Abstract: An operating method of a computing device operated by at least one processor includes collecting traffic packets; extracting particular field data from the traffic packets, transforming the extracted particular field data to a vector with a reduced dimension for each traffic packet, and creating training data with the vector for each traffic packet; training a traffic prediction model with the training data, the traffic prediction model predicting from an input traffic packet a next input traffic packet and whether the next input traffic packet is abnormal; and predicting with the trained traffic prediction model a frequency of abnormal traffic packets to be input, and outputting an abnormal traffic warning by comparing the predicted frequency and a threshold.

Abstract: The present application relates to a method and apparatus for digital forensic corresponding to an IoT (Internet of Things) terminal, the method including: performing, by an electronic device, an analysis of an Internet of Things (IoT) terminal to which digital forensics is to be performed; selecting an injection method of injecting, by the electronic device, a certificate into the IoT terminal; injecting, by the electronic device, a certificate into at least one of the IoT terminal, the electronic device, and a portable device communicating with the IoT terminal using the selected injection method; and verifying, by the electronic device, data stored in a cloud server communicating with the IoT terminal based on the injected certificate, and can also be applied to other embodiment.

Abstract: Provided is a method for generating a one class model based on a data frequency. The method for generating a one class model based on a data frequency includes: generating, by a machine learning apparatus, a plurality of spatial coordinates by arranging a plurality of learning data in corresponding coordinates in a feature space; classifying, by the machine learning apparatus, the plurality of spatial coordinates into a plurality of internal coordinates PI and a plurality of external coordinates PO based on a frequency of the learning data arranged in the respective spatial coordinates which belong to the plurality of spatial coordinates; and generating, by the machine learning apparatus, a one class model based on the plurality of internal coordinates PI based on mutual spatial distances of the plurality of external coordinates PO and the plurality of internal coordinates PI.

Abstract: An operating method of a computing device operated by at least one processor includes collecting traffic packets; extracting particular field data from the traffic packets, transforming the extracted particular field data to a vector with a reduced dimension for each traffic packet, and creating training data with the vector for each traffic packet; training a traffic prediction model with the training data, the traffic prediction model predicting from an input traffic packet a next input traffic packet and whether the next input traffic packet is abnormal; and predicting with the trained traffic prediction model a frequency of abnormal traffic packets to be input, and outputting an abnormal traffic warning by comparing the predicted frequency and a threshold.

Abstract: Provided are a method of monitoring a network driving apparatus provided in a network and a system thereof. The present invention provides a network monitoring method that performs monitoring which does not hinder existing network availability through a means for detouring a path of a packet transferred to a monitoring target apparatus by using one or more servers and clients connected to a network and further, provides extensibility which can be applied to the network using various communication protocols through a protocol converting means that detours the path of the packet after converting the existing protocol into a TCP/IP protocol.

Abstract: According to an aspect of the inventive concept, there is provided a system for detecting vulnerabilities of communication protocol software, including: a field selection module selecting message fields of a communication protocol of an industrial control system; a value set configuration module configuring first value sets with respect to the respective message fields selected by the field selection module; a test case generation module generating first test cases by Cartesian product of the first value sets; a test module generating first code coverage data by testing the communication protocol software of the industrial control system based on the first test cases; and a code coverage analysis module analyzing the first code coverage data, wherein the field selection module selects concentration message fields which influence the first code coverage data among the message fields according to an analysis result of the code coverage analysis module.

Abstract: Provided is a method for generating a one class model based on a data frequency. The method for generating a one class model based on a data frequency includes: generating, by a machine learning apparatus, a plurality of spatial coordinates by arranging a plurality of learning data in corresponding coordinates in a feature space; classifying, by the machine learning apparatus, the plurality of spatial coordinates into a plurality of internal coordinates PI and a plurality of external coordinates PO based on a frequency of the learning data arranged in the respective spatial coordinates which belong to the plurality of spatial coordinates; and generating, by the machine learning apparatus, a one class model based on the plurality of internal coordinates PI based on mutual spatial distances of the plurality of external coordinates PO and the plurality of internal coordinates PI.

Abstract: A method of managing data of a file system includes: obtaining information of an unallocated inode that is not currently used because a corresponding file has been deleted based on status of use of inodes stored in an inode bitmap and deletion information of the inodes stored in an inode table; retrieving a backup inode corresponding to the unallocated inode in a journal log area using the obtained information of the unallocated inode; and requesting selection of whether to permanently delete files corresponding to the retrieved backup inode.

Abstract: A system, method, and apparatus are provided for establishing a wireless network connection between a mobile terminal and an electronic apparatus by using a near field communication network. At least one electronic apparatus is connected to the near field communication network. A mobile terminal is connected to the near field communication network, exchanges information with the at least one electronic apparatus for a wireless communication network connection through the connected near field communication network, and establishes the wireless communication network connection with the at least one electronic apparatus based on the exchanged information.

Abstract: According to an aspect of the inventive concept, there is provided a system for detecting vulnerabilities of communication protocol software, including: a field selection module selecting message fields of a communication protocol of an industrial control system; a value set configuration module configuring first value sets with respect to the respective message fields selected by the field selection module; a test case generation module generating first test cases by Cartesian product of the first value sets; a test module generating first code coverage data by testing the communication protocol software of the industrial control system based on the first test cases; and a code coverage analysis module analyzing the first code coverage data, wherein the field selection module selects concentration message fields which influence the first code coverage data among the message fields according to an analysis result of the code coverage analysis module.

Abstract: Provided are a method of monitoring a network driving apparatus provided in a network and a system thereof. The present invention provides a network monitoring method that performs monitoring which does not hinder existing network availability through a means for detouring a path of a packet transferred to a monitoring target apparatus by using one or more servers and clients connected to a network and further, provides extensibility which can be applied to the network using various communication protocols through a protocol converting means that detours the path of the packet after converting the existing protocol into a TCP/IP protocol.

Abstract: A method and apparatus for communicating with a target device in a personal area network (PAN), when a multi-function remote controller (MRC) is outside the coverage area of the target device. The apparatus includes a proxy device which automatically forms a virtual PAN by setting up a pairing link with the target device to control the target device. Accordingly, a user may continuously control the target device irrespective of the location of the MRC.

Abstract: A system, method, and apparatus are provided for establishing a wireless network connection between a mobile terminal and an electronic apparatus by using a near field communication network. At least one electronic apparatus is connected to the near field communication network. A mobile terminal is connected to the near field communication network, exchanges information with the at least one electronic apparatus for a wireless communication network connection through the connected near field communication network, and establishes the wireless communication network connection with the at least one electronic apparatus based on the exchanged information.

Abstract: A system, method, and apparatus are provided for establishing a wireless network connection between a mobile terminal and an electronic apparatus by using a near field communication network. At least one electronic apparatus is connected to the near field communication network. A mobile terminal is connected to the near field communication network, exchanges information with the at least one electronic apparatus for a wireless communication network connection through the connected near field communication network, and establishes the wireless communication network connection with the at least one electronic apparatus based on the exchanged information.

Abstract: A method and apparatus for selecting a wireless personal area network (WPAN) based adaptive radio frequency (RF) interface. The method includes obtaining RF interface information by establishing a WPAN based network connection with a target RF device; selecting an RF interface from among a plurality of RF interfaces using the obtained RF interface information, based on characteristics of applications and a network load; and establishing the selected RF interface by negotiating about the selected RF interface with the target RF device.

Abstract: In a charging demand verification method of an eco-friendly vehicle (EV), an eco-friendly vehicle supply equipment (EVSE) receives a charging request from a communication controller of eco-friendly vehicle (EVCC). The EVSE receives an identification code value (PEVID), a moving distance value, and a request charging value from the EVCC. The EVSE transmits the received identification code value to a secondary actor (SA). The EVSE receives vehicle type information, a basic maximum charging value, an accumulated moving distance value, and a charging amount at a previous charging time. The EVSE compares the request charging value and denies the charging request of the EV when the request charging value is greater than the basic maximum charging value. The EVSE calculates a prediction value of power consumed by the EV, and charges the EV when the difference between the prediction value and the actual power value actually is within a predetermined error range.

Abstract: A mobility management system and method is provided for efficiently support mobility to an IPv6 based LoWpan. The mobility management method for Internet Protocol version 6 (IPv6) based personal area network (PAN) moving with a mobile router according to the present invention includes detecting, at a mobile terminal, movement of the mobile router; determining whether the movement is an intra-network movement or an inter-network movement, transmitting, when the movement is an intra-network movement, a neighbor discovery request message to a gateway of a currently attached network and receiving a neighbor discovery response message containing a temporary address transmitted by the gateway in response to the neighbor discovery request message. When the movement is an inter-network movement, the gateway receives the binding acknowledgement message from a home agent and establishes a bidirectional tunnel with the home agent.

Abstract: A method for controlling a camera through a Multi-Hop-based wireless sensor network includes: sensing whether an event occurs or not in a corresponding area and transmitting position information on the corresponding area and type information on the event, converting the received position information on the event into a movement control signal for the camera, calculating camera driving values in a left/right direction and an up/down direction using the converted signal, controlling a zoom-in operation of the camera lens using the calculated camera driving values according to the received event type and photographing an object located in the corresponding direction, and transmitting the photographed images over the outer network.

Abstract: A method and apparatus for authenticating a sensor node in a sensor network. The method for authenticating a sensor node by a first sink node in a sensor network includes receiving an authentication request using an authentication ticket from the sensor node, identifying a second sink node which has issued the authentication ticket, decoding the authentication ticket using a group key, which is previously stored in correspondence to the second sink node to confirm the validity of the authentication ticket, when the second sink node is included in a neighboring node list, normally processing authentication for the sensor node, generating an authentication ticket using a group key of the first sink node, and transmitting the generated authentication ticket to the sensor node.

Abstract: A channel connection of a device that performs short range wireless communication is provided. If a public key that is broadcast by a specified device is received, the device encrypts its own UID (Unique Identifier) using the public key to transmit the encrypted UID to the specified device, transmits a pairing request to the specified device, and safely receives a key seed from the specified device using a security address included in a pairing device and the UID to form a security channel with the specified device.