악성 봇넷 탐지 기술에 대한 평가요소 분석

장대일(Dae-il Jang),조강유(Kang-Yu Cho),김민수(Minsoo Kim),노봉남(Bong-Nam Noh) 한국정보기술학회 2011 Proceedings of KIIT Conference Vol.2011 No.5

최근 인터넷 환경에서 발생하는 대부분의 악성 행위는 악성 봇넷에 의해 발생하고 이를 탐지하기 위한 많은 시스템이 연구되고 있다. 하지만 연구된 악성 봇넷 탐지 기술에 대한 평가 방법이 전무한 실정이다. 이에 본 논문에서는 악성 봇넷 탐지 기술을 알아보고 각 논문에서 사용된 평가 요소에 대해 알아볼 것이다. 이를 통해 문제점을 알아봄으로써 평가요소 개발이 필요함을 보이고자 한다. Malicious botnet acts the most malicious attack in internet environment. So many researchers study to detect a malicious botnet. We doen’t have a standardized evaluation method for studied detection techniques of malicious botnet. In this reason, we survey a detection technique and used evaluation factor. Through this issue that is arbitrary evaluation factor, we try to say a necessity of developing evaluation factor.

HTTP 기반 악성 봇넷 분석 (Kraken 봇넷을 중심으로)

장대일 ( Dae-il Jang ),이재서 ( Jae-seo Lee ),박준형 ( Jun-hyung Park ),김민수 ( Minsoo Kim ),노봉남 ( Bong-nam Noh ) 한국정보처리학회 2008 한국정보처리학회 학술대회논문집 Vol.15 No.2

악성 봇이 현대 인터넷 보안의 큰 위협으로 등장함에 따라, 이러한 봇을 탐지하기 위한 많은 연구가 진행되고 있다. 하지만 악성 봇은 꾸준히 진화하여 탐지방법을 무력화시키고 있으며, 최근 HTTP를 이용한 악성 봇의 등장으로 그 탐지와 대응이 더욱 어려워지고 있다. 게다가 웹기반 서비스들의 증가로 HTTP를 이용하는 패킷은 통신량의 대부분을 차지하고 있으며, 이들에 대한 분석은 큰 부하를 발생시키게 된다. 이러한 문제를 해결하기 위해서는 악성 봇넷을 효과적으로 탐지하기 위한 효율적인 매져들을 선택하여야 하며, 본 논문에서는 대표적인 HTTP 기반 악성 봇넷인 크라켄(Kraken) 봇넷의 특성을 분석하였다.

악성 봇넷 별 트래픽 분석을 통한 탐지 척도 선정

장대일(Dae-il Jang),김민수(Minsoo Kim),정현철(Hyun-chul Jung),노봉남(Bong-Nam Noh) 한국정보보호학회 2011 정보보호학회논문지 Vol.21 No.3

최근 발생하는 인터넷 상의 악성 행위는 많은 부분 악성 봇넷과 관련이 있다. DDoS 공격이나 스팸 발송, 악성코드 전파, 개인 정보 유출, 피싱 등 대부분의 악성 행위들이 봇넷에 의해 행해지고 있다. 이러한 봇넷을 탐지하고자 네트워크 단에서 악성 봇넷 탐지 시스템이 활발히 연구되고 있지만, 특정한 프로토콜이나 행위, 공격을 수행하는 봇넷에만 적용 가능하다는 단점을 가지고 있다. 이에 본 논문에서는 악성 봇넷을 탐지하기 위한 척도 선정에 관한 연구를 진행하였다. 연구를 위해 악성 봇넷의 트래픽을 수집 및 분석하여 분석된 네트워크 트래픽의 특징에 기반 한 척도를 선정하였다. 본 연구를 통해 악성 봇넷을 탐지하는데 도움이 될 수 있을 것으로 기대한다. Recently malicious activities that is a DDoS, spam, propagation of malware, steeling person information, phishing on the Internet are related malicious botnet. To detect malicious botnet, Many researchers study a detection system for malicious botnet, but these applies specific protocol, action or attack based botnet. In this reason, we study a selection of measurement to detec malicious botnet in this paper. we collect a traffic of malicious botent and analyze it for feature of network traffic. And we select a feature based measurement. we expect to help a detection of malicious botnet through this study.

HTTP 기반의 브리도랩 봇넷 분석

장대일(Dae-il Jang),김민수(Minsoo Kim),정현철(Hyunchul Jung),노봉남(Bong-Nam Noh) 한국정보과학회 2009 한국정보과학회 학술발표논문집 Vol.36 No.2D

악성 봇넷은 DDoS 공격이나 각종 스팸 메시지 발송, 개인 정보 탈취, 클릭 사기 등 많은 악성 행위에 이용되고 있다. 이를 방지하기 위해 많은 연구가 선행되었지만 악성 봇넷 또한 진화하여 탐지 시스템을 회피하고 있다. 특히 악성 HTTP 봇넷의 경우 인터넷 트래픽의 대부분을 차지하는 HTTP를 이용하여 통신함으로써 탐지를 어렵게 하고 있다. 이에 최신 HTTP 봇넷인 브리도랩 봇넷을 분석하여 최신 봇넷이 갖는 특징을 분석하였다. 이를 통해 악성 봇넷을 탐지하기 위한 효율적인 척도의 선택에 도움을 줄 것으로 기대한다.

기존 유무선 악성코드 수집시스템을 이용한 스마트폰 기반 악성코드 수집 시스템 적용 방안

조강유(Kang-Yu Cho),장대일(Dae-Il Jang),김용민(Yong-Min Kim),노봉남(Bong-Nam Noh) 한국정보기술학회 2011 Proceedings of KIIT Conference Vol.2011 No.5

최근 해커의 관심 영역이 개인 컴퓨터에서 스마트폰으로 변화함에 따라 스마트폰 기반의 악성코드가 급격히 증가하고 있다. 이에 사용자 피해가 증가하고 있는 만큼 국내 뿐만 아니라 해외 스마트폰 기반의 악성코드 동향 파악에 대한 필요성이 높아지고 있다. 하지만 스마트폰기반 악성코드는 기존 컴퓨터 환경과 다르게 감염경로가 다양하여 악성코드 수집에 대한 어려움이 있다. 본 논문에서는 기존 유무선 환경에서 동작하는 악성코드 수집 시스템을 분석하여 각 수집 경로별로 스마트폰 기반의 악성코드를 수집할 수 있는 적용 방안을 제시한다. Recently, Malware based on smartphone is increasing rapidly as hackers's interest is changing to smartphones from personal computer. In this reason, The need for malware trend based on domestic and overseas smartphone is growing more because of increasing user's damage. However, information of malware based on Smartphone is difficult to collect due to variety of infection route unlike existing computer environment. In this paper, validation method is presented to collect malware based on smartphone covering each collection route through malware collection system and analysis of operation under existing wired and wireless environment.

트래픽 프로파일링 방법을 이용한 봇넷 탐지 기법

조강유(Kang-yu Cho),장대일(Dae-il Jang),김민수(Min-Soo Kim),정현철(Hyun-Cheol Jeong),노봉남(Bong-Nam Noh) 한국정보기술학회 2011 한국정보기술학회논문지 Vol.9 No.9

Recently, many botnet detection systems have been studied for response to steadily evolving malicious botnets using evasion techniques or social engineering method. However, it is difficult to detect modified botnet because existing malicious botnet detection system detects through signature of traffic. It demands new measures and methods with stead analysis to detection malicious botnets. In this paper, we extract characteristic of botnets by analysing network traffic of recent botnets and creating botnet traffic profiling data. From the analyzed result, this paper shows the effective detection for traffic of previous or modified botnets in normal traffic through similarity comparison.

특발성 파킨슨병 환자의 전침치료 효과

강미경,이상훈,홍장무,박상민,강중원,박히준,임사비나,장대일,이윤호,Kang, Mi-kyung,Lee, Sang-hoon,Hong, Jang-moo,Park, Sang-min,Kang, Jung-won,Park, Hi-joon,Lim, Sabina,Chang, Dae-il,Lee, Yun-ho 대한침구의학회 2004 대한침구의학회지 Vol.21 No.5

Objective : This study was designed to evaluate the effect of electroacupuncture with various scales on symptoms of idiopathic Parkinson's disease. Methods : Subjects were voluntarily recruited by newspapers and internet. All the subjects are confirmed as idiopathic parkinson's disease by a neurologist. The acupuncture therapy was performed twice a week for 8 weeks. Acupuncture points for EA group were GB34, and LR3, electrical stimulation frequency was 120Hz, duration 15 minutes, and intensity is up to pain threshold according to patients. The patient's symptoms were assessed before, after 4 weeks and after 8 weeks treatments by unified Parkinson's disease rating scale(UPDRS), modified Hoehn-Yahr(H-Y) stage, Schwab & England activity of daily living and freezing of gait questionnaire(FOGQ). Results : UPDRS I, II, III, IV and total UPDRS scores were significantly improved after 4 weeks(p<0.05) and after 8 weeks(p<0.05) compared to the pre-treatment. The scores of ADL were significantly improved after 4 weeks(p<0.05) and after 8 weeks(p<0.05). There were significant changes in H-Y stage after 4 weeks(p<0.05), but There were no significant changes in H-Y stage after 8 weeks. There were significant changes in FOGQ scale after 4 weeks(p<0.05) and after 8 weeks(p<0.05). Conclusion : This study suggests that electroacupuncutre treatments can be applicable to improve symptoms in the patients with idiopathic Parkinson's disease.

국내 가상자산 거래소의 이더리움 지갑주소 식별을 위한 머신러닝 알고리즘 성능 비교

신용희(Shin Yong-hee),배근우(Bae Keun-woo),장대일(Jang Dae-il),지승구(Ji Seung-goo) 한국통신학회 2022 한국통신학회 학술대회논문집 Vol.2022 No.11

사회복지사의 노후준비에 관한 연구 : 경남지역 사회복지기관을 중심으로

장대일 培材大學校 人文科學硏究所 2018 人文論叢 Vol.35 No.-

사회복지사의 노후준비에 관한 선행연구를 보면 아직 그다지 활발하게 논의가 이루어지고 있지는 않지만, 사회복지사의 노후준비 인식과 실태에 관한 몇몇 시사적인 연구결과들이 제시되어 있어 주목할 만하다. 가령, 사회복지사들의 노후준비 인식과 노후준비 실태를 경제적, 정서적, 신체적 요인을 중심으로 조사한 결과를 보면 노후준비 인식은 매우 높게 나타났지만 노후준비 실태는 낮다고 하였다(김정표, 2005). 또한, 노후준비 인식과 노후준비 실태에 영향을 미치는 결정요인을 분석한 결과 혼인 상태, 학력, 직종과 직급, 이직, 퇴직금 제도가 노후준비에 큰 영향을 미치고 있다고 하였다(이춘희, 2008). 본 연구는 이러한 선행연구의 연장선상에서 사회복지사의 인구사회학적 특성과 직업적 환경이 사회복지사의 노후준비 인식과 실태에 어떠한 영향을 미치는지를 체계적으로 규명함으로써 사회복지사의 안정적인 노후설계를 위한 기초자료를 제공하고자 한다. The purpose of this study is to investigate the effect of social demographic characteristics and occupational environment on social workers' perception and behavior for preparing their retirement. The perception and behavior for preparing retirement consist of three sub–dimensions(Economic, emotional, and physical areas) respectively. Altimately, this study will suggests the policy and practical implications of social workers' retirement design support. For this study, we conducted a structured questionnaire survey of 289 social workers working in social welfare facilities in Gyeongsang nam-do. Data analysis was performed through SPSS for Windows ver.22.0 program. As a concrete analysis method, descriptive statistics, reliability test, T-test, ANOVA analysis, post analysis, and multiple regression analysis were used. The results of this study are summarized as follows. First, the level of social workers' perception for preparing retirement. was average at 3.2392(mean) In terms of three sub-dimensions of retirement preparation recognition, 'Economic perception for preparing retirement' was the highest at 3.2725(mean), followed by 'Emotional perception for preparing retirement' at 3.2307(mean) and 'Physical perception for preparing retirement' at 3.1592(mean). Seconds, the level of social workers' behavior for preparing retirement. was average at 3.1070(mean) In terms of three sub-dimensions of retirement preparation recognition, 'Emotional behavior for preparing retirement' was the highest at 3.6301(mean), followed by 'Physica behavior for preparing retirement' at 2.9602(mean) and 'Economic behavior for preparing retirement' at 2.7307(mean). Third, There was equally group differences between the perception and behavior or preparing retirement. According to the social demographic characteristics(age, final educational background, marital status, and the type of household) have differences in the case of the perception and behavior for preparing retirement. Also, the perception and behavior for preparing retirement were different according to occupational environment such as employment type, work experience, position type and total income. Fourth, multiple regression analysis was conducted to examine factors affecting The perception and behavior for preparing retirement. The results of this study show that employment status, working experience, and facility sector have an influence on the overall perception for preparing retirement. Also, the age, spouse status, employment type, work experience, type of facility have an influence on the overall behavior for preparing retirement. Based on the above results, the suggestions for the preparation of social workers' retirement are as follows. First, Economic perception for preparing retirement was the highest among the perception for preparing retirement. However, Economic behavior for preparing retirement is the lowest level among the behavior for preparing retirement. This means that social workers have difficulties in preparing for economic deprivation and are not getting enough preparedness. Above all, active intervention and efforts of the government and local governments are needed for social workers who can not prepare for economic retirement due to low income and salary. Since the current salaries of social workers are low, it seems urgent to find a reasonable plan to increase pay. In addition, it is necessary to strengthen the welfare system such as loan for housing funds and support for living expenses. Seconds, The term, “Health in old age is more important than economic” related the Physical perception for preparing retirement was the highest. However, “I exercise regularly for a healthy life of old age” was relatively low. When asked about the overall aging preparation situation, the most important factor in aging was the question "Living healthy" (34.4%). This means that social workers are at the forefront of health than economics, but they are having difficulty in preparing for their physical aging due to excessive work and poor working conditions. Therefore, the government and social welfare organizations should work together to raise the health status of the social workers and improve the work environment so that they can be interested in the preparation of social workers' old age. Third, It is necessary to establish a systematic and professional design support system for social workers' retirement preparation. In response to the question, "Do you participate in retirement planning counseling or education to prepare for retirement," 214 (74.0%) of the many social workers answered that they did not. This is a very high figure. In addition, 107 respondents (50.0%) answered that they did not know how to receive such education about questions "Why did not receive education for old age"? This is half of the total response. A professional support system should be established to provide systematic and comprehensive support for social workers' stable and successful retirement preparation. In addition, the Korean Association of Social Workers should establish a education program on retirement preparation in social welfare worker education.

추체외로 증상을 나타낸 간경변 환자에서 담창구 부위의 자기공명 신호증강과 혈중 망간농도와의 상관성

백일현,김병호,김경진,김효종,최우석,장린,이정일,동석호,장영운,이동근,한요셉,장대일 대한간학회 2000 Clinical and Molecular Hepatology(대한간학회지) Vol.6 No.1

Backgroud/Aims : Increasing evidence suggests that manganese deposition in globus pallidus is responsible for MRI signal hyperintensity and for extrapyramidal symptoms in cirrhotics. However, the relationships between blood manganese, the severity of liver dysfunction, the pallidal signal intensity, and neurological signs have not been well established. Methods: Blood manganese concentrations were measured together with brain MRI and neurological evaluation in six controls, six patients with Parkinson's disease with normal liver function, and fourteen cirrhotic patients with hepatic encephalopathy including six cirrhotics with extrapyramidal symptoms. The neurological state was evaluated using the Columbia scale and the pallidal index (PI). The ratio of globus pallidus to frontal subcortical white-matter signal intensity was measured-multiplied by 100. Results : Pallidal signal hyperintensity was observed in 85.7% of cirrhotics, and the PI was higher in cirrhotics with extrapyramidal signs or high grade varices than those without them, but there was no increase in the Parkinson's disease patients. No correlations were demonstrated between the blood manganese level and PI as well as the Child-Pugh score. The blood manganese level was not significantly different between cirrhotics and other groups. However, there was an overt increase only in two cirrhotic patients with extrapyramidal signs. The Columbia scale did not reveal any correlations with the blood manganese level and the Child-Pugh score. Conclusions: Cirrhotics with extrapyramidal signs showed a significant increase in PI, but there was no increase in the patients with Parkinson's disease. The PI was not significantly correlated with the blood manganese level. These findings suggest that extrapyramidal signs in cirrhotics might be caused by a different mechanism than those in Parkinson's disease, which could possibly be related with manganese. (Korean J Hepatol 2000;6:24-32)