사이버 보안 연구 프레임워크로써의 Emulab 활용 동향 연구

국문 초록 (Abstract)

Emulab은 미국 Utah 대학에서 개발된 연구 프레임워크로써 연구자들에게 필요한 시스템을 원하는 네트워크 구조로 연결하여 주는 On-demand 서비스를 그 핵심으로 하고 있다. 특히 Emulab은 시뮬레이션 또는 가상화 기술을 사용하지 않고 실제 시스템에 운영체제를 구동시킴으로써 연구의 검증환경을 실제 환경에 가깝게 하는 것이 특징이다. 이로 인해 Emulab은 사이버 보안 분야뿐만 아니라 네트워크 분야 등에서도 다양하게 활용되고 있었지만 국내에는 활용된 바가 거의 없었다. 최근 한국과학기술정보연구원(KISTI)에서 소규모 Emulab을 자체적으로 구축·운영함에 따라 국내에서도 Emulab을 활용한 연구가 활성화 될 것으로 기대된다. 이를 기점으로 본 논문은 Emulab을 국내에 소개하고, 사이버 보안 연구 프레임워크로써의 Emulab 활용 동향을 소개한다.

다국어 초록 (Multilingual Abstract)

Emulab is a research framework developed by Utah university, proving on-demend research environment service so that researchers can set up and use the environment at anytime. The main advantage of Emulab over other research methodologies like simulation or virtualization is to use real systems and networks using real operating systems, making the research environment much similar to the real world. Even though Emulab has been actively used in many areas such as security and network, there has been little use in Korea research community. As KISTI recently constructed a small Emulab, it is expected that many researchers and educators would make use of the Emulab. In this study, we introduce Emulab to Korea research community and give an overview of utilization trend of Emulab as a cyber security research framework.

목차 (Table of Contents)

• 요약
• ABSTRACT
• Ⅰ. 서론
• Ⅱ. Emulab 소개
• Ⅲ. Emulab을 이용한 사이버 보안기술 연구 동향
• Ⅳ. Emulab을 이용한 DDoS 공격 사례 연구
• Ⅴ. 결론
• References

참고문헌 (Reference)

1 N. Weaver, "Very fast containment of scanning worms, Revisited" Springer Verlag 27 : 113-145, 2007

2 "Utah Emulab; Network Emulation Testbed Home"

3 C. Ko, "Towards systemic ids evaluataion" 2006

4 X. Chen, "Towards an understanding of anti-virtualization and anti -debugging behavior in modern malware" 177-186, 2008

5 S. Cheetancheri, "Towards a framework for worm-defense evaluation" 559-565, 2006

6 P. Barford, "Toward botnet mesocosms" USENIX Association 2007

7 K. Butler, "Testing large scale bgp security in replayable network environments" 2006

8 N. Weaver, "Stress-testing a gbps intrusion prevention device on deter" 2006

9 "Slowloris HTTP DoS"

10 "Slowloris"

11 P. Peterson, "Security exercises for the online classroom with deter" 2010

12 C. Neuman, "Running live self-propagating malware on the deter testbed" 2006

13 H. Hazeyama, "Outfitting an inter-as topology to a network emulation testbed for realistic performance tests of ddos countermeasures" 2008

14 J. Mirkovic, "Measuring impact of dos attacks" 2006

15 "KISTI Emulab; Network Emulation Testbed Home"

16 S. Hanna, "Implementation and instrumentation of a flash-worm" 2006

17 J. Mirkovic, "How to test dos defenses" 103-117, 2009

18 R. Chertov, "High fidelity denial of service(dos) experimentation" 2006

19 L. Briesemeister, "Formally specifying design goals of worm defense strategies" 2006

20 M. Natu, "Fine-grained capabilities for flooding ddos defense using client reputations" 105-112, 2007

21 L. Li, "Evaluation of collaborative worm containments on deter testbed" 2007

22 L. Li, "Emulating sequential scanning worms on the deter testbed" 2006

23 C. Neuman, "Emulating an embedded firewall" 2007

24 S. Tseng, "Elisha: a visual and interactive tool for bgp anomaly detection and analysis" 2006

25 M. Vasek, "Do malware reports expedite cleanup? an experimental study" 2012

26 J. Mirkovic, "Distributed defense against ddos attacks" University of Delaware CIS Department 2005

27 S. Floyd, "Difficulties in simulating the internet" 9 (9): 392-403, 2001

28 J. Li, "Dependency -based distributed intrusion detection" 2007

29 A. Hussain, "Ddos experiment methodology" 2006

30 "DETER Network Security Testbed"

31 Y. Chen, "Collaborative detection of ddos attacks over multiple network domains" 18 (18): 1649-1662, 2007

32 J. Mirkovic, "Benchmarks for ddos defense evaluation" 2006

33 J. Mirkovic, "Automating ddos experimentation" 2007

34 B. White, "An integrated experimental environment for distributed Systems and Networks" 255-270, 2002

35 K. Butler, "A survey of bgp security issues and solutions" ATandT Labs – Research 2004

36 S. Cheetancheri, "A distributed host-based worm detection system" 107-113, 2006

37 M. Beaumont-Gay, "A comparison of syn flood detection algorithms" 9-, 2007