Kiwook Sohn

A Study on MITM (Man in the Middle) Vulnerability in Wireless Network Using 802.1X and EAP

The security of wireless LAN is being strengthened through a combination of EAP with an 802.1X-based authentication server, with 802.11i as the standard. As such a security technique effectively defends the existing WEP or protocol vulnerabilities, another approach is needed to prove the vulnerability of the wireless LAN. This paper proposes the wireless MITM (man in the middle) framework, which can actively prove the vulnerability of MITM by applying the MITM technique in the wireless LAN environment, whose security is applied using 802.1X and EAP. It also describes the designing of the required functions and modules. This paper proposes that it is possible to collect the wireless LAN authentication information of the unauthorized user using the designed wireless MLTM-framework under the EAP-MD5 and EAP-TTLS environment.

Learning decision trees with taxonomy of propositionalized attributes

We introduce Propositionalized Attribute Taxonomy guided Decision Tree Learner (PAT-DTL), an inductive learning algorithm that exploits a taxonomy of propositionalized attributes as prior knowledge to generate compact decision trees. Since taxonomies are unavailable in most domains, we also introduce Propositionalized Attribute Taxonomy Learner (PAT-Learner) that automatically constructs taxonomy from data. Our experimental results on UCI repository data sets show that the proposed algorithms can generate a decision tree that is generally more compact than and is often comparably accurate to those produced by standard decision tree learners.

WebVaccine: A Client-Side Realtime Prevention System against Obfuscated Malicious Web Pages

As a solution for malicious web page attacks, we need a client-side prevention system with deobfuscation mechanism. In this paper we introduce WebVaccine, that is a client-side real-time prevention system against obfuscated malicious web pages. For secure web surfing, before the navigation to be completed, WebVaccine inserts a deobfuscation function call routine prior to the vulnerable script functions in malicious web pages, and makes the inserted function to extract the deobfuscated script string so that the string can be analyzed by a signature based detection subsystem or third party detection tools. We rest assured that the WebVaccine framework does not affect the execution of dynamic script interpretation while running web browsers and is likely to be of success.

Detecting and Guarding against Kernel Backdoors through Packet Flow Differentials

SUMMARY In this paper, we present a novel technique to detect and defeat kernel backdoors which cannot be identified by conventional security solutions. We focus on the fact that since the packet flows of common network applications go up and down through the whole network subsystem but kernel backdoors utilize only the lower layers of the subsystem, we can detect kernel backdoors by employing two host-based monitoring sensors (one at higher layer and the other at lower layer) and by inspecting the packet flow differentials. We also provide strategies to mitigate false positives and negatives and to defeat kernel backdoors. To evaluate the effectiveness of the proposed technique, we implemented a detection system (KbGuard) and performed experiments in a simulated environment. The evaluation results indicate that our approach can effectively detect and deactivate kernel backdoors with a high detection rate. We also believe that our research can help prevent stealthy threats of kernel backdoors.