공격시스템을 위한 보안-역-공격공학 생명주기 모델과 공격명세모델
Security-Reverse-Attack Engineering Life-cycle Model for Attack System and Attack Specification Models
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
최근 사이버공격이 활성화됨에 따라 이러한 많은 공격사례들이 다양한 매체를 통해 접해지고 있다. 사이버공격에 대한 보안공학이나 역공학에 대한 연구는 활발하지만, 이들을 통합하고 비용효과적인 공격공학을 통해 공격시스템을 연계하여 적용시킨 연구는 부족하다. 본 논문에서는, 보안강화형 정보시스템을 보안공학적으로 개발하고, 역공학을 통해 취약점을 식별한다. 이 취약점을 이용하여 공격공학을 통해 공격시스템을 구축하거나 리모델링하는 생명주기모델을 비교·분석하여 각 시스템의 구조 및 행동을 명세화하고, 더욱 실효성 있는 모델링을 제안한다. 또한, 기존의 모델·도구를 확장하여 공격방법 및 시나리오를 기능적, 정적, 동적과 같은 모델의 관점에서 명세하는 도형적 공격명세모델을 제시한다.
Abstract
Recently, as cyber attacks have been activated, many such attacks have come into contact with various media. Research on security engineering and reverse engineering is active, but there is a lack of research that integrates them and applies attack systems through cost effective attack engineering. In this paper, security - enhanced information systems are developed by security engineering and reverse engineering is used to identify vulnerabilities. Using this vulnerability, we compare and analyze lifecycle models that construct or remodel attack system through attack engineering, and specify structure and behavior of each system, and propose more effective modeling. In addition, we extend the existing models and tools to propose graphical attack specification models that specify attack methods and scenarios in terms of models such as functional, static, and dynamic.
참고문헌 (43)
- 정진우, "국내 클라우드 보안 인증스킴 개발에 관한 연구", 디지털융복합연구, 13(8), pp.43~49 (2015), 한국디지털정책학회[DOI]
- M. S. Gu, "A Study of Countermeasures for Advanced Persistent Threats attacks by malicious code", Journal of IT Convergence Society for SMB, 5(4), pp.37~42 (2015)
- J. H. Allen, "Software security engineering - A guide for project managers", pp.315~ (2008), Addison-Wesley Professional
- M. Ramachandran, "Software Security Engineering - Design and applications", pp.272~ (2012), Nova Science Publishers, Inc.
- R. Ross, "Systems security engineering - Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems", NIST SP 800-160, 242~ (2016)
- "Common Criteria for Information Technology Security Evaluation, Part1, Part2, Part3 Version 3.1, Revision 4", CCRA, ~ (2012)
- "Common Methodology for Information Technology Security Evaluation, Version 3.1, Revision 4", CCRA, ~ (2012)
- Kelley Dempsey, "Kelley Dempsey, Security and Privacy Controls for Federal Information Systemsand Organizations", NIST SP 800-53 Revision 4, ~ (2013)
- E. Gamma, "Design patterns - elements of reusable object-oriented software", pp.431~ (1995), Addison-Wesley
- C. Dougherty, "Secure Design Patterns" (2009), CMU
- "C Secure Coding Guide for e-government SW Development - Operation", Ministry of the Interior (11-1311000-000330-10), 212~ (2012)
- Java Secure Coding Guide for e-government SW Development-Operation, Ministry of the Interior, 11-1311000-000330-10, pp. 320, "Java Secure Coding Guide for e-government SW Development - Operation", Ministry of the Interior (11-1311000-000330-10), 320~ (2012)
- 김정훈, "빅데이터 기반의 융합 보이스피싱을 이용한 사회공학적 공격 기법과 대응방안", 한국융합학회논문지, 6(1), pp.85~91 (2015), 한국융합학회[DOI]
- 양환석, "프로파일 기반 다단계 공격 탐지 기법에 관한 연구", (사)디지털산업정보학회 논문지, 10(4), pp.89~96 (2014), (사)디지털산업정보학회
- K. M. Goertztel, "Software security assurance", IATAC and DACS, ~ (2007)
- P. Manadhata, "An Attack Surface Metric", IEEE Transactions on Software Engineering, 37(3) (2011)
- R. M. Blank, "Guide for Conducting Risk Assessments", NIST SP 800-30, ~ (2012)
- Alexander I, "Misuse Cases: Use Cases with Hostile Intent", IEEE Software, 20(1), pp.58~66 (2003)
- Sindre, G, "Eliciting Security Requirements with Misuse Cases", Requirements Engineering, 10(1), pp.34~44 (2005)
- Barbara Kordy, "DAG-Based Attack and Defense Modeling: Don’ Miss the Forest for the Attack Trees", Computer Science Review, 13, pp.1~38 (2014)
- 엄정호, "네트워크 취약성 분석을 위한 확장된 사이버 공격 트리에 관한 연구", (사)디지털산업정보학회 논문지, 6(3), pp.49~57 (2010), (사)디지털산업정보학회
- G. Lee, "Petri Net based Models for Specification and Analysis of Cryptographic Protocols", Journal of Systems and Software, 37, pp.141~159 (1997)
- Yongfu Zhou, "The Network Attack Model based on Hierarchical Expanded Stochastic Petri Net", International Journal of Security and Its Applications, 8, pp.161~172 (2014)
- Peter Karpati, "Towards a hacker attack representation method", Proceedings of the 5th International Conference on Software and Data Technologies, 92(101), pp.92~101 (2010)
- Schneider, Thorsten, "Secure Software Engineering Processes: Improving the Software Development Life Cycle to Combat Vulnerability", Software Quality Professional, 8(1) (2006)
- I. Flechais, "Integrating Security and Usability into the Requirements and Design Process", International Journal of Electronic Security and Digital Forensics, 1(1), pp.12~26 (2006)
- A. S. Sodiya, "Towards building secure software systems", Proceedings of Issues in Informing Science and Information Technology, Vol. 3, 3, pp.637~644 (2006)
- M. Zulkernine, "Enterprise Information Systems Assurance and System Security", pp.19~ (2006), Managerial and Technical Issues