KR20210154050A - Method and apparatus for implementation of playbook-style penetration simulator - Google Patents

Abstract

A device for implementing a simulated attack tool in a playbook form according to one embodiment includes: a scenario creation unit which compiling a plurality of unit attack modules including attack commands of each attack step according to a cyber kill chain, creating a simulated attack scenario in a cyber attack playbook form, and storing the same in an attack scenario database; an environment management unit which installs a management tool corresponding to equipment in a virtual environment network where the simulated attack scenario operates; and an attack execution unit which executes the simulated attack scenario in the virtual environment network through the management tool and stores a simulated attack execution result in the simulation attack execution result database. According to the present invention, a lot of combinations of attack scenarios can be arbitrarily created by users.

Description

Apparatus and method for implementing a simulation attack tool in the form of a playbook

The present invention relates to an apparatus and method for implementing a simulation attack tool, and more particularly, to an apparatus and method for implementing a simulation attack tool in the form of a playbook.

The simulation attack tool is mainly used to generate a periodic attack signal when testing the defense capability of the defense system or testing the function of the attack data collection system. For the convenience of attack automation, these mod attack tools often perform unit attacks that perform only one stage of the cyber kill chain stage. And, in the case of a simulated attack tool that uses an attack scenario created by tying unit attacks, the attack data that can be collected by using a limited set of attack elements in advance is limited. In other words, it is difficult to implement the attack form that uses the recent chain and various attack techniques represented by the intelligent continuous attack as a simulated attack tool.

Korean Patent Publication No. 10-1560297 (Registered on Oct. 7, 2015)

According to one embodiment, an apparatus and method for implementing a simulation attack tool are provided so that an attack scenario of countless combinations can be easily created by implementing the simulation attack tool in the form of a playbook.

The problems to be solved of the present invention are not limited to those mentioned above, and other problems to be solved that are not mentioned will be clearly understood by those of ordinary skill in the art to which the present invention belongs from the following description.

The device for implementing a simulated attack tool in the form of a playbook according to the first aspect creates an attack by creating a simulated attack scenario in the form of a cyber attack playbook by tying a plurality of unit attack modules including an attack command for each attack stage according to the cyber kill chain. A scenario generation unit for storing the scenario database, an environment management unit for installing a management tool corresponding to equipment in a virtual environment network in which the simulated attack scenario operates, and an environment management unit for installing the simulated attack scenario in the virtual environment network through the management tool and an attack execution unit that stores the result of performing the simulation attack in the simulation attack execution result database.

The method for implementing a simulated attack tool performed by the apparatus for implementing a simulated attack tool in the form of a playbook according to the second aspect is a cyber attack playbook form by weaving a plurality of unit attack modules including an attack command for each attack stage according to a cyber kill chain. generating a simulated attack scenario by using the method; to obtain a result of performing a mock attack.

According to the third aspect, a computer readable recording medium storing a computer program is, when the computer program is executed by a processor, by tying a plurality of unit attack modules including an attack instruction for each attack step according to the cyber kill chain. Creating a simulated attack scenario in the form of a cyber attack playbook, installing a management tool corresponding to equipment in a virtual environment network in which the simulated attack scenario operates, and managing the simulated attack scenario through the management tool and instructions for causing the processor to perform a method including obtaining a result of performing a simulated attack by performing it in a virtual environment network.

According to the fourth aspect, when the computer program stored in the computer readable recording medium is executed by the processor, a plurality of unit attack modules including the attack instruction of each attack stage according to the cyber kill chain are bound to form a cyber attack playbook. generating a simulated attack scenario by using the method; and an instruction for causing the processor to perform a method comprising the step of obtaining a result of performing a mock attack.

According to an embodiment, the simulation attack tool is implemented in the form of a playbook to easily create countless combinations of attack scenarios. In other words, users can arbitrarily create countless combinations of attack scenarios just by adjusting the unit attacks placed in each attack step little by little. In addition, even in a scenario that has already been created, different results can be obtained even if the same scenario is performed by adjusting the environment to which the scenario is applied or by manipulating variables in detailed commands. In addition, when performing a scenario, it can produce an effect similar to an advanced persistent attack because it is performed while diversifying the actions according to the cyber kill chain stage.

1 is a block diagram of an apparatus for implementing a mock attack tool in the form of a playbook according to an embodiment of the present invention.
FIG. 2 is an exemplary diagram of a virtual environment network in which a simulated attack scenario operates in an apparatus for implementing a simulated attack tool in the form of a playbook according to an embodiment of the present invention.
3 to 5 are flowcharts for explaining a method for implementing a simulation attack tool performed by an apparatus for implementing a simulation attack tool in the form of a playbook according to an embodiment of the present invention.

Advantages and features of the present invention and methods of achieving them will become apparent with reference to the embodiments described below in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various different forms, and only these embodiments allow the disclosure of the present invention to be complete, and common knowledge in the art to which the present invention pertains It is provided to fully inform those who have the scope of the invention, and the present invention is only defined by the scope of the claims.

Terms used in this specification will be briefly described, and the present invention will be described in detail.

The terms used in the present invention have been selected as currently widely used general terms as possible while considering the functions in the present invention, but these may vary depending on the intention or precedent of a person skilled in the art, the emergence of new technology, and the like. In addition, in a specific case, there is a term arbitrarily selected by the applicant, and in this case, the meaning will be described in detail in the description of the corresponding invention. Therefore, the term used in the present invention should be defined based on the meaning of the term and the overall content of the present invention, rather than the name of a simple term.

When a part 'includes' a certain component throughout the specification, this means that other components may be further included, rather than excluding other components, unless otherwise stated.

In addition, the term 'unit' used in the specification means software or hardware components such as FPGA or ASIC, and 'unit' performs certain roles. However, 'part' is not limited to software or hardware. The 'unit' may be configured to reside on an addressable storage medium and may be configured to refresh one or more processors. Thus, as an example, 'part' refers to components such as software components, object-oriented software components, class components, and task components, processes, functions, properties, procedures, subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays and variables. Functions provided within components and 'units' may be combined into a smaller number of components and 'units' or further divided into additional components and 'units'.

Hereinafter, with reference to the accompanying drawings, the embodiments of the present invention will be described in detail so that those of ordinary skill in the art can easily implement them. And in order to clearly explain the present invention in the drawings, parts irrelevant to the description will be omitted.

1 is a block diagram of an apparatus for implementing a mock attack tool in the form of a playbook according to an embodiment of the present invention.

Referring to FIG. 1 , an apparatus 100 for implementing a simulated attack tool in the form of a playbook includes a scenario generating unit 110 , an environment management unit 120 , and an attack execution unit 130 .

The scenario generator 110 creates a simulated attack scenario in the form of a cyber attack playbook by weaving a plurality of unit attack modules 111 including an attack command of each attack stage according to the cyber kill chain, and is stored in the attack scenario database 112. Save. Here, the attack scenario database 112 may be included as a configuration of the scenario generator 110 or may be separated into a separate configuration as illustrated in FIG. 1 . In addition, each unit attack of the unit attack module 111 is a command command input from the target device, and in some cases, a file or code added by an attacker may be used.

The scenario generator 110 may further include a scenario creation module 113 and an attack result management module 114 . The scenario creation module 113 creates a simulated attack scenario by tying two or more of the plurality of unit attack modules 111 . The attack result management module 114 codes and stores the result of each unit attack corresponding to the plurality of unit attack modules 111 , and provides the result of the preceding attack among the unit attacks.

The environment management unit 120 installs a management tool corresponding to the equipment in the virtual environment network in which the simulated attack scenario operates. For example, in the virtual environment network managed by the environment management unit 120 , as shown in the example of FIG. 2 , an agent is installed in a server and a PC, respectively, and the server, the PC, and the agent may be interconnected through a switch.

The environment management unit 120 may include an environment creation module 121 and an environment control module 122 .

The environment creation module 121 creates a new device in the virtual environment network. The environment control module 122 installs corresponding management tools to control new or existing equipment, and restores the virtual environment network to the state before the simulated attack after the simulated attack according to the simulated attack scenario ends.

The attack execution unit 130 performs the simulation attack scenario in the virtual environment network through the management tool and stores the result of the simulation attack in the simulation attack execution result database 131 . That is, the attack execution unit 130 interlocks the scenario generation unit 110 and the environment management unit 120 to manage a simulated attack actually performed in the virtual environment.

The attack performing unit 130 may further include an attack control module 132 . The attack control module 132 performs a simulated attack by placing a simulated attack scenario in a virtual environment network and designating a variable to be entered into an attack command.

Among the configurations of the playbook-type simulation attack tool implementation apparatus 100 illustrated in FIG. 1 , the scenario creation module 113 , the attack result management module 114 , the environment control module 122 , and the attack control module 132 are It may include a computing means such as a microprocessor (microprocessor). The attack scenario database 112 and the simulation attack execution result database 131 include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and flops. It may be a computer-readable recording medium, such as a magneto-optical medium such as a optical disk, a hardware device specially configured to store and execute program instructions such as a flash memory, or the like.

3 to 5 are flowcharts for explaining a method for implementing a simulation attack tool performed by the apparatus 100 for implementing a simulation attack tool in the form of a playbook according to an embodiment of the present invention.

Hereinafter, a simulation attack tool implementation method performed by the playbook-type simulation attack tool implementation apparatus 100 according to an embodiment of the present invention will be described with reference to FIGS. 1 to 5 .

First, the scenario creation module 113 of the scenario generator 110 creates a simulated attack scenario in the form of a cyber attack playbook by weaving a plurality of unit attack modules 111 including an attack command for each attack stage according to the cyber kill chain. and stores the generated simulated attack scenario in the attack scenario database 112 . Here, the cyber attack playbook form means that it includes IP addresses, URLs, domains, DNS queries, as well as various elements and attack techniques used for attacks ( 301 ).

Then, the environment creation module 121 of the environment management unit 120 installs a management tool corresponding to the equipment in the virtual environment network in which the simulated attack scenario generated in 301 by the scenario generation unit 110 operates (302) .

Then, the attack control module 132 of the attack execution unit 130 performs the simulated attack by performing the simulated attack scenario generated in 301 in the virtual environment network through the management tool installed in 302, and returns the result of the simulated attack. obtained and stored in the simulation attack execution result database 131 . Here, when the attack control module 132 obtains the result of performing the simulated attack, the simulated attack scenario may be placed in the virtual environment network and variables to be entered into the attack command may be designated to perform the simulated attack ( 303 ).

Meanwhile, when generating the simulated attack scenario, the scenario creation module 113 may create a simulated attack scenario by tying two or more of the plurality of unit attack modules 111 ( 401 ). Then, the scenario creation module 113 codes and stores the results of each unit attack corresponding to the plurality of unit attack modules 111 (402), and stores the result of the unit attack by the preceding attack among the unit attacks by 303. It can be provided upon request (403).

Also, when the management tool is installed, the environment creation module 121 may create new equipment in the virtual environment network ( 501 ). In addition, the environment control module 122 may install corresponding management tools to control new or existing equipment ( 502 ). Then, the environment control module 122 may restore the virtual environment network to the state before the mock attack after the simulation attack according to the simulated attack scenario is finished ( 503 ).

Looking at the simulation attack execution process by the attack control module 132 as described above in more detail, the environment management unit 120 designates an environment in which the simulated attack is to be performed, and the scenario generator 110 selects the attack scenario to be performed. specify Here, when determining a simulated attack scenario, the variables or attack targets of each unit attack constituting the scenario can be designated in order according to the cyber kill chain stage, and whether to restore to the initial state after the attack is performed can be determined.

In this way, when the environment and scenario settings are completed, the simulation attack is performed according to the command of the specified scenario, and all processes in which each attack is executed in the environment and the result is output are stored in the simulation attack execution result database 131 .

As such, when one simulated attack is completed and the simulation attack execution result is stored in the database 131 , the attack control module 132 may then perform a re-attack by reflecting the settings of the corresponding simulated attack as it is.

On the other hand, each step included in the discount service method according to the above-described embodiment may be implemented in a computer-readable recording medium for recording a computer program including instructions for performing such a step.

In addition, each step included in the discount service method according to the above-described embodiment may be implemented in the form of a computer program stored in a computer-readable recording medium programmed to include instructions for performing these steps.

As described so far, the simulation attack tool is implemented in the form of a playbook so that countless combinations of attack scenarios can be easily created. In other words, users can arbitrarily create countless combinations of attack scenarios just by adjusting the unit attacks placed in each attack step little by little. In addition, even in a scenario that has already been created, different results can be obtained even if the same scenario is performed by adjusting the environment to which the scenario is applied or by manipulating variables in detailed commands. In addition, when performing a scenario, it can produce an effect similar to an advanced persistent attack because it is performed while diversifying the actions according to the cyber kill chain stage.

Combinations of each step in each flowchart attached to the present invention may be performed by computer program instructions. These computer program instructions may be embodied in a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment, such that the instructions performed by the processor of the computer or other programmable data processing equipment provide the functions described in each step of the flowchart. It creates a means to do these things. These computer program instructions may also be stored in a computer-usable or computer-readable medium that may direct a computer or other programmable data processing equipment to implement a function in a particular manner, and thus the computer-usable or computer-readable medium. The instructions stored in the recording medium are also capable of producing an article of manufacture including instruction means for performing the functions described in each step of the flowchart. The computer program instructions may also be mounted on a computer or other programmable data processing equipment, such that a series of operational steps are performed on the computer or other programmable data processing equipment to create a computer-executed process to create a computer or other programmable data processing equipment. It is also possible that instructions for performing the processing equipment provide steps for performing the functions described in each step of the flowchart.

Further, each step may represent a module, segment, or portion of code comprising one or more executable instructions for executing the specified logical function(s). It should also be noted that in some alternative embodiments it is also possible for the functions recited in the steps to occur out of order. For example, it is possible that two steps shown one after another may in fact be performed substantially simultaneously, or that the steps may sometimes be performed in the reverse order according to the corresponding function.

The above description is merely illustrative of the technical spirit of the present invention, and various modifications and variations will be possible without departing from the essential quality of the present invention by those skilled in the art to which the present invention pertains. Accordingly, the embodiments disclosed in the present invention are not intended to limit the technical spirit of the present invention, but to explain, and the scope of the technical spirit of the present invention is not limited by these embodiments. The protection scope of the present invention should be interpreted by the following claims, and all technical ideas within the scope equivalent thereto should be interpreted as being included in the scope of the present invention.

100: device for implementing a simulated attack tool
110: Scenario Saint Part
111: unit attack module
112: Attack Scenario Database
113: Scenario Creation Module
114: attack result management module
120: Environmental Management Department
121: environment creation module
122: environmental control module
130: attack execution unit
131: Simulation attack execution result database
132: attack control module

Claims (12)

A scenario generator for creating a simulated attack scenario in the form of a cyber attack playbook by tying a plurality of unit attack modules including an attack command for each attack stage according to the cyber kill chain and storing it in the attack scenario database;
an environment management unit that installs a management tool corresponding to the equipment in the virtual environment network in which the simulated attack scenario operates;
and an attack execution unit configured to store a result of performing the simulated attack by performing the simulated attack scenario in the virtual environment network through the management tool in a simulated attack execution result database.
A device for implementing a mock attack tool in the form of a playbook. The method of claim 1,
The scenario generator,
a scenario creation module for creating the simulated attack scenario by tying two or more of the plurality of unit attack modules;
and an attack result management module that codes and stores results of each unit attack corresponding to the plurality of unit attack modules and provides results of a preceding attack among the unit attacks.
A device for implementing a mock attack tool in the form of a playbook. 3. The method of claim 2,
The environmental management unit,
an environment creation module for creating new equipment in the virtual environment network;
Comprising an environment control module for installing the management tools corresponding to each so as to control the new equipment or the existing equipment
A device for implementing a mock attack tool in the form of a playbook. 4. The method of claim 3,
The environment control module is configured to restore the virtual environment network to a state before the simulated attack after the simulated attack according to the simulated attack scenario is terminated.
A device for implementing a mock attack tool in the form of a playbook. 4. The method of claim 3,
The attack execution unit,
An attack control module for disposing the simulated attack scenario in the virtual environment network and performing a simulated attack by designating a variable included in the attack command
A device for implementing a mock attack tool in the form of a playbook. A method for implementing a simulated attack tool performed by a playbook-type simulated attack tool implementation device, comprising:
Creating a simulated attack scenario in the form of a cyber attack playbook by tying a plurality of unit attack modules including an attack command for each attack stage according to the cyber kill chain;
installing a management tool corresponding to the equipment in the virtual environment network in which the simulated attack scenario operates;
performing the simulated attack scenario in the virtual environment network through the management tool to obtain a result of performing the simulated attack
How to implement a mock attack tool in the form of a playbook. 7. The method of claim 6,
The step of generating the simulated attack scenario comprises:
creating the simulated attack scenario by tying two or more of the plurality of unit attack modules;
coding and storing the results of each unit attack corresponding to the plurality of unit attack modules;
A step of providing a result of the unit attack by a preceding attack among the unit attacks
How to implement a mock attack tool in the form of a playbook. 8. The method of claim 7,
The step of installing the management tool is,
creating a new device in the virtual environment network;
and installing the corresponding management tools to control the new or existing equipment.
How to implement a mock attack tool in the form of a playbook. 9. The method of claim 8,
After the simulated attack according to the simulated attack scenario is terminated, the method further comprising the step of restoring the virtual environment network to a state before the simulated attack.
How to implement a mock attack tool in the form of a playbook. 8. The method of claim 7,
The step of obtaining the result of performing the mock attack includes:
Placing the simulated attack scenario in the virtual environment network and performing a simulated attack by designating a variable to enter the attack command
How to implement a mock attack tool in the form of a playbook. As a computer-readable recording medium storing a computer program,
When the computer program is executed by a processor,
Creating a simulated attack scenario in the form of a cyber attack playbook by tying a plurality of unit attack modules including an attack command for each attack stage according to the cyber kill chain;
installing a management tool corresponding to the equipment in the virtual environment network in which the simulated attack scenario operates;
and instructions for causing the processor to perform a method including obtaining a result of performing the simulated attack by performing the simulated attack scenario in the virtual environment network through the management tool. As a computer program stored in a computer-readable recording medium,
The computer program, when executed by a processor,
Creating a simulated attack scenario in the form of a cyber attack playbook by tying a plurality of unit attack modules including an attack command for each attack stage according to the cyber kill chain;
installing a management tool corresponding to the equipment in the virtual environment network in which the simulated attack scenario operates;
and instructions for causing the processor to perform a method including obtaining a result of performing the simulated attack by performing the simulated attack scenario in the virtual environment network through the management tool.

Images