It is essential to build a practical environment of the training/test site for cyber training and weapon system test evaluation. In a military environment, cyber training sites should be continuously developed according to the characteristics of the military. Weapons with cyber security capabilities should be deployed through cyber security certification. Recently, each military has been building its own cyber range that simulates its battlefield environment. However, since the actual battlefield is an integrated operation environment, the cyber range built does not reflect the integrated battlefield environment that is interconnected. This paper proposes a configuration plan and operation function to construct a multi-cyber range reflecting the characteristics of each military to overcome this situation. In order to test the multi-cyber range, which has scenario authoring and operation functions, and can faithfully reflect reality, the impact of DDoS attacks is tested. It is a key to real-world mission-based test evaluation to ensure interoperability between military systems. As a result of the experiment, it was concluded that if a DDoS attack occurs due to the infiltration of malicious code into the military network, it may have a serious impact on securing message interoperability between systems in the military network. Cyber range construction technology is being developed not only in the military, but also in school education and businesses. The proposed technology can also be applied to the construction of cyber ranges in industries where cyber-physical systems are emphasized. In addition, it is a field that is continuously developing with the development of technology, such as being applied as an experimental site for learning machine learning systems.

North Korean cyber-attack groups such as Kimsuky, Lazarus, Andariel, and Venus 121 continue to attempt spear-phishing APT attacks that exploit social issues, including COVID-19. Thus, along with the worldwide pandemic of COVID-19, related threats also persist in cyberspace. In January 2022, a hacking attack, presumed to be Kimsuky, a North Korean cyber-attack group, intending to steal research data related to COVID-19. The problem is that the activities of cyber-attack groups are continuously increasing, and it is difficult to accurately identify cyber-attack groups and attack origins only with limited analysis information. To solve this problem, it is necessary to expand the scope of data analysis by using BGP archive data. It is necessary to combine infrastructure and network information to draw correlations and to be able to classify infrastructure by attack group very accurately. Network-based infrastructure analysis is required in the fragmentary host area, such as malware or system logs. This paper studied cyber ISR and BGP and a case study of cyber ISR visualization for situational awareness, hacking trends of North Korean cyber-attack groups, and cyber-attack tracking. Through related research, we estimated the origin of the attack by analyzing hacking cases through cyber intelligence-based profiling techniques and correlation analysis using BGP archive data. Based on the analysis results, we propose an implementation of the cyber ISR visualization method based on BGP archive data. Future research will include a connection with research on a cyber command-and-control system, a study on the cyber battlefield area, cyber ISR, and a traceback visualization model for the origin of the attack. The final R&D goal is to develop an AI-based cyber-attack group automatic identification and attack-origin tracking platform by analyzing cyber-attack behavior and infrastructure lifecycle.

ROS(Robot Operating System)는 로봇 소프트웨어 개발에 사용되는 일종의 프레임워크로서 무인화 시대를 맞이하여 다수의 로봇에서 현재 사용되고 있다. 2010년 ROS1.0이 발표 된 후 보안과 실시간성을 개선하기 위해서 DDS(Data Distribution Service) 미들웨어 기반의 ROS2가 발표되었다. ROS2는 DDS 기반으로 Publish-Subscribe(발행-구독) 메커니즘을 통해 통신하고 평문/암호통신도 가능하며 DDS 벤더간 통신도 가능하다. 이에 기존의 ROS2 성능 분석 논문이 발표되고 있고 주로 벤더간 통신 테스트, 평문/암호통신에 따른 지연시간/처리량, QoS 옵션별 오버헤드 등이 대부분이다. 본 논문에서는 ROS2의 암호통신이 그룹키 기반의 통신이 아니라 Pairwise 키 기반으로 수행된다는 점을 고려하여 Subscriber 수에 따른 통신시간을 실험하였다. 실험 결과 통신방법(평문/암호) 뿐 아니라 Subscriber 수에 따라 통신시간이 폭발적으로 증대됨을 확인하였다.

There was an error in the original publication

With the recent intensification of geopolitical tensions, cyber-attacks have become increasingly sophisticated and dynamic. Traditional machine learning-based anomaly detection techniques, which rely on pre-trained data, often suffer from performance degradation when exposed to novel attack types not seen during training. To address this limitation, this study proposes a continual learning-based anomaly detection framework capable of incrementally incorporating new attack patterns without forgetting previously learned information. The proposed method consists of three key stages: first, preprocessing and data augmentation are applied to construct high-quality, balanced datasets; second, a base anomaly detection model is trained; and third, new attack data are incrementally integrated to continuously update and evaluate the model. To enhance adaptability and efficiency, the framework incorporates Memory-LGBM, a lightweight architecture that combines a prototype-based memory module with a gradient-free LGBM classifier. The model maintains class-wise latent representations instead of raw samples, enabling compact, memory-efficient learning. Experimental results on the CICIDS 2017 dataset demonstrate that the proposed approach outperforms existing continual learning methods in accuracy, adaptability, and resistance to forgetting, making it a practical and scalable solution for real-world anomaly detection scenarios that demand rapid adaptation, strong knowledge retention, and low computational overhead.