1 CURELAN TECHNOLOGY Co., LTD Flowviewer FM-800A CURELAN TECHNOLOGY Co., LTD

Slow response time Do Hackers Attack ？ 2

Why do Hackers Attack ？ Steal private data & credit card info 3

The Blind Spot of the IPS Equipment Feature code scheme (pattern) High error rate on the threshold setting function False Positives 4

Cyber-Intrusion== Cyber-Attack Cyber-Intrusion V.S. Attack Robber Huge Traffic / Sessions Not care being discovered 5 Cyber-Intrusion Cyber-Attack Thief Small packet Not like to be discovered

The Blind Spot of the IPS Equipment The Amount of TrafficA Number of Sessions

Network Behavior Anomaly Detection (NBAD) Detect & block attacks automatically 7 NBAD Technology Flowviewer is 64 bit solution NBAD Technology Flowviewer is 64 bit solution Picture provided by : free vector graphics Version 1 Version 2 ? TRUE ? FALSE ? High Error Rate High Error Rate

Packets Sessions (Flows) Protocol Transport protocol port Time Duration Destination IP address Source IP address Traffic Info Collected Real-Time Data Collected From The Flowviewer FM-800A

Intrusion Port scan SSH RDP Worm Attack UDP Flood Attack DOS Attack DNS Attack NTP Attack Detect and Block Intrusion & Attack

Math Formula 10 S: session P src n : source port number P dst n : destination port number T n : some time ∵ ∵

IPS ( Intrusion prevention system ) of DoS Protection Profile Threshold Function UDP_SRC_Session default 5,000 session/ second UDP_DST_Session default 5,000 session/ second UDP_Flood default 2,000 packets/ second 11

Real Case 1 A University: Event Time, 2014 / 05 / 27 05:00-06:00 12

IPS Threshold : default 5,000 session / sec Hacker can avoid IPS detection 13 The maximum session of attack is 743. Hacker can avoid IPS detection.

Real Case 2 B University: Event Time, 2015 / 07 / 21 22:00-23:00 14

IPS Threshold : default 5,000 session / sec Hacker can avoid IPS detection 15 The maximum session of attack is Hacker can avoid IPS detection.