flow data from network equipment, a session type determination unit for determining a session type of the received network flow data, a host type determination unit for determining a type of host corresponding to the network flow data based on the session type, an attack method determination unit for determining an attack method corresponding to the network flow data, a protocol identification unit for identifying a protocol of the network flow data, and an attack detection unit for detecting a DRDoS attack based on the session type, the host type, the attack method, and the protocol.

Abstract: Disclosed herein are an apparatus and method for generating secret information. The apparatus includes a data communication unit for receiving a request to output a content value and outputting the content value; and a microcontroller unit for generating a Physically Unclonable Function (PUF) response based on the content value, calculating the characteristic value of the PUF response, and generating secret information using the PUF response, the error of which is corrected using the characteristic value.

Abstract: Disclosed is a method of generating secret information on the basis of a ring oscillator. According to an embodiment of the present disclosure, there is provided an apparatus for generating secret information on the basis of a ring oscillator, the apparatus including: multiple PUF information generation units each including at least one ring oscillator cell and generating physically unclonable function (PUF) information generated by the at least one ring oscillator cell; a phase checking unit cross-checking phases for the multiple pieces of the PUF information that are output from the multiple PUF information generation units, respectively; and a secret key generation unit outputting secret key information based on a result of comparing the multiple phases received from the phase checking unit.

Abstract: Disclosed herein are a decoy apparatus and a method for expanding a fake attack surface using a deception network. The method includes determining, by a protected server, whether a packet is a target to be processed when the packet is received; converting, by the protected server, the packet and transmitting, by the protected server, the converted packet to the decoy apparatus of the deception network when the packet is determined not to be such a target; receiving, by the protected server, a response packet from a decoy virtual machine included in the decoy apparatus as a reply to the converted packet; and modifying, by the protected server, the response packet and transmitting, by the protected server, the modified response packet to the source from which the packet was transmitted, in order to expand the fake attack surface.

Abstract: Disclosed are a method and apparatus for searching for an attack path. The apparatus generates an attack graph, generates an attack graph ontology, generates a semantic attack graph by imparting semantics to the attack graph on the basis of the attack graph ontology, and searches for the attack path on the basis of the semantic attack graph.

Abstract: Disclosed herein are a server apparatus, a client apparatus, and a method for communication based on network address mutation. The method for communication based on network address mutation, performed by the server apparatus and the client apparatus, includes setting the external address of a network interface for receiving a packet from the client apparatus; setting the internal address of a hidden interface in order to forward the packet received through the network interface to the hidden interface; modifying the external address based on a preset network address mutation rule; and communicating with the client apparatus by forwarding the packet, received from the client apparatus based on the modified external address, to the hidden interface.