KR100851521B1 - Cyber Attack System for Vulnerability Assessment and Method Thereof - Google Patents

Abstract

As a security technology for a network system, the present invention relates to a cyber attack system that provides an active and automated integrated cyber attack model for detecting and analyzing vulnerabilities inherent in a network and a system. Attack execution agent means for conducting cyber attack for vulnerability detection or analysis of system, attack control means for setting attack purpose, managing necessary information for attack, control for attack, information collecting agent for collecting attack target information Means, information analysis means for analyzing target information, cyber attack management means for selecting main attack points and generating attack scenarios, attack damage evaluation means for analyzing attack performance and evaluating the success or damage of the target. Prepare a configuration.

By using the cyber attack system and its attack method for analyzing the above vulnerabilities, it is designed by analyzing the attack patterns and characteristics of the actual cyber attackers, so it is possible to detect the vulnerabilities inherent in the network and the system by actually simulating on the network. Do.

Vulnerability, Cyber Attack, OODA LOOP, Information Warfare, Simulation, Scenario

Description

Cyber Attack System for Vulnerability Assessment and Method Thereof}

1 is a block diagram showing a cyber attack system for vulnerability analysis according to an embodiment of the present invention;

2 is a flowchart illustrating a cyber attack method for vulnerability analysis according to an embodiment of the present invention;

3 is a view showing an example of an attack target information according to an embodiment of the present invention,

4 is a view showing an example of an attack pattern according to an embodiment of the present invention,

5 is a view showing an example of an attack tree according to an embodiment of the present invention;

6 illustrates an attack pattern of a denial of service attack according to an embodiment of the present invention;

7 is a view showing an attack tree according to an embodiment of the present invention;

8 is a diagram showing an attack tree when the attack control means 20 performs control according to an embodiment of the present invention;

9 is a view showing the attack success probability for each node in the UDP attack and ICMP attack according to an embodiment of the present invention.

Explanation of symbols on the main parts of the drawings

10: attack execution agent means 20: attack control means

30: information collecting agent means 40: information analysis means

41: target information analysis unit 42: information DB

50: cyber attack management means 51: target development analysis

52: Vulnerability DB 53: Attack Scenario Analysis Department

54: Attack Scenario DB 60: Attack Damage Evaluation Means

The present invention relates to a cyber attack system for vulnerability analysis and an attack method thereof, and more particularly, to an active and automated integrated cyber attack model that can detect and analyze vulnerabilities inherent in networks and systems as security technology for network systems. It provides a cyber attack system and its attack method.

As information technology develops, dependence on network and system is increasing and security is increasing. Cyber attackers are attacking with sophisticated and intelligent hacking techniques using vulnerabilities inherent in the target network and system to achieve their specific purpose. As a result, automated tools such as vulnerability analysis tools and risk analysis tools for the detection of vulnerabilities inherent in networks and systems are being developed, and researches on the characteristics, patterns, and types of cyber attacks and the corresponding technology It is actively underway. However, these automated tools alone cannot provide information on how the discovered vulnerabilities are used in cyber attacks and what types of attacks they can cause. In addition, it is difficult to block the attack during the attack because the attack pattern is not known until the attack is terminated.

As a result, in recent years, research has been conducted to analyze actual patterns and characteristics of attackers and establish appropriate security countermeasures by modeling behavior patterns of attackers. . Sushil Jaiodia's 'Surviving Information Warfare Attacks' released in 1999 and Nong Ye's 'A Process Control Approach Cyber Attack Detection' released in 2001 categorized cyber attacks and provided countermeasures. Gregg Schudel's Modeling Behavior of the Cyber-Terrorist, published in 2000, provides definitions and procedures for cyber attackers. T.Tidwell's Modeling Internet Attacks and Andrew P. Moore's Attack Modeling for Information Security and Survivability, published in 2001, discuss the research carried out on attack scenarios based on attack patterns and trees. Presented.

As such, an example of cyber attack model technology is disclosed in Korean Patent Registration Publication No. 0505339 (registered on July 25, 2005, information warfare simulation apparatus and method using a client-server model).

The technology disclosed in the Republic of Korea Patent Registration No.0505339 relates to an information warping simulation device and method using a client-server model that can effectively experiment with various attack and defense technologies used in information warfare. It consists of a simulation server that constructs a network based on a database and simulates information and attack scenarios according to the user's command, and a simulation studio that provides the user's commands and data to the simulation server and provides the user with simulation results from the simulation server. It is described. That is, in the technique disclosed in the publication No. 5053539, the modeling method for the information warfare simulation is improved to establish the information warfare research base and obtain data through the implementation of the simulator, and to construct various network environments and scenarios in a short time to simulate the simulation. This paper describes the information warfare simulation apparatus and method using a client-server model that can effectively prepare for the actual expected war situation.

However, in the technique disclosed in the Republic of Korea Patent Publication No. 5053539, there was a problem that the detailed attack process was not considered.

In addition, the above-mentioned papers and techniques in the field of conventional cyber attack models focus on the characteristics of partial attacks such as attacker's behavioral characteristics, attack scenario, attack type classification, attack pattern analysis, or single vulnerability rather than integrated cyber attack model. There was a problem that was limited to simple modeling.

An object of the present invention is to solve the problems described above, and propose a complete attack process for the cyber attack model, and provides a vulnerability analysis that provides an active and automated cyber attack model that can detect and analyze the vulnerability of the system. To provide a cyber attack system and its attack method. In other words, the present invention provides an active and automated integrated cyber attack system capable of performing reconnaissance, attack targets, attack scenarios, attack control, and post-assessment, and an attack method thereof.

Another object of the present invention is to provide a cyber attack system capable of reducing transmission load and concealing an attack procedure by assigning a sequence number to an attack scenario and an attack method thereof.

Another object of the present invention is to select the optimal scenario by applying the probability of aggression, the cycle control process (Observe: Observation-Orient: Analysis-Decide: Decision-Act: Action Loop, OODA LOOP) ), It provides a cyber attack system and its attack method that reduce the operation time of the attack and reduce the overload on the agent task. In other words, by applying the OODA LOOP, it is possible to actively control the attack execution agent such as retrying, changing, and canceling the attack without administrator intervention or time delay.

Another object of the present invention is to provide a cyber attack system and an attack method that enhance the expertise by separating the agents responsible for information collection and attack from each other, and applying an agent system for each agent function. In addition, the task load and time of the agent can be reduced by separating the reconnaissance agent and the attack agent and giving autonomous agent characteristics.

Another object of the present invention is to separate the agents responsible for collecting and attacking information, and to analyze the vulnerabilities of the target system to develop accurate attack scenarios and achieve the objectives of the attack, the most vulnerable of them, and the damage caused by the attack. It provides a cyber attack system using an attack point (Main Point of Impact, MPI) and its attack method.

Another object of the present invention is to provide a cyber attack system and its attack method that can reduce the detection probability from the target system by giving an attack time limit to each attack step.

Another object of the present invention is to provide a cyber attack system and its attack method that can analyze the post-attack attack procedure and damage assessment through post-evaluation and improve the attack process.

In order to achieve the above object, the cyber attack system for vulnerability analysis according to the present invention is an automation agent, which sets an attack execution agent means for performing a cyber attack for detecting or analyzing a vulnerability of a network or a computing system, and sets an attack purpose. Attack control means for managing information and controlling the attack according to the request of the attack execution agent means, information collecting agent means for collecting the target information necessary to achieve the attack target, analyzing the target information Information analysis means, and cyber attack management means for selecting a main attack point using the analyzed target information and generate an attack scenario, wherein the cyber attack management means analyzes the vulnerability of the target to attack and the target The most damage to the target An attack that generates and analyzes the attack scenario using a target development analysis unit for determining the main attack point that can be given, an attack pattern describing the technique and procedure of the attack, or an attack tree expressing the attack procedure and path of the attack scenario. Characterized in that it comprises a scenario analysis unit.

In addition, in the cyber attack system for vulnerability analysis according to the present invention, the attack execution agent means receives the attack target information, the attack target information or the attack scenario information through the attack control means to the main attack point; It characterized in that to perform an attack on.

In addition, in the cyber attack system for vulnerability analysis according to the present invention, the attack control means is a cycle cycle command control process of the information received from the information analysis means, the cyber attack management means, the attack damage evaluation means (Observe- Orient-Decision-Act Loop, OODA LOOP) to control the attack of the attack performing agent means.

delete

In addition, in the cyber attack system for vulnerability analysis according to the present invention, the attack scenario analysis unit defines the attack pattern or configures the attack tree and assigns a sequence number to the attack procedure to the attack pattern or the The attack scenario is generated by mapping an attack tree.

In addition, in the cyber attack system for vulnerability analysis in accordance with the present invention, the attack scenario analysis unit is the main purpose of the attack objective, the maximum vulnerability point when performing the attack pattern or the attack target to achieve the attack pattern in the attack target or lower attack node. Attack point, prerequisites that are conditions or situations necessary for the target or attack agent when performing the attack on each node that performs the attack, attack procedures and attack techniques and paths to be performed by the attack execution agent means, and the attack is terminated. Later, it is characterized by any one of the post-conditions describing the changed state of the target to attack.

In addition, in the cyber attack system for vulnerability analysis according to the present invention, the attack scenario analysis unit in the AND combination, each sub-node can move to the next higher node attack only if all of the attack targets succeed in the attack tree in each sub-node OR combination that requires only one of all attack objectives, CON does not need to achieve all attack objectives in each subnode, but if it achieves, CON enables the attack target of the current node to be easily achieved and also facilitates parent node attacks. It is characterized by the configuration using any one of the combinations.

In addition, in the cyber attack system for vulnerability analysis according to the present invention, the attack control means does not meet the prerequisites on the attack scenario, fails to achieve the attack purpose of the sub-node on the attack scenario or the The attack execution agent is characterized in that when the malfunction occurs in the attack execution agent means or the attack is detected by the attack target agent.

In addition, in the cyber attack system for vulnerability analysis according to the present invention, if the preconditions on the attack scenario is not met, the attack control means returns the attack procedure of the attack execution agent means to the previous step, Re-analyze the information of the target and transmit new information to control the attack execution agent means to resume the attack.

In addition, in the cyber attack system for vulnerability analysis according to the present invention, when the attack objective of the subnode in the attack scenario is not achieved, the attack control means selects a new optimal path through the induction of the attack success probability The attack performing agent means for controlling the attack to resume using the attack method.

In addition, in the cyber attack system for vulnerability analysis according to the present invention, when a malfunction occurs in the attack execution agent means or an attack is detected by the target of attack, the attack control means causes the attack execution agent means to attack the scenario. And returning to the lowest subnode in the table, and deleting log information of the performed task, so that the attacking agent means resumes the attack.

In addition, in the cyber attack system for vulnerability analysis according to the present invention, the cyber attack system for vulnerability analysis analyzes the attack performance after the attack execution of the attack execution agent means is completed and whether the attack performance is successful or the Characterized in that it further comprises an attack damage evaluation means for evaluating the degree of damage of the attack target.

In addition, the cyber attack method for vulnerability analysis according to the present invention to achieve the above object is a cyber attack system having an attack execution agent means, attack control means, information collecting agent means, information analysis means, cyber attack management means network Or a method for attacking for vulnerability detection or analysis of a computing system, wherein the information collecting agent means collects attack target information corresponding to an attack target and analyzes the collected attack target information by the information analysis means; Selecting, by the cyber attack management means, a main attack point of an attack target, generating and analyzing an attack scenario by the cyber attack management means, and performing the attack by the attack performing agent means on the main attack point; The attack control means received from the attack agent; Controlling the attack according to the request; and generating and analyzing the attack scenario comprises: defining, by the cyber attack management means, an attack pattern describing the technique and procedure of the attack, the cyber attack management means. Constructing an attack tree representing an attack procedure and a path of the attack scenario; and setting up correlation by mapping the attack pattern or the attack tree by assigning a sequence number to the attack procedure by the cyber attack management means Characterized in that it comprises a.

In addition, in the cyber attack method for vulnerability analysis according to the present invention, the step of analyzing the attack control means to set the attack purpose and transmits to the information collecting agent means, the information collecting agent means the attack And collecting the attack target information necessary to achieve the purpose, and analyzing the attack target information collected by the information analysis means to be used for generating the attack scenario.

In addition, in the cyber attack method for vulnerability analysis according to the present invention, the step of selecting the cyber attack management means for analyzing the vulnerability of the attack target, the cyber attack management means in accordance with the attack purpose And determining the main attack point that can cause the most damage to an attack target.

delete

In addition, in the cyber attack method for vulnerability analysis according to the present invention, the cyber attack management means is the attack purpose to achieve the attack pattern through the attack procedure in the attack target or lower attack node, the maximum vulnerability point when performing the attack The main attack point, the prerequisites or conditions necessary for the target or attack agent means to perform the attack on each node that performs the attack, the attack procedure and attack procedure that are to be performed by the attack execution agent means, and the attack is terminated. After that, it is characterized by any one of the post-conditions describing the changed state of the target of attack according to the purpose of attack.

In addition, in the cyber attack method for vulnerability analysis according to the present invention, the cyber attack management means is the AND combination, each sub node can move to the next higher node attack only if the attack tree succeeds in all the attack targets in each sub node. OR combination in which only one of all attacking targets can succeed, but it is not necessary to achieve all attacking objectives in each subnode, but if it achieves, it makes it possible to easily achieve the attacking objective of the current node and also to facilitate the attack of upper node. It is characterized by using any one of the CON combination.

In addition, in the cyber attack method for vulnerability analysis according to the present invention, in the step of performing the attack, the attack execution agent means for the attack target information, the attack target information or the attack scenario information through the attack control means; Receiving and performing the attack.

In addition, in the cyber attack method for vulnerability analysis according to the present invention, the attack control means is a cycle cycle command control process (OODA LOOP) information received from the information analysis means, the cyber attack management means, the attack damage evaluation means ) To control the attack of the attack performing agent means.

In addition, in the cyber attack method for vulnerability analysis according to the present invention, the controlling step, if the attack control means does not meet the preconditions on the attack scenario, achieve the attack purpose of the sub-node on the attack scenario If it does not or when a malfunction occurs in the attack execution agent means or when an attack is detected by the attack target, characterized in that for receiving the control request from the attack execution agent.

Further, in the cyber attack method for vulnerability analysis according to the present invention, if the preconditions on the attack scenario do not meet, the attack control means returns the attack procedure of the attack performing agent means to the previous step, Re-analyze the information of the target and transmit new information to control the attack execution agent means to resume the attack.

In addition, in the cyber attack method for vulnerability analysis according to the present invention, when the attack objective of the subnode in the attack scenario is not achieved, the attack control means selects a new optimal path through the induction of the attack success probability The attack performing agent means for controlling the attack to resume using the attack method.

In addition, in the cyber attack method for vulnerability analysis according to the present invention, when a malfunction occurs in the attack execution agent means or an attack is detected by an attack target, the attack control means causes the attack execution agent means to attack the scenario. And returning to the lowest subnode in the table, and deleting log information of the performed task, so that the attacking agent means resumes the attack.

In addition, in the cyber attack method for vulnerability analysis according to the present invention, the cyber attack system further comprises an attack damage evaluation means, the cyber attack method for the vulnerability analysis is that the attack execution agent means has completed the attack execution; And then transmitting the attack performance result to the attack damage evaluation means, analyzing the attack performance result received by the attack damage evaluation means, and evaluating whether the attack performance is successful or the degree of damage of the attack target. It is characterized by including.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. In addition, in describing the present invention, the same parts are denoted by the same reference numerals, and repetitive description thereof will be omitted.

1 is a block diagram illustrating a cyber attack system for vulnerability analysis according to an embodiment of the present invention.

As shown in FIG. 1, the cyber attack system according to the present invention is an automated agent for setting an attack execution agent means 10 for performing a cyber attack for detecting or analyzing a vulnerability of a network or a computing system, and setting an attack target. Attack control means 20 for managing the necessary information and to control the attack in accordance with the request of the attack execution agent means 10, information collecting agent means 30 for collecting the target information required to achieve the attack objectives Information analysis means 40 for analyzing the target information, cyber attack management means 50 for selecting a main attack point using the analyzed target information and generating an attack scenario, and analyzing the attack performance after the attack execution is completed. And attack damage evaluation means 60 for evaluating whether the attack performance is successful or the degree of damage of the attack target.

The attack execution agent means 10 shown in FIG. 1 receives the attack purpose, attack scenario, attack target information, etc. from the attack control means 20, and performs the actual attack on the main attack point of the attack target system. Since the attack execution agent means 10 is designed as an automated agent, the attack can be actively coordinated with the data received initially when the attack is started.

In addition, the attack control means 20 is related to the attack execution, and controls the attack execution agent means 10 at the time of the request of the attack execution agent step 10. Only in case of requesting help from the attack execution agent 10, the attack is intervened, and in the case of requesting help, the information received from each means is applied to the OODA LOOP without directing the work process of all means. do. In the present invention, by applying the OODA LOOP can reduce the overall work process time and the overall attack time, thereby reducing the detection probability in the target system.

In addition, the information collecting agent means 30 receives the final attack purpose information from the attack control means 20, and performs the function of collecting the relevant information to achieve this. In the present invention, an intelligent search agent disclosed in 'Intelligent Retrieval Agent based on Distributed Environment' by Kim Haeng-Kon, presented at the 4th SERA International Conference in August 2006, instead of an automated scanning tool such as a network scanner, which is widely used for collecting information. (Intelligent Retrieval Agent) is used.

In addition, the information analysis means 40 is provided with an attack target information analysis unit 41 for analyzing all the information related to the attack target system and transmitted to the cyber attack management means 50, the attack target information analysis unit 41 It works in conjunction with the information DB 42.

In addition, the cyber attack management means 50 analyzes the vulnerability of the target system and target development analysis unit 51 to determine the main attack point that can cause the most damage to the target in accordance with the purpose of attack, attack technology And an attack scenario analysis unit 53 for generating and analyzing an attack scenario using an attack tree representing an attack pattern or an attack scenario and a path describing an attack scenario. The target development analysis unit 51 and the attack scenario analysis unit 53 operate in conjunction with the vulnerability DB 52 and the attack scenario DB 54. In particular, the attack scenario analysis unit 53 defines an attack pattern, constructs an attack tree, and generates an attack scenario by mapping an attack pattern and an attack tree by assigning a sequence number to an attack procedure. The attack pattern and attack tree will be described later.

In addition, the attack damage evaluating means 60 analyzes all processes of the attack, evaluates the success of the attack and the magnitude of the damage of the target system, and analyzes all elements for future attacks such as re-attack or modification of the process. To improve functionality.

Briefly summarized the organic relationship between the internal devices of the cyber attack system shown in FIG. The information collecting agent means 30 shown in FIG. 1 collects and transmits the information to the information analyzing means 40 and the attack control means 20, and the information analyzing means 40 analyzes all the information related to the attack target system. And transmit to the target development analysis unit (51). The target development analysis unit 51 extracts the vulnerable elements based on the information and recommends the main attack point that can cause the most vulnerable and enormous damage among them. The attack scenario analysis unit 53 generates an optimal attack procedure using the attack pattern and the attack tree based on the attack target and the main attack point, and transmits the optimal attack procedure to the attack control means 20. Attack control means 20 transmits the information of the target system and the sequence number set of the attack scenario to the attack performing agent means 10 to perform the actual attack. In addition, the attack control means 20 controls the attack execution agent means 10 only at the request of the attack execution agent means 10. When the attack is finished, the attack results are sent to the attack damage evaluation means 60 to evaluate the overall attack process, calculate the damage degree of the target system, and refer to the result for future function improvement or attack scenario modification.

Next, a cyber attack method for vulnerability analysis according to the present invention will be described with reference to FIGS.

2 is a flowchart illustrating a cyber attack method for vulnerability analysis according to an embodiment of the present invention.

As shown in FIG. 2, in the cyber attack method according to the present invention, the information collecting agent means 30 collects attack target information corresponding to the attack target, and the information analyzing means 40 analyzes the collected attack target information. Information collection and analysis step (ST100), cyber attack management means 50 selects the main attack point of the attack target and target attack point determination step (ST200), cyber attack management means 50 generates an attack scenario Attack scenario analysis step (ST300), the attack execution agent means 10 performs the attack on the main attack point (ST400), and the attack damage evaluation means 60 performs the attack after the attack execution is completed. The post-attack evaluation step (ST500) is performed to analyze and evaluate the success of the attack or the degree of damage of the target.

First, in the first step of collecting and analyzing the information (ST100), the attack control means 20 sets the attack purpose and transmits it to the information collecting agent means 30. The information collecting agent means 30 collects information of the target system to be attacked in order to achieve the received attack target. 3 is a diagram illustrating an example of attack target information according to an embodiment of the present invention. As shown in FIG. 3, attack target information is configured based on XML (Extensible Markup Language). When the information is collected through the information collecting agent means 30, the information analyzing means 40 analyzes the information of the target system to be used for generating the attack scenario for the second step.

Next, in the second step of determining the target of attack and the main attack point (ST200), the cyber attack management means 50 detects / analyzes all the target's vulnerabilities by using the information on the target system to meet the target of the attack. Choose the most vulnerable area you can be. At this time, the main attack point, which is the point where the maximum evasion of detection from the attack target is possible and can cause the most damage during the attack, is determined. An example of the main attack point can also be obtained from 'Monthly Hacking and Virus Statistical Analysis' data provided by the Internet Incident Response Support Center.

An attack scenario analysis step (ST300), which is a third step, is a step of generating and analyzing an attack scenario by defining an attack pattern and constructing an attack tree. The attack scenario analysis unit 53 of the cyber attack management means 50 is performed. . That is, the attack scenario analysis unit 53 defines an attack pattern describing the techniques and procedures of the cyber attack, constructs an attack tree describing the attack procedure and the path of the cyber attack scenario, and assigns a sequence number to the attack procedure. Correlation is set by mapping attack pattern and attack tree.

The fourth step, the attack execution step (ST400) is a step of performing an actual attack on the main attack point of the attack target system through the attack execution agent means (10). The attack purpose agent attack information, attack scenario, attack target system information, etc. which are necessary for the attack execution agent means 10 to perform the attack are provided through the attack control means 20. The attack execution agent stage 10 does not store the attack scenario in the form of a text file and performs the attack, but stores only the sequence number and then performs the attack in this sequence number order.

The post attack evaluation step (ST500), which is the sixth step, is performed by the attack damage evaluating means 60, and analyzes all processes from the start point of the attack to the end point of the attack. By assessing the magnitude of damages, we can improve the functionality of all elements necessary for future attacks, such as reattack or modification of the process. The ex post evaluation is performed off-line after the attack, not in real time, to prevent the process overload and time delay.

Now, the attack pattern and attack tree used in the attack scenario analysis step ST300 will be described in detail.

First, the attack pattern will be described.

4 is a view showing an example of an attack pattern according to an embodiment of the present invention, the definition of the attack pattern is configured in the form as shown in FIG. The attack pattern describes the techniques and procedures of cyber attack that can occur in a specific situation. It consists of five elements: attack objective, main attack point, precondition, attack procedure, and post condition.

Attack objective is to define the attack objective to be achieved through the attack procedure at the final attack target or the lower attack node. The main attack point is the maximum vulnerability point performing the final attack, and the prerequisite is to attack at each node. It is to define conditions or situations necessary for the target system or attack performing agent means 10 when performing. The attack procedure defines attack techniques and paths to be performed by the attack execution agent means 10, and post-conditions describe the changed state of the target system according to the attack purpose after the attack is completed.

Next, the attack tree will be described.

5 is a view showing an example of an attack tree according to an embodiment of the present invention, the structure of the attack tree is configured in the form as shown in FIG. The attack tree describes the attack procedure and path of the cyber attack scenario using the tree, and is composed of three combinations of 'AND', 'OR' and 'CON'. AND combination means that all attack objectives must succeed in each sub node to move to the next higher node attack. The OR combination means that if one of all the attack targets succeeds in each subnode, it can move to the next higher node. The CON combination does not need to achieve all of the attack objectives at each subnode, but if it does, it means that the attack objectives of the current node can be easily achieved and the parent node can be easily attacked.

Another example of the attack pattern and the attack tree is as shown in FIGS. 6 and 7.

6 is a view showing an attack pattern of a denial of service attack according to an embodiment of the present invention, Figure 7 is a view showing an attack tree according to an embodiment of the present invention.

The process of creating an attack scenario involves mapping the attack pattern and the attack tree by assigning a sequence number to the attack procedure after defining the attack pattern and constructing the attack tree, as described above, and constructing a scenario for the denial of service attack. For example, it may be configured in the form of the attack pattern shown in Figure 6 and the attack tree shown in FIG.

The attack execution agent means 10 performs the attack using the sequence number of the attack scenario. For example, assuming a SYN Flooding attack in the example of the denial of service attack shown in FIG. 7, the sequence number set = {(1.2.1.1.1, 1.2.2, 1.2.3) during the entire attack scenario. , 1.2.4), (1.2.1.1.2, 1.2.2, 1.2.3, 1.2.4), (1.2.1.2, 1.2.2, 1.2.3, 1.2.4), (1.2.1.2, 1.2 .1.3, 1.2.2, 1.2.3, 1.2.4). However, in the present invention, since the information collecting agent means 30 and the attack execution agent means 10 are separated, the tasks of the subnodes having the sequence number set = {1.2.1} or less are already completed by the information collecting agent means 30. It becomes a state. Therefore, the attack execution agent means 10 transmits only the sequence number set = {1.2.1, 1.2.2, 1.2.3, 1.2.4.} Without performing a task having the sequence number set = {1.2.1} or less. You can do it. Through this, the task load and the attack time of the attack performing agent means 10 are obtained.

Next, a method of controlling the attack execution agent means 10 by the attack control means 20 will be described with reference to FIGS. 8 to 9.

8 is a view showing an attack tree when the attack control means 20 performs control according to an embodiment of the present invention, Figure 9 is a UDP (User Datagram Protocol) attack according to an embodiment of the present invention And an attack success probability for each node in an ICMP (Internet Control Message Protocol) attack.

In the cyber attack method for vulnerability analysis according to the present invention, when the attack control means 20 receives a request for help from the attack execution agent means 10, it controls the attack execution agent means 10 according to the received request. That is, the attack control means 20 is detected from the malfunction or attack target system of the attack execution agent means 10, if the preconditions do not meet, as shown in FIG. If so, it controls the attack execution agent means (10).

First, if the preconditions are not met (ⓐ), the attack control means 20 returns the attack procedure of the attack execution agent means 10 to the previous stage, reanalyzes the information of the target system, and retransmits new information. As a result, the attack agent means 10 controls to resume the attack. For example, if the port number is wrong, the newly opened port number is transmitted.

Next, if the attack target of the lower node in the attack method layer is not achieved (ⓑ), the attack control agent 20 resumes the attack by using the new attack method. To control. At this time, the optimal path is selected based on the attack success percentage (hereinafter referred to as 'ASP'). In case of UDP Flooding attack, there are five methods of sequence number set {1.1.1.1, 1.1.2, 1.1.3.1, 1.1.3.2, 1.1.4}, except for OR combination or CON combination. Finally, four methods remain. Here, the OR combination or the CON combination is not selected in the attack path in the present invention due to the absence of detailed attack procedures. Therefore, the attack success probability (ASP) for each node of the UDP flooding attack can be obtained as shown in FIG. 9A. In addition, the attack success probability (ASP) for each node of the ICMP flooding attack can be calculated as shown in FIG. 9B. In conclusion, the overall attack success probability (ASP) of UDP flooding attacks is 7/4 (= 1.75), which is the result of adding the attack success probability (ASP) for each node, and 8/5 (= 1.6 for ICMP flooding attacks). )to be. Therefore, the attack control means 20 selects a UDP flooding attack with a high attack success probability (ASP).

Finally, when the attack execution agent means 10 malfunctions or an attack is detected by the attack target system (©), the attack control means 10 causes the attack execution agent means 10 to be the lowest in the attack scenario. Return to the lower node, and deletes all the log information of the work performed by them to control the attack execution agent means 10 to resume the attack.

As described above, the present invention focuses on the fact that existing network attack models and cyber attack models do not present a complete attack process, and thus an active and automated cyber attack model capable of performing an attack from the start point to the end point of the attack may be proposed. The present invention relates to a cyber attack system and a method for attacking the vulnerability. In addition, human factors can be minimized by adding specialized information gathering agent and attack execution agent design, accurate main attack point development process, systematic and efficient attack scenario development, automated attack control and post attack evaluation. It is possible to carry out a cyber attack similar to a real attack.

The active cyber attack model proposed in the present invention was invented by analyzing the attack patterns and characteristics of the actual cyber attackers, so that the vulnerability that is scattered in the network and the system can be confirmed by simulating on the network. It also shows how the vulnerability is used by attackers and by what type of attack. In addition, the attack scenarios are organized by layer, so that the risk level for each stage of attack can be identified through simulation, and the security policy and security countermeasures can be established accordingly. Accordingly, the present invention is a government agency (security management of the e-government administrative service system), finance (security management of the Internet banking system), defense (components of the Syversion and Information Warfare), IT (security management for information systems), etc. Applicable to various applications.

As mentioned above, although the invention made by this inventor was demonstrated concretely according to the said Example, this invention is not limited to the said Example and can be variously changed in the range which does not deviate from the summary.

As described above, according to the cyber attack system and the attack method for analyzing the vulnerability according to the present invention, since it is designed by analyzing the attack pattern and characteristics of the actual cyber attacker, it is actually simulated on the network to the vulnerability inherent in the network and the system. The effect is that detection is possible.

In addition, according to the cyber attack system and the attack method for analyzing the vulnerability according to the present invention, it is also possible to obtain information about how the detected vulnerability is used by attackers, by what attack method.

In addition, according to the cyber attack system and the attack method for analyzing the vulnerability according to the present invention, effects such as transmission load reduction, attack procedure concealment, attack time saving, detection probability reduction and the like are also obtained.

In addition, according to the cyber attack system and the attack method for analyzing the vulnerability according to the present invention, the attack scenarios are organized by layers to determine the risk level for each stage of the attack, to set the security policy accordingly and to implement security countermeasures. The effect of establishing is also obtained. That is, the efficiency of the performed functions, the accuracy of attack point selection, the rationality of the attack procedure, and the magnitude of the damage may be analyzed and reflected in future attacks.

Claims (25)

Attack agent means for performing cyber attacks as an automated agent for detecting or analyzing vulnerability of network or computing system, Attack control means for setting the purpose of the attack, manage the information necessary for the attack, and performs the control of the attack at the request of the attack execution agent means, Information collecting agent means for collecting the target information required to achieve the attack objectives, Information analysis means for analyzing the target information; A cyber attack management means for selecting a main attack point using the analyzed target information and generating an attack scenario; The cyber attack management means Target development analysis unit for analyzing the vulnerability of the target and determine the main attack point that can cause the most damage to the target in accordance with the purpose of the attack, Cyber attack for vulnerability analysis, characterized in that it comprises an attack scenario analysis unit for generating and analyzing the attack scenario by using the attack pattern describing the attack pattern and attack scenario of the attack pattern or attack scenario describing the technique and procedure of the attack. system. The method of claim 1, The attacking agent means receives the attack target information, the attack target information or the attack scenario information through the attack control means to perform an attack on the main attack point, cyber attack system for vulnerability analysis . The method of claim 1, The attack control means performs the attack by applying the information received from the information analysis means, the cyber attack management means, the attack damage evaluating means to the cyclic cycle command control process (Observe-Orient-Decision-Act Loop, OODA LOOP) Cyber attack system for vulnerability analysis, characterized in that to control the attack of the agent means. delete The method of claim 1, The attack scenario analysis unit defines the attack pattern or configures the attack tree and assigns a sequence number to the attack procedure to generate the attack scenario by mapping the attack pattern or the attack tree. Cyber attack system for analysis. The method of claim 5, The attack scenario analyzer analyzes the attack pattern. Attack objectives to be achieved through the attack procedure on the attack target or subordinate attack nodes, Main attack point, which is the most vulnerable point when attacking, Prerequisites, which are conditions or situations required by the target or attack agent when performing the attack on each node that performs the attack, Attack procedure, which is an attack technique and path to be performed by the attack execution agent means, Cyber attack system for vulnerability analysis, characterized in that it is defined as one of the post-conditions describing the changed state of the target to be attacked after the attack is finished. The method of claim 6, The attack scenario analyzer analyzes the attack tree. AND combination that can only move to the next higher node attack after successful completion of all attack objectives in each subnode. OR combination that requires only one of all attack objectives to succeed on each subnode, It is not necessary to achieve all the attack objectives in each subnode, but if it achieves it, it is characterized by using any one of the CON combinations that can easily achieve the attack objectives of the current node and also facilitate the parent node attack. Cyber attack system for vulnerability analysis. The method of claim 7, wherein If the attack control means does not meet the prerequisites on the attack scenario, fails to achieve the attack purpose of the sub-node on the attack scenario, or a malfunction occurs in the attack execution agent means or an attack is detected by the attack target. Cyber attack system for vulnerability analysis, characterized in that for controlling the attack execution agent. The method of claim 8, If the preconditions on the attack scenario are not met, the attack control means returns the attack procedure of the attack execution agent means to the previous step, re-analyzes the information of the attack target, and transmits new information to the attack execution agent means. Cyber attack system for vulnerability analysis, characterized in that it controls to resume this attack. The method of claim 8, When the attack objective of the subnode cannot be achieved in the attack scenario, the attack control means controls the attack execution agent means to resume the attack by using a new attack method that selects an optimal path through the induction of the attack success probability. Cyber attack system for vulnerability analysis, characterized in that the. The method of claim 8, If a malfunction occurs in the attack execution agent means or an attack is detected by the attack target, the attack control means returns the attack execution agent means to the lowest subnode in the attack scenario, and logs log information of the performed task. The cyber attack system for vulnerability analysis, characterized in that for controlling the attack execution agent means to resume the attack by deleting. The method of claim 1, The cyber attack system for analyzing the vulnerability further includes an attack damage evaluation means for analyzing the attack performance after the attack execution of the attack execution agent means is completed and evaluating whether the attack execution is successful or the degree of damage of the attack target. Cyber attack system for vulnerability analysis, characterized in that. In the attack method for attack detection or analysis of a network or a computing system with a cyber attack system having an attack execution agent means, attack control means, information collecting agent means, information analysis means, cyber attack management means, Collecting, by the information collecting agent means, attack target information corresponding to the attack target, and analyzing the attack target information collected by the information analyzing means; Selecting, by the cyber attack management means, a main attack point of an attack target; Generating and analyzing an attack scenario by the cyber attack management means; The attack performing agent means performing an attack on the main attack point, Controlling the attack by the attack control means in accordance with a control request received from the attack execution agent means, The generating and analyzing step Defining, by the cyber attack management means, an attack pattern describing the technique and procedure of the attack, Configuring, by the cyber attack management means, an attack tree representing an attack procedure and a path of the attack scenario; And the cyber attack management means assigning a sequence number to the attack procedure to establish correlation by mapping the attack pattern or the attack tree. The method of claim 13, The analyzing step Transmitting, by the attack control means, to the information collecting agent means by setting the attack purpose Collecting the attack target information necessary for the information collecting agent means to achieve the attack target; And analyzing the attack target information collected by the information analysis means so as to be used for generating the attack scenario. The method of claim 13, The step of selecting Analyzing, by the cyber attack management means, the vulnerability of the attack target; The cyber attack method for cyber vulnerability analysis, characterized in that for determining the main attack point that can cause the most damage to the attack target in accordance with the attack target. delete The method of claim 13, The cyber attack management means is based on the attack pattern Attack objectives to be achieved through the attack procedure on the attack target or subordinate attack nodes, Main attack point, which is the most vulnerable point when attacking, Prerequisites, which are conditions or situations required by the target or attack agent when performing the attack on each node that performs the attack, Attack procedure, which is an attack technique and path to be performed by the attack execution agent means, Cyber attack method for vulnerability analysis, characterized in that it is defined as one of the post-conditions describing the changed state of the target to be attacked after the attack is finished. The method of claim 13, The cyber attack management means the attack tree AND combination that can only move to the next higher node attack after successful completion of all attack objectives in each subnode. OR combination that requires only one of all attack objectives to succeed on each subnode, It is not necessary to achieve all the attack objectives in each subnode, but if it achieves it, it is characterized by using any one of the CON combinations that can easily achieve the attack objectives of the current node and also facilitate the parent node attack. Cyber attack method for vulnerability analysis. The method of claim 13, In the performing of the attack, the attack execution agent means receives the attack purpose information, the attack target information or the attack scenario information through the attack control means, and executes the cyber attack for vulnerability analysis. Attack method. The method of claim 13, The attack control means controls the attack of the attack execution agent means by applying the information received from the information analysis means, the cyber attack management means, the attack damage evaluation means in a cyclic cycle command control process (OODA LOOP) Cyber attack method for vulnerability analysis. The method of claim 20, The controlling step If the attack control means does not meet the prerequisites on the attack scenario, fails to achieve the attack purpose of the subnode on the attack scenario, or a malfunction occurs in the attack execution agent means or an attack is detected by the attack target. Cyber attack method for vulnerability analysis, characterized in that receiving the control request from the attack execution agent. The method of claim 21, If the preconditions on the attack scenario do not match, the attack control means returns the attack procedure of the attack execution agent means to the previous step, re-analyzes the information of the attack target, and transmits new information to the attack execution agent means. Cyber attack method for vulnerability analysis, characterized in that the control to resume the attack. The method of claim 21, If the attack objective of the subnode cannot be achieved in the attack scenario, the attack execution agent means controls to resume the attack by using a new attack method in which the attack control means selects an optimal path through the induction of the attack success probability. Cyber attack method for vulnerability analysis, characterized in that the. The method of claim 21, If a malfunction occurs in the attack execution agent means or an attack is detected by the attack target, the attack control means returns the attack execution agent means to the lowest subnode in the attack scenario, and logs log information of the performed task. The cyber attack method for vulnerability analysis, characterized in that for controlling the attack execution agent means to resume the attack by deleting. The method of claim 13, The cyber attack system further comprises an attack damage evaluation means, Cyber attack method for the vulnerability analysis Transmitting, by the attack performing agent means, the attack performing result to the attack damage evaluation means after completing the attack execution; And analyzing, by the attack damage evaluating means, the received attack performance result and evaluating whether the attack performance is successful or the degree of damage of the attack target.

Images