公开(公告)号：US20140123288A1

公开(公告)日：2014-05-01

申请号：US14023635

申请日：2013-09-11

Applicant: ELECTRONICS AND TELECOMMUNICATIONS RESEARCH INSTITUTE

Inventor： Sung-Ryoul LEE ,  Young-Han CHOI ,  Jung-Hee LEE ,  Byung-Chul BAE ,  Hyung-Geun OH ,  Ki-Wook SOHN

IPC: H04L29/06

CPC classification number: H04L63/1416

Abstract: A network intrusion detection apparatus and method that perform Perl Compatible Regular Expressions (PCRE)-based pattern matching on the payloads of packets using a network processor equipped with a Deterministic Finite Automata (DFA) engine. The network intrusion detection apparatus includes a network processor core for receiving packets from a network, and transmitting payloads of the received packets to a Deterministic Finite Automata (DFA) engine. A detection rule converter converts a PCRE-based detection rule, preset to detect an attack packet, into a detection rule including a pattern to which only PCRE grammar corresponding to the DFA engine is applied. The DFA engine performs PCRE pattern matching on the payloads of the packets based on the detection rule converted by the detection rule converter.

Abstract translation: 一种网络入侵检测装置和方法，其使用配备有确定性有限自动机（DFA）引擎的网络处理器，对分组的有效载荷执行基于Perl兼容正则表达式（PCRE）的模式匹配。 网络入侵检测装置包括用于从网络接收分组并将接收的分组的有效载荷发送到确定性有限自动机（DFA）引擎的网络处理器核心。 检测规则转换器将基于PCRE的检测规则转换为包含仅对应于DFA引擎的PCRE语法的模式的检测规则，以检测攻击包。 DFA引擎根据检测规则转换器转换的检测规则对报文的有效载荷进行PCRE模式匹配。

公开(公告)号：US20140047543A1

公开(公告)日：2014-02-13

申请号：US13958552

申请日：2013-08-03

Applicant: Electronics and Telecommunications Research Institute

Inventor： Sung-Jin KIM ,  Jong-Moon LEE ,  Byung-Chul BAE ,  Hyung-Geun OH ,  Ki-Wook SOHN

IPC: H04L29/06

CPC classification number: H04L63/1441 ,  H04L2463/144

Abstract: An apparatus and method for detecting a Hyper Text Transfer Protocol (HTTP) botnet based on the densities of transactions. The apparatus includes a collection management unit, a web transaction classification unit, and a filtering unit. The collection management unit extracts metadata from HTTP request packets collected by a traffic collection sensor. The web transaction classification unit extracts web transactions by analyzing the metadata, and generates a gray list by arranging the extracted web transactions according to the frequency of access. The filtering unit detects an HTTP botnet by filtering the gray list based on a white list and a black list.

Abstract translation: 一种基于事务密度检测超文本传输​​协议（HTTP）僵尸网络的装置和方法。 该装置包括收集管理单元，网络交易分类单元和过滤单元。 收集管理单元从由流量采集传感器收集的HTTP请求数据包中提取元数据。 Web事务分类单元通过分析元数据来提取Web事务，并且通过根据访问频率排列提取的Web事务来生成灰色列表。 过滤单元通过基于白名单和黑名单过滤灰名单来检测HTTP僵尸网络。

公开(公告)号：US20150067868A1

公开(公告)日：2015-03-05

申请号：US14337306

申请日：2014-07-22

Applicant: ELECTRONICS AND TELECOMMUNICATIONS RESEARCH INSTITUTE

Inventor： Dong-Phil KIM ,  Jun-Young CHOI ,  Tae-Hyung KIM ,  Ji-Eun LEE ,  Hyung-Geun OH ,  Kiwook SOHN

IPC: G06F21/57

CPC classification number: G06F21/577 ,  G06F2221/034 ,  H04L63/00 ,  H04W4/00

Abstract: An apparatus and method for manifesting an event to verify the security of a mobile application are provided. The apparatus for manifesting an event to verify the security of a mobile application includes a tester application production unit, a tester application execution unit, and a tester application daemon execution unit. The tester application production unit produces a tester application for testing an application to be tested based on application information which is extracted from the application to be tested. The tester application execution unit executes the application to be tested by manifesting an event included in the extracted application information, and extracts a user view object output to a screen of a smart device when the application to be tested is executed. The tester application daemon execution unit generates a touch event based on the extracted user view object, and performs a screen change.

Abstract translation: 提供了用于显示事件以验证移动应用的安全性的装置和方法。 用于显示用于验证移动应用的安全性的事件的装置包括测试者应用程序生产单元，测试者应用程序执行单元和测试应用程序守护程序执行单元。 测试者应用程序生产单元根据从被测试应用程序提取的应用程序信息生成测试应用程序，以测试要测试的应用程序。 测试者应用程序执行单元通过显示提取的应用程序信息中包含的事件来执行要测试的应用程序，并且当执行要测试的应用程序时，提取输出到智能设备的屏幕的用户视图对象。 测试者应用程序守护程序执行单元基于所提取的用户视图对象生成触摸事件，并且执行画面改变。