사례기반추론기법을 적용한 침해사고 프로파일링 시스템
Applying CBR algorithm for cyber infringement profiling system
0
조회
0
다운로드
5
인용
0
참고문헌
키워드
초록
최근에 발생하는 웹 사이트 해킹은 기업의 이미지와 평판에 악영향을 끼치는 큰 위협이 되고 있다. 이러한 웹 사이트 변조 행위는 해커의 정치적인 동기나 성향을 반영하기도 하므로, 행위에 대한 분석은 해커나 해커 그룹을 추적하기위한 결정적인 단서를 제공할 수 있다. 웹 사이트에 남겨진 특정한 메시지나 사진, 음악 등의 흔적들은 해커를 추적하기 위한 단서를 제공할 수 있고, 인코딩 방법과 해커가 남긴 메시지에 사용된 폰트, 트위터나 페이스북 같은 해커의SNS ID 또한 해커의 정보를 추적하는데 도움을 준다. 본 논문에서는 zone-h.org의 웹 해킹 사례들로부터 특성들을추출하고, CBR(Case-Based Reasoning) 알고리즘을 적용하여 침해사고 프로파일링 시스템을 구현하였다. 해커의 흔적과 습관에 관한 분석 및 연구는 추후 사이버 수사에 있어 공격 의도를 파악하고 그에 따른 대응책을 마련하는데 있어 IDSS(Investigation Detection Support System)로써 중요한 역할을 기대 할 수 있으리라 본다.
Abstract
Nowadays, web defacement becomes the utmost threat which can harm the target organization's image and reputation. These defacement activities reflect the hacker's political motivation or his tendency. Therefore, the analysis of the hacker‘sactivities can give the decisive clue to pursue criminals. A specific message or photo or music on the defaced web site andthe outcome of analysis will be supplying some decisive clues to track down criminals. The encoding method or used fontsof the remained hacker’s messages, and hacker’s SNS ID such as Twitter or Facebook ID also can help for tracking hackersinformation. In this paper, we implemented the web defacement analysis system by applying CBR algorithm. The implementedsystem extracts the features from the web defacement cases on zone-h.org. This paper will be useful to understand the hacker’spurpose and to plan countermeasures as a IDSS(Investigation Detection Support System).
참고문헌 (24)
- "‘3.20 Cyber Terror’ mid-term report"[URL]
- "Defense Advanced Research Projects Agency"[URL]
- M. Warren, "Hacker Taggers: A new type of hackers", Information Systems Frontiers, pp.425~431 (2010)
- H. Woo, "A Content Analysis of Defaced Web Pages", Media Psychology, 6(1), pp.63~82 (2004)
- M. Milone, "Hacktivism: Securing the National Infrastructure", Knowledge, Technology & Policy, 16(1), pp.75~103 (2003)
- S. Begum, "Case-Based Reasoning Systems in the Health Sciences: A Survey of Recent Trends and Developments", Systems, Man, and Cybernetics, Part C: Applications and Reviews, IEEE Transactions on, 41(4), pp.421~434 (2011)
- Z. Yin, "On Development of Supplementary Criminal Analysis System Based on CBR and Ontology", Computer Application and System Modeling (ICCASM), 2010 International Conference on, pp.V14-653~V14-655 (2010)
- C.C. Chang, "Applying Case-Based Reasoning and Expert Systems to Coastal Patrol Crime Investigation in Taiwan", Intelligence and Security Informatics, pp.161~170 (2008)
- A.J. Pinizzotto, "Criminal Personality Profiling", Law and Human Behavior, 14(3), pp.215~233 (1990)
- K.L. Kaufman, "Subgroup Differences in the Modus Operandi of Adolescent Sexual Offender", Child Maltreat, pp.17~24 (1996)
- R.R. Hazelwooda, "Linkage analysis: modus operandi, ritual, and signature in serial sexual crime", Aggression and Violent Behavior, 9(3), pp.307~318 (2004)
- C. Bennell, "Between a ROC and a hard place: a method for linking serial burglaries by modus operandi", Journal of Investigative Psychology and Offender Profiling, 2(1), pp.23~41 (2005)
- B. Leclerc, "Modus Operandi and Situational Aspects in Adolescent Sexual Offenses Against Children: A Further Examination", International Journal of Offender Therapy and Comparative Criminology, 52(1), pp.46~61 (2008)
- H.K. Kim, "DSS for Computer Security Incident Response applying CBR and collaborative response", Expert Systems with Applications, 37(1), pp.852~870 (2010)
- "Typeface from Wikipedia, the free encyclopedia"[URL]
- "Cyber war blooming between Korea and japan on March 1, 2010 from Wikipedia, the free encyclopedia"[URL]
- "Hacking groups calling for 9/11 cyber atta cks against Israel, U.S"[URL]
- "Syria, Egypt crises spur escalation of ME cyber attacks"[URL]
- "Unknown group calling itself Whois Team 's html source, they attacked South Korea 's thriving Internet community"[URL]
- "Turkish hacking group defaces UPS, TheRegister, Acer, Telegraph, Vodafone on zone-h.org"[URL]
- "Windows-1524 from Wikipedia, the free encyclopedia"[URL]
- "ISO/IEC 8859-1 from Wikipedia, the free encyclopedia"[URL]
- "ICANN and IANA domains hijacked by Turkish on zone-h.org.crackers"[URL]