Jaehan Kim

Blockchain technology has ushered in a transformative paradigm of decentralized and transparent systems, offering innovative solutions across diverse sectors. While these systems strive for unparalleled transparency and trustlessness in a fully distributed framework, permissionless blockchains, such as Bitcoin and Ethereum, encounter vulnerabilities due to their intrinsically public nature. Addressing these vulnerabilities, the emergence of permissioned blockchains presents a fortified alternative, incorporating rigorous access controls and authentication protocols to ensure participation exclusivity and transaction confidentiality. Nevertheless, a keen observation reveals that, despite encryption, the operational traffic within these blockchains manifests distinct time-series patterns and operational relations during sensitive data exchanges. Such patterns hold the potential to inadvertently expose critical details about the network, encompassing its topology and the operational dependencies among nodes. In light of this revelation, we introduce a pioneering blockchain fingerprinting mechanism, denoted as gShock. This system meticulously analyzes periodic patterns and the context of operational relations from the collected blockchain network traffic. It employs a Graph Neural Network (GNN)-based model, adept at capturing the intricate characteristics innate to specialized blockchain operations. Through empirical experiments conducted in a realistic permissioned blockchain environment, comprising various nodes, we ascertain that gShock demonstrates a remarkable proficiency in classifying blockchain operational traffic with an F-1 score of ≥ 96% and identifying individual dependencies with a macro F-1 score of ≥ 93%.

Cryptocurrencies have increasingly been used as a medium for illicit financial activities by criminals. Annually, billions of dollars’ worth of Bitcoin penetrate cryptocurrency exchanges. Despite the critical need for advanced Bitcoin financial forensics to investigate these criminal activities, no novel methods have been developed to detect illicit Bitcoin operations. Existing approaches to identifying illegal Bitcoin activity are fundamentally limited due to their inadequate consideration of graph data. To address these limitations, we present a novel approach, Hyperedge Classification, to detect illegal transactions with greater precision. This approach introduces a novel cluster-based Hyperedge-Node Switching technique, which enables effective hyperedge classification and visualization of hyperedge relationships. Additionally, we propose a framework named CENSor, which offers more powerful and robust detection capabilities compared to traditional techniques for both illegal entity detection and illegal transaction detection. Our cluster-based Hyperedge-Node Switching technique demonstrates a tenfold improvement in the F1-score compared to previous graph-based methods. Moreover, CENSor visualizes the Bitcoin cluster graph and the Hyperedge-Node switched graph, highlighting the importance of utilizing appropriate graph information in Bitcoin analysis.

Containers have become the predominant virtualization technique for deploying microservices in cloud environments. However, container networking, critical for microservice functionality, often introduces significant overhead and resource consumption, potentially degrading the performance of microservices. This challenge arises from the complexity of the software-based network data plane, responsible for network virtualization and access control within container traffic. To tackle this challenge, we propose Hyperion , a novel hardware-based container networking system that prioritizes high performance and security. Leveraging smartNICs, commonly found in cloud environments, Hyperion implements a fully-functional container network data plane, encompassing network virtualization and access control. It also has the capability to dynamically optimize its data plane for agile responses to frequent changes in container environments, ensuring up-to-date data plane operation. This hardware-based design empowers Hyperion to significantly improve the overall container networking performance without relying on the host system resources. Notably, Hyperion seamlessly integrates with existing containerized applications without necessitating modifications. Our evaluation shows that compared to state-of-the-art solutions, Hyperion achieves significant improvements in HTTP container communication latency and throughput by up to 2.25x and 4.3x, respectively. Furthermore, it reduces CPU utilization associated with container networking by up to 4x.

Software-defined wide area network (SD-WAN) has emerged as a new paradigm for steering a large-scale network flexibly by adopting distributed software-defined network (SDN) controllers. The key to building a logically centralized but physically distributed control-plane is running diverse cluster management protocols to achieve consistency through an exchange of control traffic. Meanwhile, we observe that the control traffic exposes unique time-series patterns and directional relationships due to the operational structure even though the traffic is encrypted, and this pattern can disclose confidential information such as control-plane topology and protocol dependencies, which can be exploited for severe attacks. With this insight, we propose a new SD-WAN fingerprinting system, called Heimdallr. It analyzes periodical and operational patterns of SD-WAN cluster management protocols and the context of flow directions from the collected control traffic utilizing a deep learning-based approach, so that it can classify the cluster management protocols automatically from miscellaneous control traffic datasets. Our evaluation, which is performed in a realistic SD-WAN environment consisting of geographically distant three campus networks and one enterprise network shows that Heimdallr can classify SD-WAN control traffic with ≥ 93%, identify individual protocols with ≥ 80% macro F-1 scores, and finally can infer control-plane topology with ≥ 70% similarity.

최근 검·경수사권 조정에 관한 정부의 입장에는 자치경찰제 운영에 관한 내용도 함께 수록되었다. 자치경찰제는 과거로부터 논의가 지속되어 왔지만, 중앙정부에 집중되어 있던 경찰행정의 권한을 지방에 분산시켜 지역주민의 입장을 반영하고 지역사회의 실정에 맞는 치안서비스와 대민서비스를 제공하기 위한 노력의 성과는 쉽게 나타나지 않았다. 현 정부의 등장과 함께 권력기관에 대한 개혁의 바람이 불기 시작하였고, 그동안 불공정 사례와 권한남용의 상처를 남긴 검찰권력에 대한 개혁의 일환으로 수사권 조정 등이 이루어지면서 자치경찰제의 도입에 관한 논의가 본격적으로 진행되었다. 결국 2020년 12월 31일부로 「경찰법」이 폐지되고, 「국가경찰과 자치경찰의 조직 및 운영에 관한 법률」로 전부 개정되어 2021년 1월 1일부터 시행되고 있다. 그러나 자치경찰제에 대해서는 여전히 비판과 우려의 목소리가 많은 것이 사실이다. 특히 광역단체장, 국회, 지역 정치인 등 지역토착세력에 대한 정치적 중립성 확보방안에 대한 문제가 가장 많이 거론되고 있으며, 초기 단계에서 발생할 수 있는 시민에 대한 여러 유형의 인권침해 문제, 그리고 국가경찰과 자치경찰의 사무분배나 사건의 책임소재에 대한 문제와 자치경찰제 운영을 위한 재정부담의 문제 등이 제기되고 있다. 본 연구에서는 선행 연구에서 언급한 여러 대안들을 살펴보면서 국민에게 신뢰받을 수 있는 자치경찰제도의 정착이 이루어질 수 있는 해결책들을 모색해 보았다. 앞으로 운영될 자치경찰제도와 관련하여 새로운 제도 도입으로 발생할 수 있는 혼란을 최소화 하고자 노력해야 할 것이며, 지역주민들과 함께 소통하면서 서로 이해하는 과정을 끊임없이 가져야 할 것이다.