Abstract: Disclosed herein is an Intrusion Detection System (IDS) false positive detection apparatus and method. An IDS false positive detection apparatus includes a payload extraction unit for extracting payloads by dividing each packet corresponding to an IDS detection rule into a header and a payload. A false positive payload information generation unit generates false positive payload information required to identify a false positive payload by extracting a payload of a false positive packet based on results of packet analysis received from a manager. A false positive payload determination unit transmits results of a determination of whether each payload extracted by the payload extraction unit corresponds to a false positive payload, based on the false positive payload information, to the manager.

Abstract: An apparatus and method for detecting forgery/falsification of a homepage. The apparatus includes a homepage image shot generation module for generating homepage image shots of an entire screen of an accessed homepage. A character string extraction module extracts character strings from each homepage image shot using an OCR technique. A character string comparison module compares each of the extracted character strings with character strings required for determination of homepage forgery/falsification, thus determining whether the extracted character string is a normal character string or a falsified character string. A homepage falsification determination module determines whether the corresponding homepage has been forged/falsified, based on results of the comparison. A character string learning module learns the character string extracted from the homepage image shot, based on results of the determination, and classifies the character string as the normal character string or the falsified character string.

Abstract: An apparatus and method for automatically detecting a malicious link. The apparatus includes a threat information collection unit, a priority management unit, a malicious link collection unit, a malicious link analysis unit, and a malicious link tracking unit. The threat information collection unit collects threat information, and identifies whether a malicious link is present in each target site. The priority management unit determines the priorities of the target sites, and performs the assignment and management of the target sites in order to collect and analyze a malicious link. The malicious link collection unit collects the uniform resource locator (URL) of the malicious link from the target sites. The malicious link analysis unit analyzes a call correlation based on the collected URL, and analyzes the malicious link through pattern matching. The malicious link tracking unit tracks the real-time changing state of the malicious link.

Abstract: Disclosed herein is an Intrusion Detection System (IDS) false positive detection apparatus and method. An IDS false positive detection apparatus includes a payload extraction unit for extracting payloads by dividing each packet corresponding to an IDS detection rule into a header and a payload. A false positive payload information generation unit generates false positive payload information required to identify a false positive payload by extracting a payload of a false positive packet based on results of packet analysis received from a manager. A false positive payload determination unit transmits results of a determination of whether each payload extracted by the payload extraction unit corresponds to a false positive payload, based on the false positive payload information, to the manager.

Abstract: An apparatus and method for detecting forgery/falsification of a homepage. The apparatus includes a homepage image shot generation module for generating homepage image shots of an entire screen of an accessed homepage. A character string extraction module extracts character strings from each homepage image shot using an OCR technique. A character string comparison module compares each of the extracted character strings with character strings required for determination of homepage forgery/falsification, thus determining whether the extracted character string is a normal character string or a falsified character string. A homepage falsification determination module determines whether the corresponding homepage has been forged/falsified, based on results of the comparison. A character string learning module learns the character string extracted from the homepage image shot, based on results of the determination, and classifies the character string as the normal character string or the falsified character string.

Abstract: A terminal discriminating apparatus and a terminal discriminating method using the same are provided. The terminal discriminating apparatus includes: a measurement unit for measuring a pull-up voltage and a pull-down voltage of each of candidate terminals to be discriminated; a discriminating unit for comparing the pull-up voltages, pull-down voltages, and the differences between the pull-up voltages and pull-down voltages for the candidate terminals to discriminate the types of the candidate terminals; and an output unit for outputting results of the discrimination of the candidate terminals transferred from the discriminating unit. The types of the candidate terminals can be discriminated by comparing the pull-up voltage, the pull-down voltage, and the differences between the pull-up voltages and the pull-down voltages for the candidate terminals.

Abstract: A device and method for extracting data stored in a volatile memory are provided. In particular, a memory-data extracting device and method for ensuring integrity of data extracted from a volatile memory installed in a computer are provided. A memory-data extracting module extracts data stored in a memory. A module loader loads the memory-data extracting module in a kernel region of the memory and sets a priority of the loaded memory-data extracting module to be higher than priorities of kernel processors loaded in the memory. Task switching can be prevented in the course of extracting memory data by loading a process for extracting memory data in a kernel region and setting a priority of the loaded process to be higher than priorities of other kernel processes, thereby ensuring the integrity of data extracted from a non-volatile memory.

Abstract: A terminal discriminating apparatus and a terminal discriminating method using the same are provided. The terminal discriminating apparatus includes: a measurement unit for measuring a pull-up voltage and a pull-down voltage of each of candidate terminals to be discriminated; a discriminating unit for comparing the pull-up voltages, pull-down voltages, and the differences between the pull-up voltages and pull-down voltages for the candidate terminals to discriminate the types of the candidate terminals; and an output unit for outputting results of the discrimination of the candidate terminals transferred from the discriminating unit. The types of the candidate terminals can be discriminated by comparing the pull-up voltage, the pull-down voltage, and the differences between the pull-up voltages and the pull-down voltages for the candidate terminals.

Abstract: A device and method for extracting data stored in a volatile memory are provided. In particular, a memory-data extracting device and method for ensuring integrity of data extracted from a volatile memory installed in a computer are provided. A memory-data extracting module extracts data stored in a memory. A module loader loads the memory-data extracting module in a kernel region of the memory and sets a priority of the loaded memory-data extracting module to be higher than priorities of kernel processors loaded in the memory. Task switching can be prevented in the course of extracting memory data by loading a process for extracting memory data in a kernel region and setting a priority of the loaded process to be higher than priorities of other kernel processes, thereby ensuring the integrity of data extracted from a non-volatile memory.