보안관제 위협 이벤트 탐지규칙 표준 명명법 연구

박원형,김양훈,임영환,안성진,Park, Wonhyung,Kim, Yanghoon,Lim, YoungWhan,Ahn, Sungjin 한국융합보안학회 2015 융합보안 논문지 Vol.15 No.4

최근 해킹과 악성코드 등 사이버 공격기법은 매우 빠르게 변화 발전하고 있으며 그에 따른 사이버공격 기법이 다양해지고 지능화된 악성코드의 수가 증가하고 있다. 악성 코드의 경우 악성 코드의 수가 급격하게 증가함으로서 분류나 이름의 모호함으로 인해 악성코드에 대처함에 있어 어려움이 있다. 본 논문은 이러한 문제점을 해결하기 위해서 국내에 있는 백신업체들의 명명규칙을 조사 분석하고 이를 기반으로 현재까지 나온 탐지규칙의 패턴을 비교 분석해 보안관제 이벤트 탐지규칙에 적합한 명명규칙을 제안 한다. Recent, Cyber attacks such as hacking and malicious code techniques are evolving very rapidly changing cyber a ttacks are increasing, the number of malicious code techniques vary accordingly become intelligent. In the case of m alware because of the ambiguity in the number of malware have increased rapidly by name or classified as maliciou s code may have difficulty coping with. This paper investigated the naming convention of the vaccine manufacturer s in Korea to solve this problem, the analysis and offers a naming convention for security control event detection r ule analysis to compare the pattern of the detection rule out based on this current.

보증신용장거래 분쟁에서 중재합의의 이행가능성

박원형,강원진 한국중재학회 2009 중재연구 Vol.19 No.3

마코브 체인을 이용한 Mass SQL Injection 웜 확산 예측에 관한 연구

박원형,김영진,이동휘,김귀남 한국융합보안학회 2008 융합보안 논문지 Vol.8 No.4

최근 웜에 의한 사이버 위협이 증가함에 따라 웜의 확산 특성을 분석하기 위한 전파 모델이 연구되고 있다. 대표적인 예로 수학적 모델링 기법인 Epidemic(SI), KM(Kermack-MeKendrick), Two-Factor, AAWP(Analytical Active Worm Propagation)등의 모델 기법들이 제시되었다. 하 지만, 기존 모델 방법들은 대부분 코드레드와 같은 네트워크를 대상으로 하는 랜덤 스캐닝 기법 에 대해서만 모델링이 가능하다. 또한 거시적인 분석만 가능하고 특정 위협에 대해 예측하는데 한계점을 가지고 있다. 따라서 본 논문에서는 과거의 위협 발생 데이터를 근거로 하여 Mass SQL Injection 같은 사이버위협에 적용 가능한 마코브 체인(markov chain) 기반 예측 방법을 제시한다. 이를 통하여 각 위협별 발생 확률 및 발생빈도를 예측할 수 있다. Recently, Worm epidemic models have been developed in response to the cyber threats posed by worms in order to analyze their propagation and predict their spread. Some of the most important ones involve mathematical model techniques such as Epidemic(SI), KM(Kermack-MeKendrick), Two- Factor and AAWP(Analytical Active Worm Propagation). However, most models have several inherent limitations. For instance, they target worms that employ random scanning in the network such as CodeRed worm and it was able to be applied to the specified threats. Therefore, we propose the probabilistic of worm propagation based on the Markov Chain, which can be applied to cyber threats such as Mass SQL Injection worm. Using the proposed method in this paper, we can predict the occurrence probability and occurrence frequency for each threats in the entire system.

정보유출 악성코드 분석을 통한 개선된 탐지 규칙 제작 연구

박원형,양경철,이동휘,김귀남 한국융합보안학회 2008 융합보안 논문지 Vol.8 No.4

최근 해킹 기법들은 기존보다 정교한 기술을 바탕으로 악성화 되어 그 피해 규모가 증가하고 있으며, 인터넷 사용자의 확대와 맞물려 그 위력은 커지고 있다. 특히 정보유출을 목적으로 제작한 해킹메일에 첨부된 악성코드의 피해가 급증하고 있다. 본 논문에서 이러한 정보유출형 악성코드를 효과적으로 분석, 탐지할 수 있는 기술에 관하여 연구한다. 또한 본 연구에서는 기존 악성코드의 탐지규칙과 해킹메일 악성코드 탐지규칙을 비교하였으며 이를 통해 해킹메일 악성코드 뿐 아니라 새로운 악성코드와 변종들에 대해서도 탐지할 수 있는 기술에 대해 설명한다. Not only the recent hacking techniques are becoming more malicious with the sophisticated technology but also its consequences are bringing more damages as the broadband Internet is growing rapidly. These may include invasion of information leakage, or identity theft over the internet. Its intent is very destructive which can result in invasion of information leakage, hacking, one of the most disturbing problems on the net. This thesis describes the technology of how you can effectively analyze and detect these kind of E-Mail malicious codes. This research explains how we can cope with malicious code more efficiently by detection method.

스키 시뮬레이터를 위한 모션 피드백 플랫폼

박원형,김유준,최동수,김상연 한국지식정보기술학회 2014 한국지식정보기술학회 논문지 Vol.9 No.2

In this paper, the motion-haptic feedback system is presented in order to provide the same sensation to players as if they enjoys a real ski on ski slope. For maximizing immersive sensation, player’s motion is measured by two inertia measurement units (IMUs) and the measured motion is used for natural interaction with virtual environment. To simulate the behavior of player’s ski plates, three timing belts and five DC motors are incorporated into the proposed system. The three-timing belts and three-DC motors are also used in order to provide horizontal acceleration to players. Furthermore, two additional DC motors are applied to the proposed system for creating forward-backward acceleration. Therefore, the players can sense realistic motion-haptic feedback as if they enjoy real ski on ski slope.

디지털 신호 처리 소자에 의한 Mel척도 필터 뱅크의 구현 ( The Implementation of Mel-scaled Filter Bank using Digital Signal Processor )

박원형,이원근,김훈경,박인정 대한전자공학회 1993 대한전자공학회 학술대회 Vol.1993 No.1

직물 형상 PVC 겔 기반의 유연한 햅틱 액추에이터

박원형 한국소음진동공학회 2020 소음 진동 Vol.30 No.5

Anterior Optic Pathway Compression Due to Internal Carotid Artery Aneurysms: Neurosurgical Management and Outcomes

박원형,박중철,Kyunghwa Han,안재성,권병덕 대한뇌졸중학회 2015 Journal of stroke Vol.17 No.3

Background and Purpose Compression of the anterior optic pathway results in visual deficits that can lead to the detection of unruptured aneurysms in the internal carotid artery (ICA). The general types of treatment modalities for aneurysms and visual deficits include surgery and endosaccular coiling. This study retrospectively analyzed and compared the resolution of visual deficits following surgery or endosaccular coiling. Methods We reviewed data on 33 patients with unruptured ICA aneurysms who presented with visual field deficits caused by mass effects over the anterior optic pathway. Statistical analyses were performed to identify the variables associated with the recovery of visual symptoms. Results Eighteen patients underwent aneurysm clipping, 2 underwent bypass surgery with endovascular trapping, and 2 underwent endovascular trapping without bypass surgery (group A). Ten patients received endosaccular coiling (group B). The visual outcomes included the following: in group A, 17 patients (73.9%) demonstrated improvement and 6 patients (26.1%) demonstrated no changes or worse outcomes; in group B, 2 patients (20.0%) demonstrated improvement and 8 patients (80.0%) demonstrated no changes or worse outcomes. Group A was associated with a higher rate of favorable outcome than group B (P=0.007). According to the multivariate analysis, treatment without endosaccular coiling (group A) was the only variable significantly associated with improvement of visual outcome (P=0.005; OR=28.523; 95% CI=2.683-303.171). Conclusions Treatment modality was the only predictor of improvement in visual deficits. Treatment without endosaccular coiling resulted in visual improvement significantly more often in comparison with endosaccular coiling.

미국 연방법제하의 중재합의의 이행가능성에 관한 연구 - 하이닉스 반도체 사건을 중심으로

박원형,하충룡 한국무역학회 2009 貿易學會誌 Vol.34 No.5

Given the comparative analysis between the U.S. and Korea through their Arbitration Acts, this article tried to draw certain implication through the U.S. case law regarding the validity of arbitral agreements, especially regarding interpretation of the governing law provision. A universal principle of contemporary arbitration law is that contract plays a vital role in the governance of arbitration. While the vitality of that role can vary by legal system, court, statute, or treaty. Nonetheless, party agreement often provides the most significant rules for regulating arbitrations and conducting arbitral proceedings especially in international commercial arbitration. Freedom of contract, therefore, is at the very core of how the law regulates arbitration. What the contracting parties provide in their agreement generally becomes the controlling law. A workable and contemporary arbitration agreement should include a provision that clearly establishes the governing law and the role it is to play as to the different facets of the transaction and the agreed upon process of dispute resolution. In this setting, the Rambus Inc. v. Hynix Semiconductor, Inc. case reviewed in this article suggests choice-of-law considerations which have greater relevance to transborder arbitrations. Further research will be conducted to provide useful and meaningful guidances for better operation of arbitral agreements in certain domestic legal regime, where, like in Korea, case laws can't play a role as a gap-filler for the arbitration act because relevant cases are not common.

Carotid Sinus Syncope in an Elderly Patient With Unexplained Syncope

박원형,김수연,박현경,송대근,김태균,민보영,박중일 대한심장학회 2008 Korean Circulation Journal Vol.38 No.10

Carotid sinus syndrome is the most commonly reported cause of falls and syncope in elderly adults. However, it has been rarely reported in Koreans, and the reason of this ethnic difference is unknown. We report here on an Korean unusual case of carotid sinus syncope and this was induced by carotid sinus massage Carotid sinus syndrome is the most commonly reported cause of falls and syncope in elderly adults. However, it has been rarely reported in Koreans, and the reason of this ethnic difference is unknown. We report here on an Korean unusual case of carotid sinus syncope and this was induced by carotid sinus massage