KR100961992B1 - Method and Apparatus of cyber criminal activity analysis using markov chain and Recording medium using it - Google Patents

Abstract

Disclosed are a cyber criminal behavior analysis method using a Markov chain, an apparatus thereof, and a recording medium recording the same.

Cybercrime behavior analysis method using the Markov chain according to the present invention,

Define the forensic behavior of the user based on the behavior data of the user stored in the server and the log server, and select the forensic behavior defined by the user, and based on the evidence generated according to the selected forensic behavior, the transition matrix for the forensic behavior Constructing; Setting a priority of the forensic behavior by calculating a final probability vector value for prioritizing the forensic behavior using a Markov chain according to the configured transition matrix; Resetting the priority by removing the noise page for the forensic behavior at the set priority; Verifying the reliability of the priority by performing Monte Carlo simulation based on the reset priority; And storing a scenario for the verified forensic behavior in a database.

According to the present invention, by analyzing the user-based forensic evidence through a logical causal relationship, it is possible to improve the reliability of future threat-based, scenario-based threat detection, and to database various threat scenarios. By analyzing the behavior of the log data, it is possible to identify various forensic behaviors, proactively analyze the user's scenarios for various threats that may occur in the future, and actively capture the threats, and reduce the false positive rate for threat detection. It can be effective.

Description

Method and Apparatus of cyber criminal activity analysis using markov chain and Recording medium using it}

The present invention relates to digital forensic evidence analysis, in particular to analyze the digital forensic evidence considering the various metadata left by the intruder, and to apply the analysis method according to the Markov chain in order to identify the causal relationship of the forensic behavior over time. The present invention relates to a cyber criminal behavior analysis method using a Markov chain that can actively cope with cyber criminal behavior against an intruder and to accurately detect an invader's attack, an apparatus thereof, and a recording medium recording the same.

Due to the rapid development of information and communication technology and the widespread use of information equipment, the way of life of all economic subjects such as government, corporations and individuals is greatly changing, the system of economic society in general is fundamentally changing, and knowledge and information It is being reorganized into the knowledge and information society that is the driving force.

However, with the progress of informatization, illegal invasion, paralysis, destruction, invasion of privacy and misuse of personal information, criminal acts over the Internet, fraudulent use of cryptographic technologies, compromise of safety and reliability of electronic transactions, infringement of intellectual property rights, Various dysfunctions of informatization such as circulation of unhealthy information are emerging as serious social problems.

In this way, the necessity of information protection is increasing in the private sector as well as in the state and public institutions, as the adverse effects of information leakage and tampering are increased.

In the past, confidentiality-based security emphasized the need for comprehensive security, including availability and integrity, to expand the concept and scope of information security.

This means that if no organization can effectively detect security threats, it will never be able to respond to incidents.

In practice, there is a need for a countermeasure using automation technology, but expert judgment may be important depending on the situation.

 Conventionally, forensic procedures are network-based forensics. In particular, attackers trace back through forensic analysis using intrusion detection information by tools such as intrusion detection or firewall, but this does not introduce the concept of user behavior. In addition, there is a problem in that it is difficult to accurately estimate an attacker's attack pattern corresponding to various scenarios, and it is difficult to prevent cyber criminal behavior in advance by simply relying on the attacker traceback.

Accordingly, the first problem to be solved by the present invention is to introduce a forensic concept of user behavior, to estimate various criminal behaviors acting after intrusion, and to construct an optimal behavior scenario to improve reliability of forensic behavior. It is to provide a cyber criminal behavior analysis method using the Markov chain.

The second problem to be solved by the present invention is to provide a cyber criminal behavior analysis apparatus using the Markov chain applying the cyber criminal behavior analysis method using the Markov chain.

A third problem to be solved by the present invention is to provide a recording medium recorded by a program so that the computer can perform the cyber criminal behavior analysis method using the Markov chain.

The present invention to solve the first problem,

Define the forensic behavior of the user based on the behavior data of the user stored in the server and the log server, and select the forensic behavior defined by the user, and based on the evidence generated according to the selected forensic behavior, the transition matrix for the forensic behavior Constructing; Setting a priority of the forensic behavior by calculating a final probability vector value for prioritizing the forensic behavior using a Markov chain according to the configured transition matrix; Resetting the priority by removing the noise page for the forensic behavior at the set priority; Verifying the reliability of the priority by performing Monte Carlo simulation based on the reset priority; And it provides a cyber criminal behavior analysis method using the Markov chain comprising the step of storing the scenario for the verified forensic behavior in a database.

The defined forensic behavior may be selected based on mutual access information including the user, a log server storing the access information of the user, and application performance information by the user.

The transition matrix may be configured by a dual matrix configured according to the mutual access information.

In addition, the setting of the priority of the forensic behavior sets a priority of the forensic behavior by assigning a weight to each of the forensic behaviors, and the forensic behaviors are forensic behaviors based on priority, habit-based forensic behaviors, and counter- habits. It is characterized by being classified as based on forensic behavior.

In addition, the removal of the noise page is characterized in that the noise page is removed according to singular value decomposition (SVD).

The step of constructing the transition matrix may include performing data mining on the categorized forensic behavior, wherein the categorized forensic behavior is stored in a hierarchical document form of XML or AXML.

는And the final probability vector value.

Is

라 하고, 상기 유저의 행위 데이터에 기반한 전이 행렬을

라 하고, 상기 유저에 의해 수행되는 포렌식 행위 데이터의 총 수를

이라고 할 때, 수학식

에 의해 구성되는 것을 특징으로 한다.Initial value determined in advance according to the data mining (initial value)

A transition matrix based on the user's behavior data

The total number of forensic behavior data performed by the user

Speaking of equations

It is characterized by consisting of.

In addition, storing the verified forensic behavior scenario in a database may include separately configuring a database for each user, and deleting and modifying the database in real time when a change occurs in the log data for each user. Characterized in that it comprises a.

The present invention to solve the second problem,

A forensic behavior definition unit that defines a forensic behavior of a user and selects the defined forensic behavior; A transition matrix constructing unit constituting a transition matrix for the forensic behavior based on the evidence generated according to the selected forensic behavior; A priority setting unit for setting a priority of the forensic behavior by calculating a final probability vector value for prioritizing the forensic behavior using a Markov chain according to the configured transition matrix; A noise page removal unit for resetting the priority by removing the noise page for the forensic behavior at the set priority; A verification unit which verifies the reliability of the priority by performing Monte Carlo simulation based on the reset priority; And it provides a cyber criminal behavior analysis apparatus using the Markov chain including a database for storing the scenario for the forensic behavior verified in the database.

Here, the forensic behavior defining unit may select forensic behavior based on mutual access information including the user, a log server storing the access information of the user, and application performance information by the user.

The transition matrix may be configured by a dual matrix configured according to the mutual access information.

In addition, the priority setting unit sets the priority of the forensic behavior by assigning a weight to each of the forensic behaviors, and the forensic behaviors are classified into priority-based forensic behavior, habit-based forensic behavior, and semi- habit-based forensic behavior. It is characterized by.

The noise page remover may remove the noise page according to the singular value decomposition.

In addition, the transition matrix configuration unit includes a data mining module that performs data mining on the classified forensic behavior, wherein the classified forensic behavior is stored in a hierarchical document form of XML or AXML.

는 상기 데이터 마이닝에 따라 미리 결정된 초기값(initial value)을

라 하고, 상기 유저의 행위 데이터에 기반한 전이 행렬을

라 하고, 상기 유저에 의해 수행되는 포렌식 행위 데이터의 총 수를

이라고 할 때, 수학식

에 의해 구성되는 것을 특징으로 한다.And the final probability vector value.

Is an initial value determined according to the data mining.

A transition matrix based on the user's behavior data

The total number of forensic behavior data performed by the user

Speaking of equations

It is characterized by consisting of.

In order to solve the third problem, the present invention provides a recording medium recorded by a program so that the computer can perform the cyber criminal behavior analysis method using the Markov chain.

According to the present invention, by analyzing the user-based forensic evidence through a logical causal relationship, it is possible to improve the reliability of future threat-based, scenario-based threat detection, and to database various threat scenarios. By analyzing the behavior of the log data, it is possible to identify various forensic behaviors, proactively analyze the user's scenarios for various threats that may occur in the future, and actively capture the threats, and reduce the false positive rate for threat detection. It can be effective.

The present invention introduces a forensic concept of user behavior that is not based on a conventional host or network, estimates various behavior patterns of a user who acts after a user's intrusion, analyzes an optimal forensic behavior scenario, and verifies it. Database.

To this end, the present invention is based on the Markov chain methodology to identify the causal relationship to forensic behavior, and to identify the forensic behavior from which errors are eliminated by introducing a noise reduction algorithm to overcome the error rate by stochastic approach. can do.

In addition, the present invention can build a database to combine the scenario for the best forensic behavior, and can improve the reliability of the scenario of forensic behavior through the verification of Monte Carlo simulation.

Indeed, if no organization can effectively detect a threat, then incident response can never be facilitated.

This method is also important, but the expert's judgment may be important depending on the situation.

Therefore, it is necessary to analyze the attacker's behavior and infer the next behavior or look for patterns.

That is, unauthorized, abnormal and illegal events are recorded by the end user, detected by the system administrator, confirmed by the IDS alerting device or discovered by many other alarm systems.

As such, the digital forensic evidence obtained from the automated process can be used as important information for survey analysis.

This is to answer the question about who, what, when, where, how, and why, and to use it as solid evidence.

Therefore, the following evidence should be collected.

1. Date and time of the system

2. Recent Visitor Log List

3. Time / date stamp of entire file system

4. Recently Run Applications (including installation)

5. Recessed Open Socket

6. Listening to Applications on Open Sockets

7. Recent connection information or network topology with other systems

Based on such evidence, trace evidence is collected through host-based, network-based, and non-technical research methods.

The present invention can construct a cyber criminal behavior analysis model for forensic behavior using a non-technical investigation method among these.

To this end, various evidences such as document tracking information (word documents, emails, web pages, etc.), time stamps present in document files or web page cache areas are collected in the system.

Recently, digital forensics have attracted attention and various analysis methodologies have been proposed, but most of them belong to a method for analyzing forensic behavior through information recorded in a system such as a hard disk.

In order to be credible, such fragmentary evidence needs to describe the behavior in which evidence can appear and be revealed.

Therefore, the present invention is to identify the causal relationship between the various forensic actions that can be performed in the system through such evidence, and the core of the present invention is to select the high incidence of intruders.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

In addition, the embodiment of the present invention illustrated below may be modified in various other forms, and the scope of the present invention is not limited to the embodiments described below. Embodiments of the invention are provided to more fully illustrate the invention to those skilled in the art.

1 is a flowchart of a cyber criminal behavior analysis method using a Markov chain according to the present invention.

Referring to FIG. 1, first, forensic behavior of a user is defined based on behavior data of a user stored in a server and a log server, and the forensic behavior defined above is selected (step 110).

This is to perform initial data mining, and to calculate each component value for constructing a transition matrix between the user and each forensic behavior.

First, the intrusion user or the user of interest is defined, and the forensic behavior of the user is classified such as the execution of the web browser, the log server search, the software download, the installation of a specific application, and the execution of a specific application.

As shown in FIG. 2, the browser web 220 may be executed by the user 210, search of the log server 230, and the process of downloading a specific software 240 by the user. This may be performed, and the installation 250 of the specific application and the execution 260 of the application may be performed.

The path shown in FIG. 2 may be a single action alone, or a specific action may be performed by various paths.

The present invention sets a priority for each forensic behavior in a scenario in which a specific forensic behavior occurs with respect to a plurality of paths associated with the specific behavior shown in FIG. 2, and builds a database for the forensic behavior based on this.

Data mining for classifying forensic behavior may be divided into a preparation step, an aggregation step, and an analysis step as shown in Table 1 below.

Through the data mining as described above, forensic behavior is classified and a transition matrix is constructed.

Next, a transition matrix for the forensic behavior is constructed based on the evidence generated according to the selected forensic behavior (step 120).

The defined forensic behavior may be selected based on mutual access information including the user, a log server storing the access information of the user, and application performance information by the user, and the transition matrix is the mutual access information. It can be configured by a dual matrix consisting of.

In the present invention, constructing a dual matrix may be performed independently of forensic behavior, but in scenario-based forensic behavior, each behavior may be performed in conjunction with other behaviors, and thus a relationship between a pair of behaviors may be performed. To derive the dual matrix, a transition matrix can be generated based on the dual matrix.

In addition, data mining may be performed on the selected forensic behavior to construct a transition matrix, and the selected forensic behavior may be stored in a hierarchical document form of XML or AXML.

Since each forensic behavior can be classified hierarchically, it can be stored as an XML or AXML document having a hierarchical document type.

On the other hand, according to Figure 3, the user's behavior based on the generated evidence can be configured in each node.

3 illustrates the interaction of each node with respect to forensic behavior.

As shown in FIG. 3, for each action performed by a user, the priority of the forensic action may be continuously defined based on the Markov chain.

Based on FIG. 3, in order to calculate a priority value for each forensic behavior, a transition matrix for the forensic behavior is configured.

를 사용하며,

개의 포렌식 행위를 기반으로 마르코프 연산의 최종 확률 벡터값

를 구성할 수 있다.In order to construct the transition matrix, the present invention is a transition matrix which is a hyperlink matrix constructed based on a pair of forensic behaviors.

Using the

Final probability vector of Markov operations based on forensic behavior

Can be configured.

를 이용하여 마르코프 연산의 최종 확률 벡터값

를 구성하면 하기의 수학식 1과 같다.The transition matrix

Final probability vector value of the Markov operation

When configured as shown in Equation 1 below.

는 상기 데이터 마이닝에 따라 미리 결정된 초기값(initial value)을

라 하고, 상기 유저의 행위 데이터에 기반한 전이 행렬을

라 하고, 상기 유저에 의해 수행되는 포렌식 행위 데이터의 총 수를

이라고 할 때, 상기 수학식 1에 의해 연산된다.As such, the final probability vector value

Is an initial value determined according to the data mining.

A transition matrix based on the user's behavior data

The total number of forensic behavior data performed by the user

Is calculated by the above equation (1).

는

의 범위를 가지게 되는데, 본 발명에서는 데 이터 마이닝 기법에서 통상적으로 사용되는 거듭 제곱 방법(Power method)를 사용하여, 초기값

를 0.85로 정의한다. 이는 크기가 큰 행렬의 경우에 가장 큰 고유치(eigenvalue)를 구하는데 있어서 초기값

를 0.85로 정의할 수 있다.The initial value

Is

In the present invention, an initial value is used by using a power method commonly used in data mining techniques.

Is defined as 0.85. This is the initial value for finding the largest eigenvalue for large matrices.

Can be defined as 0.85.

에 대하여, 상기 수학식 1을 정규화하면, 하기의 수학식 2에 따라 상기 최종 확률 벡터값인 행렬

에 대하여 열벡터

로 구성할 수 있으며, 이는 하기의 수학식 2과 같다.In addition, the forensic behavior

For Equation 1, the equation 1 is normalized. The matrix is the final probability vector value according to Equation 2 below.

Column vector

It may be configured as, which is shown in Equation 2 below.

As can be seen in Equation 2, since the priority of the forensic behavior is calculated by the probability, the sum of the total probabilities for each forensic behavior is 1.

In addition, a weight may be calculated in the concatenation of each forensic behavior while constructing a transition matrix.

In scenario-based forensic behavior, this can be classified into priority-based forensic behavior, habit-based forensic behavior, and semi- habit-based forensic behavior based on habitability.

In other words, priority-based forensic behavior refers to forensic behavior without addictive habits, habit-based forensic behavior refers to forensic behavior that is known from users, and semi- habit-based forensic behavior refers to priority-based forensic behavior. And forensic behavior, which falls into the middle category of habit-based forensic behavior.

As such, weights may be selected for each of the forensic actions, and the priority of the forensic actions may be calculated according to the transition matrix.

Equations 3 to 5 below represent equations for weighting the respective forensic behaviors.

는 전이행렬

(

)의 역수의 개념으로 역행렬을 의미하며, 우선 순위 기반의 포렌식 행위

를 고려한 행위 결과 벡터

는 그 종속성을 고려하여 결과 벡터

의 절대값의 역수로 표현될 수 있다.Equation 3 relates to a forensic action result vector based on priority, and a forensic action result vector based on priority.

Is the transition matrix

(

Is the inverse of the concept of the inverse matrix, priority-based forensic behavior

Behavior result vector

Considering the dependencies

It can be expressed as the inverse of the absolute value of.

에 있어서, 각각의 행위를 나타내는 웹 상태(web State:

) 집합의 포렌식 행위인

내의 각 습관에 대한 가중치 값 벡터

의 총 합이

이전의 습관에 대한 가중치 값 벡터와 반비례함을 알 수 있고, 습관 기반의 포렌식 행위

를 고려한 행위 결과 벡터

는 그 종속성을 고려하여 결과 벡터

와 가중치 값 행렬

의 곱의 전체 합의 절대값 역수는

와 반비례로 표현될 수 있다.According to Equation 4, the habit-based forensic behavior result vector relates to a habit-based forensic behavior result vector.

In which the web state represents each action.

) The forensic act of aggregation

Weight value vector for each habit within

Sum of

Habit-based forensic behavior, inversely proportional to the weight vector of previous habits.

Behavior result vector

Considering the dependencies

Matrix with weights

The absolute reciprocal of the sum of the products of

It can be expressed in inverse proportion to.

는 전이행렬

(

)의 역수의 개념으로 역행렬을 의미하며, 반 습관 기반의 포렌식 행위

를 고려한 행위 결과 벡터

는 그 종속성을 고려하여 결과 벡터

와 각 습관에 대한 가중치 값 행렬

의 곱의 전체 합의 절대값은 각 반습관에 대한 가중치 값 행렬

와 반비례로 표현될 수 있다.Equation 5 relates to a semi- habit based forensic behavior result vector, and a semi habit based forensic behavior result vector.

Is the transition matrix

(

The inverse matrix means the inverse of the concept, and anti- habit based forensic behavior

Behavior result vector

Considering the dependencies

Matrix of weights for each habit

The absolute value of the total sum of the products of is the weighted value matrix for each counter habit.

It can be expressed in inverse proportion to.

Next, the priority of the forensic behavior is set by calculating a final probability vector value for prioritizing the forensic behavior using a Markov chain according to the configured transition matrix (step 130).

A final probability vector value for prioritizing the forensic behavior is calculated using the Markov chain for the forensic behavior that occurs continuously in time using the transition matrix generated in step 120.

This calculates a final probability vector value for prioritizing each forensic behavior using the weights calculated according to Equations 4 to 6 and the transition matrix generated in step 120.

In practice, the forensic behavior is complicated because it involves various behaviors, and the forensic behavior is shown in FIG. 3.

군으로 표현할 수 있으며, 이는 각각의 포렌식 행위에 대한 각 노드의 구성요소

로 나타낼 수 있다.The overall forensic behavior of the user for FIG.

It can be expressed as a group, which is the component of each node for each forensic behavior.

It can be represented as.

This means that each situation has an interrelationship, which maintains a mutually dependent relationship.

인 전이행렬로 나타낼 수 있고, 이는 상기 수학식 1 및 수학식 2에 나타나 있다.This conforms to the Markov assumption, in which the predecessor directly relates to the after action according to FIG.

It can be represented by the phosphorus transition matrix, which is shown in the equation (1) and (2).

를 구성하는 것으로, 종속적 관계를 나타내는 포렌식 행위와 그 맥락이 동일함을 알 수 있다.That is, the core of the present invention using the Markov property is the transition matrix

By constructing, it can be seen that the context is the same as the forensic behavior representing the dependent relationship.

Therefore, when the Markov chain is finally applied, it is represented by the inference vector value of the final forensic behavior as shown in Equation 2 above.

Next, the priority is reset by removing the noise page for the forensic behavior at the set priority (step 140).

In the present invention, a noise page elimination algorithm (NPEA) is used to correct minute errors that may occur in the probability operation in order to correct the final probability vector value for prioritization calculated according to the Markov chain. Apply.

That is, in the calculation of the final probability vector value for prioritization calculated according to the Markov chain, the noise page is removed to remove probabilistic errors that may be caused by the relationship between the data before training according to the learning. It is possible to form scenario paths of purely refined forensic behavior.

Meanwhile, noise page removal is performed according to the following procedure.

으로 표현할 수 있다. 그리고 행렬

의 원소

는 하기의 수학식 6에 따라 표현될 수 있다.First, a matrix exists within the root that represents the entire action performed by the user.

It can be expressed as And the matrix

Element of

May be expressed according to Equation 6 below.

의 전체 사이즈는

과 동일하게

으로 표시된다.Meanwhile, the matrix

Overall size

Same as

Is displayed.

는 행렬

로 표현되고, 행렬

의 원소는 하기의 수학식 7에 따라 표현된다.And, the size of the page newly opened by the user

Is a matrix

Represented by a matrix

The element of is expressed according to the following equation.

Meanwhile, the noise page removal algorithm according to the present invention is basically based on singular value decomposition (SVD).

Singular value decomposition is a generalization of the spectral theory of a matrix for any rectangular matrix. Using spectral theory, we can decompose a diagonal matrix based on the eigenvalues of an orthogonal square matrix.

Here, the definition of the singular value decomposition is as follows.

를 실수 또는 복수수의 집합

의 원소로 이루어진

행렬이라 가정하면, 상기 행렬

는 하기의 수학식 8과 같이 세 행렬의 곱으로 나타낼 수 있다.procession

A set of real or plural numbers

Consisting of elements of

Assume that it is a matrix

Can be expressed as the product of three matrices, as shown in Equation 8 below.

는

유니터리 행렬(unitary matrix)이고,

행렬

은 대각선에 음수가 아닌 수를 가지고, 나머지는 모두 0의 값을 가지는 행렬이며,

은

의 켤레행렬이며

유니터리 행렬을 가리킨다.In Equation 8

Is

Unitary matrix,

procession

Is a matrix of non-negative numbers on the diagonal, all of which are zero.

silver

Is a pair of

Pointer to a unitary matrix.

의 특이값 분해라고 한다.Thus, what is represented by the product of three matrices

This is called singular value decomposition of.

행렬

에 대하여 하기의 수학식 9의 조건을 만족하는 벡터

과

이 존재할 때, 음수가 아닌 실수

를 특이값이라고 한다.Also,

procession

A vector satisfying the condition of Equation 9 below.

and

When it exists, a nonnegative real number

Is called the singular value.

및

를 각각 좌측 특이벡터와 우측 특이벡터로 명명할 수 있다.Satisfying the condition of Equation 9

And

Can be named as the left singular vector and the right singular vector, respectively.

Next, Monte Carlo simulation is performed based on the reset priority to verify the reliability of the priority (step 150).

According to the above process, in order to further increase the reliability of the priority of the forensic behavior in which the noise is removed, the reliability of the priority may be verified by performing Monte Carlo simulation.

Monte Carlo simulations can be performed in a generally known manner, which is carried out in the following five steps.

를 생성한다. Parametric Functions for Performing Monte Carlo Simulations

.

를 발생한다. 여기서 난수는 상기 우선 순위의 측정에 사용된 입력 데이터에 대응되는 난수를 발생하는데, 관리자에 의해 미리 설정된 임계치 이하의 차이값을 가지는 난수를 발생하는 것이 상기 몬테카를로 시뮬레이션의 또 다른 특징이다.2. Random number to input in the parameter function

Occurs. In this case, the random number generates a random number corresponding to the input data used to measure the priority. Another characteristic of the Monte Carlo simulation is that the random number generates a random number having a difference value less than or equal to a preset threshold.

를 저장한다.3. Model measurement result generated according to the random number

Save it.

4. Repeat steps 2 and 3 above.

를 히스토그램, 통계처리, 및 신뢰 구간 설정에 따라 분석하여 최종 결과, 즉 우선 순위값을 출력한다.5. Result value according to the above repetition

Is analyzed according to histogram, statistical processing, and confidence interval setting to output a final result, that is, a priority value.

Finally, the scenario for the verified forensic behavior is stored in the database (step 160).

In this way, by verifying the priority of the forensic behavior according to the Monte Carlo simulation, and by storing the scenario for the forensic behavior verified in the database, it is possible to cope with the forensic behavior in accordance with the intrusion of the user later, the priority stored in the database Scenarios of forensic behavior based on rankings can be provided to other users to enable them to respond to cyber risks on a universal basis.

To this end, the present invention configures a user-specific database separately, and deletes and modifies the database in real time when a change occurs in the log data for each user, thereby creating a scenario for the forensic behavior of the updated user at all times. can do.

FIG. 4 is a schematic flowchart of a noise page removal algorithm applied in operation 140 of FIG. 1.

행렬

에 대하여 특이값 분해를 수행하여 음수가 아닌 실수

인 특이값을 생성한다(441 과정). 여기서, 특이값은

개 생성될 수 있다.Referring to Figure 4,

procession

A nonnegative real by performing singular value decomposition on

Generate a singular value of phosphorus (step 441). Where the singular value is

Can be generated.

를 선택한다(442 과정).Then, the parameter based on the generated singular value according to Equation 10

(Step 442).

를 이용하여 전술한 3개의 유니터리 행렬

를 기반으로 하기의 수학식 11에 따라 파라미터

에 따른 유사행렬

를 생성한다(443 과정).Then, the parameter selected according to step 442 above.

The three unitary matrices described above using

Based on the parameter according to Equation 11 below

Similar matrix according to

Generate (step 443).

에 따라 하기의 수학식 12에 의거하여

차원에서의 포렌식 행위

의 좌표 벡터

를 생성한다(444 과정).Then, the unitary matrix used in step 443

According to Equation 12 below

Forensic behavior in dimensions

Coordinate vector

(Step 444).

행렬로부터 유사 행렬을 하기의 수학식 13에 따라 연산한다(445 과정).Then, generated according to the new page opened by the user

A similar matrix is calculated from the matrix according to Equation 13 below (step 445).

는 행렬

의 각 열벡터를 의미한다.In Equation 13

Is a matrix

Means each column vector of.

행렬과

행렬의 유사성을 측정(446 과정)하는데, 상기 유사성 측정값이 관리자에 의해 미리 설정된 임계값

보다 큰지의 여부를 판단하여(447 과정), 상기 임계값

보다 유사성의 측정값이 큰 경우 유저의 포렌식 행위

를 유지하고(448 과정), 상기 임계값

보다 유사성의 측정값이 크지 않은 경우 유저의 포렌식 행위

를 제거(449 과정)함으로써 잡음 페이지 제거 알고리즘을 종료하게 된다.Then, above

Matrix

The similarity of the matrix is measured (step 446), wherein the similarity measure is a threshold value preset by the administrator.

It is determined whether it is larger (step 447), and the threshold value

Forensic behavior of the user when the measure of similarity is greater

(Step 448), the threshold value

Forensic behavior of the user if the measure of similarity is not large

By removing (449), the noise page removal algorithm is terminated.

값과의 대소여부에 관한 판단식은 하기의 수학식 14와 같다.Here, the similarity measurement value and the threshold value of step 447

The determination equation regarding the magnitude with respect to the value is shown in Equation 14 below.

5 illustrates a scenario of forensic behavior in which noise is removed according to a noise page removal algorithm applied to the present invention.

In FIG. 5, the block 510 illustrates a scenario of forensic behavior using arrows based on the priority of the forensic behavior set according to the Markov chain, and it can be seen that the noise page 511 is unnecessary. .

In contrast, when the noise page removal algorithm is performed on the block 510, a scenario of the noise-reduced forensic behavior is obtained as shown in block 520.

6 is a block diagram of an apparatus for analyzing cyber crime behavior using a Markov chain according to the present invention.

On the other hand, detailed description of the portion overlapping with the above-described above with respect to Figure 6 will be boldly omitted.

Referring to FIG. 6, the apparatus for analyzing cyber crimes using the Markov chain according to the present invention includes a forensic behavior defining unit 610, a transition matrix constructing unit 620, a priority setting unit 630, and a noise page removing unit 640. ), The verification unit 650 and the database 660.

The forensic behavior definition unit 610 defines forensic behavior of the user, selects the defined forensic behavior, and is generated according to the forensic behavior selected by the forensic behavior definition unit 610 in the transition matrix configuration unit 620. Construct a transition matrix for the forensic behavior based on evidence.

Here, the forensic behavior defining unit 610 may define forensic behavior by selecting forensic behavior based on mutual access information including a user, a log server storing the access information of the user, and application performance information by the user. Can be.

The transition matrix is constituted by a dual matrix constructed according to the mutual access information, which is dual because the forensic behavior may be composed of a pair of forensic behaviors that are related to each other in time series rather than each forensic behavior independently. According to the matrix can be configured a transition matrix of the forensic behavior.

On the other hand, the transition matrix configuration unit 620 includes a data mining module (not shown) that performs data mining on the selected forensic behavior, wherein the selected forensic behavior is to be stored in a hierarchical document form of XML or AXML. Can be.

는 상기 데이터 마이닝에 따라 미리 결정 된 초기값(initial value)을

라 하고, 상기 유저의 행위 데이터에 기반한 전이 행렬을

라 하고, 상기 유저에 의해 수행되는 포렌식 행위 데이터의 총 수를

이라고 할 때, 상기 수학식 1에 의해 구성될 수 있음은 물론이다.And the final probability vector value.

The initial value determined in accordance with the data mining (initial value)

A transition matrix based on the user's behavior data

The total number of forensic behavior data performed by the user

Sure, it can be configured by the above equation (1).

The priority setting unit 630 sets a priority of the forensic behavior by calculating a final probability vector value for prioritizing the forensic behavior using a Markov chain according to the configured transition matrix, and removes the noise page remover ( At 640, the priority page is reset by removing noise pages for the forensic behavior according to singular value decomposition at the set priority.

The priority setting unit 630 may set the priority of the forensic behavior by assigning a weight to each of the forensic behavior, and the forensic behavior may be a priority-based forensic behavior, a habit-based forensic behavior, and a semi- habit-based forensics. It can be classified as an act, the description of which is as described above.

Then, the verification unit 650 verifies the reliability of the priority by performing Monte Carlo simulation based on the reset priority, and finally stores the scenario for the verified forensic behavior in the database 660.

The cyber criminal behavior analysis method using the Markov chain according to the present invention can be executed through software. When implemented in software, the constituent means of the present invention are code segments that perform the necessary work. The program or code segments may be stored on a processor readable medium or transmitted by a computer data signal coupled with a carrier on a transmission medium or network.

The computer-readable recording medium includes all kinds of recording devices in which data is stored which can be read by a computer system. Examples of computer-readable recording devices include ROM, RAM, CD-ROM, DVD ± ROM, DVD-RAM, magnetic tape, floppy disks, hard disks, optical data storage devices, and the like. The computer readable recording medium can also be distributed over network coupled computer devices so that the computer readable code is stored and executed in a distributed fashion.

Although the present invention has been described with reference to an embodiment shown in the drawings, this is merely an example, and those skilled in the art may have various modifications therefrom and those skilled in the art. It will be appreciated that various modifications and variations of the embodiments are possible therefrom.

However, such modifications should be considered to be within the technical protection scope of the present invention.

Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

1 is a flowchart of a cyber criminal behavior analysis method using a Markov chain according to the present invention.

Figure 2 schematically shows the configuration of each action on the cyber of the user applied to the present invention.

3 illustrates the interaction of each node with respect to forensic behavior.

FIG. 4 is a schematic flowchart of a noise page removal algorithm applied in operation 140 of FIG. 1.

5 illustrates a scenario of forensic behavior in which noise is removed according to a noise page removal algorithm applied to the present invention.

6 is a block diagram of an apparatus for analyzing cyber crime behavior using a Markov chain according to the present invention.

Claims (16)

Define the forensic behavior of the user based on the behavior data of the user stored in the server and the log server, and select the forensic behavior defined by the user, and based on the evidence generated according to the selected forensic behavior, Constructing a transition matrix composed of probabilities of occurrence of forensic behavior; Substituting the constructed transition matrix into a Markov chain representing a state change of the forensic behavior over time, calculating a final probability vector value that is a final probability of a predetermined forensic behavior, and then configuring the final probability vector value. Setting a priority of the forensic behavior according to the magnitude of the vector values; Resetting the priority by removing the noise page for the forensic behavior at the set priority; Verifying the reliability of the priority by performing Monte Carlo simulation based on the reset priority; And And storing the scenario for the verified forensic behavior in a database. The method of claim 1, The forensic behavior defined above And a selection method based on mutual access information including the user, a log server storing access information of the user, and application execution information by the user. The method of claim 2, The transition matrix is Cybercrime behavior analysis method using a Markov chain, characterized in that composed of a dual matrix configured according to the mutual access information. The method of claim 1, Setting the priority of the forensic behavior Another weight vector is generated according to the classification of the forensic behavior, and the resulting weight vector is substituted into the Markov chain to be the final probability vector.

Final probability vector of the value vector

After calculating the, the calculated probability vector value column vector

Sets the priority of the forensic behavior according to the size of the element vector values constituting The forensic behavior is classified into priority-based forensic behavior, habit-based forensic behavior, and anti-habitation-based forensic behavior. The method of claim 1, The removal of the noise page Cybercrime behavior analysis method using Markov chain, characterized in that noise page is removed by singular value decomposition. The method of claim 1, Configuring the transition matrix Performing data mining on the selected forensic behavior; The selected forensic behavior is cyber criminal behavior analysis method using a Markov chain, characterized in that stored in the form of a hierarchical document of XML or AXML. The method of claim 6, The final probability vector value

Is Initial value determined in advance according to the data mining (initial value)

A transition matrix based on the user's behavior data

The total number of forensic behavior data performed by the user

In this regard, the cyber criminal behavior analysis method using the Markov chain, characterized by the following equation 1.

(One) The method of claim 1, Storing the scenario for the verified forensic behavior in a database; Comprising a separate database for each user, and if the change occurs in the log data for each user, the step of deleting and modifying the database in real time comprising the cyber criminal behavior analysis method using a Markov chain. A recording medium recorded by a program for performing the method of any one of claims 1 to 8 on a computer. A forensic behavior definition unit that defines a forensic behavior of a user and selects the defined forensic behavior; A transition matrix constructing unit constituting a transition matrix composed of probabilities of occurrence of a forensic behavior at a next time in a forensic behavior at a current time based on the evidence generated according to the selected forensic behavior; Substituting the constructed transition matrix into a Markov chain representing a state change of the forensic behavior over time, calculating a final probability vector value that is a final probability of a predetermined forensic behavior, and then configuring the final probability vector value. A priority setting unit for setting the priority of the forensic behavior according to the magnitude of vector values; A noise page removal unit for resetting the priority by removing the noise page for the forensic behavior at the set priority; A verification unit which verifies the reliability of the priority by performing Monte Carlo simulation based on the reset priority; And Apparatus for analyzing cyber criminal behavior using the Markov chain including a database for storing the scenario for the verified forensic behavior in a database. The method of claim 10, The forensic behavior definition unit And a forensic behavior screening device based on mutual access information including the user, a log server storing access information of the user, and application performance information by the user. The method of claim 11, The transition matrix is Apparatus for analyzing cyber crimes using a Markov chain, characterized in that formed by a dual matrix configured according to the mutual access information. The method of claim 10, The priority setting unit Another weight vector is generated according to the classification of the forensic behavior, and the resulting weight vector is substituted into the Markov chain to be the final probability vector.

Final probability vector of the value vector

After calculating the, the calculated probability vector value column vector

Sets the priority of the forensic behavior according to the size of the element vector values constituting The forensic behavior is cyber criminal behavior analysis apparatus using the Markov chain, characterized in that classified as priority-based forensic behavior, habit-based forensic behavior and semi- habit-based forensic behavior. The method of claim 10, The noise page removal unit An apparatus for analyzing cyber criminal behavior using a Markov chain, characterized by removing noise pages according to singular value decomposition. The method of claim 10, The transition matrix component is Including a data mining module for performing data mining on the selected forensic behavior, The selected forensic behavior is cyber criminal behavior analysis apparatus using the Markov chain, characterized in that stored in the form of a hierarchical document of XML or AXML. The method of claim 15, The final probability vector value

Is Initial value determined in advance according to the data mining (initial value)

A transition matrix based on the user's behavior data

The total number of forensic behavior data performed by the user

In this case, the cyber criminal behavior analysis device using the Markov chain, characterized by the following equation 2.

(2)

Images