Abstract:
A method of operating a vehicle communication security management system includes receiving a request for registration in a vehicle communication service from a vehicle, generating a security policy corresponding to the request for registration and a pseudonym corresponding to the vehicle, transmitting a request to generate a pseudonym certificate corresponding to the generated pseudonym to a certification center, receiving the pseudonym certificate from the certification center in response to the request to generate the pseudonym certificate, and transmitting vehicle communication service registration information, corresponding to the request for registration in the vehicle communication service, to the vehicle.
Abstract:
Disclosed herein is a method for detecting a network attack based on a fusion feature vector. The method includes extracting feature vectors corresponding to a preset unit time from network traffic, generating fusion feature vectors based on the extracted feature vectors, and performing training using the generated fusion feature vectors.
Abstract:
Disclosed are a method for providing a security service for a wireless device and an apparatus thereof. The method includes obtaining a wireless fingerprint of a wireless device, determining a wireless device type corresponding to the obtained wireless fingerprint by referring to a first database, determining a security policy corresponding to the determined wireless device type by referring to a second database, and applying the determined security policy to a service for the wireless device, so that the wireless device is provided with a tight security service.
Abstract:
Disclosed herein are an intrusion response apparatus and method for a vehicle network. The intrusion response method for a vehicle network is performed by an intrusion response apparatus for the vehicle network, and includes receiving attack detection information about an intrusive attack on the vehicle network from an intrusion detection system, selecting at least one target electronic control unit that is to be instructed to respond to the intrusive attack from among multiple electronic control units, and sending a response instruction message to the at least one target electronic control unit so that the target electronic control unit responds to the intrusive attack.
Abstract:
Disclosed herein are a health device, a gateway device, and a method for securing a protocol using the health device and the gateway device. The method includes performing, by the health device and the gateway device, authentication and key exchange based on security session information; sending, by any one of the health device and the gateway device, an application message protected based on the security session information; and receiving, by a remaining one of the health device and the gateway device, the protected application message.
Abstract:
Disclosed herein are a user terminal and method for playing DRM content. The user terminal includes a common security platform. The common security platform includes a DRM application management unit and a security management unit. The DRM application management unit stores and executes a DRM application that requests authentication from a license server and receives a license, including a decryption key for decrypting encrypted DRM content. The DRM application is an application in a downloadable form. The security management unit decrypts the encrypted DRM content, provided by a content providing server, using the decryption key included in the license issued via the DRM application.
Abstract:
Disclosed herein is a method for visualizing a medical device network and a security threat. The method includes representing nodes in zones that are divided into a server zone including nodes corresponding to server devices, a medical device zone including nodes corresponding to medical devices, a white zone including registered nodes excluding the server devices and the medical devices, and a gray zone including nodes included in none of the above-mentioned zones, representing links between the nodes, and representing a node and a link in which a security attack is detected using a different color when the security attack is detected in the node.
Abstract:
Disclosed herein are a device identification apparatus and method based on network behavior. The device identification apparatus includes one or more processors, and execution memory for storing at least one program that is executed by the one or more processors, wherein the at least one program is configured to collect packet data of a device connected to a network through port mirroring and extract behavior features from the packet data, analyze the behavior features and then generate unique information based on a previously created detection model, and extract an identification number corresponding to the unique information from a database and then identify the device.
Abstract:
An apparatus and a method for identifying a rogue device having a media access control (MAC) address counterfeited/forged when a wireless intrusion prevention system controls an access to an access point (AP) and a wireless terminal which are not applied are disclosed. The apparatus includes: a sensor unit configured to collect MAC addresses, RSSI values, and RF feature values based on RF signals of wireless terminals; an RF feature database configured to store the collected MAC addresses, RSSI values, and RF feature values; and a terminal identification unit configured to identify whether a MAC of any one of the wireless terminals is forged by comparing information of the RF feature database with the RSSI value and the RF feature value of any one of the wireless terminals according to a MAC verification request of any one of the wireless terminals from the sensor unit.
Abstract:
Disclosed herein are self-learning-based intrusion detection apparatus and method. The self-learning-based intrusion detection apparatus includes memory configured to store at least one program, and a processor configured to execute the program, wherein the program is configured to perform detecting an anomaly behavior in network traffic based on a first detection model, and as a self-learning event is published, generating a second detection model through self-learning in parallel with detecting the anomaly behavior, and wherein the program is configured to perform, as the second detection model is generated, in detecting the anomaly behavior, replacing the first detection model with the second detection model, and thereafter detecting the anomaly behavior in the network traffic.