KR101897395B1 - Design and System for managing Security Vulnerability based Standard Dataset for Developing and Validating Cyber Warfare Scenarios - Google Patents

Abstract

More particularly, the present invention relates to a technique for designing a security vulnerability database for verifying the effectiveness of cyberspace scenario creation and the validity of a cyber attack in an environment of a cyberspace modeling environment (Constructive Modeling Environment) And a system and method for responding to standard data-based security vulnerabilities.
According to the present invention, by using the vulnerability database, it is possible to support the efficiency of creating the interim scenario by providing a selection criterion for selecting a vulnerability for exploiting the weakness when creating the interim scenario, in accordance with the purpose of the scenario.

Description

Technical Field [1] The present invention relates to a method and system for responding to a standard data base security vulnerability for creating a cyber scenario,

More particularly, the present invention relates to a security vulnerability database (DB) for verifying the effectiveness of cyberspace scenario creation and the effectiveness of a cyber attack in an environment of a cyber-modeling environment (Constructive Modeling Environment) And a system and method for responding to standard data-based security vulnerabilities for design.

In addition, the present invention can be applied to common vulnerability and exposure (CVE), Common Weakness Enumeration (CWE), Common Platform Enumeration (CPE), Common Vulnerability Scoring System Vulnerability Scoring System (CVSS), and the like), which are designed and constructed based on open standard data that manages security vulnerability data.

The environment of the interim configuration model is an environment for modeling and simulating the interim operation environment simulating the military field communication environment as the interim version execution space and the cyber attack and defense technology. The source code of the target software (operating system, various application programs, etc.) to which detection and infiltration (cyber attack) and exploit (malicious behavior) Since there is no such standard, it is necessary to establish standards for verifying the validity of cyber attack and scenario version creation. These standards should not be arbitrarily determined, and should be able to accurately reflect the process by which actual cyber attacks are triggered and the damage is occurring.

On the other hand, organizations that include representatives of security-related organizations, such as government agencies, universities and research institutes, security tool manufacturers, and other security experts in developed countries to manage and share security vulnerability information in computer systems, Related information.

As part of this effort, Common Vulnerability and Exposure (CVE) is used to provide identifiers for sharing information of known vulnerabilities that are the epicenter of cyber attacks. The CVE list includes CVE name, vulnerability and exposure summary , And corresponding reference materials.

In addition, to manage CVE, the Common Weakness Enumeration (CWE) study, which is a list and classification system of vulnerability types, was launched. After the release of the full version in September 2008, more than 40 companies and research institutes cooperated and developed continuously. Going out. CWE systematically catalogs vulnerability types to identify various software vulnerabilities such as SQL injection, cross-site scripting, and buffer overflow.

Common Platform Enumeration (CPE) is a defined list to identify vulnerability information related to hardware, software, operating systems, applications, and so on.

The Common Vulnerability Scoring System (CVSS) is an open framework that scales vulnerabilities to a variety of heterogeneous hardware and software platforms to rank their severity. Scoring vulnerability points across all hardware and software platforms allows uniform vulnerability management policies. There are three groups of CVSS: Base, Temporal, and Environment. Each group provides numeric scores ranging from 0 to 10.

We can use the vulnerability information as a criterion for creating the interim scenario and checking the validity of the cyber attack in the interim version environment. However, since CVE, CWE, CPE, and CVSS are provided independently of each other, it is possible to analyze the association between various open standard data to support the validation of interim attack or to create interim attack and defense scenario, There is no system. Therefore, there is a disadvantage that there is a difficulty in manually utilizing related data according to the user's needs.

1. Korean Registered Patent No. 10-1460589 (Registered on May 31, 2014)

1. Hong, Young-Ran, "Siderification Modes and Response Strategies" Military Science Policy Research Vol.6 No.1 (2013) pp.1-69

The present invention has been proposed in order to solve the problem according to the above background art, and it is possible to confirm the known vulnerability information from the security vulnerability DB when creating the interim scenario in the environment of the version version scheme, A security vulnerability that verifies the validity of cyber attacks based on open standard data such as Common Vulnerability and Exposure (CVE), Common Weakness Enumeration (CWE), Common Platform Enumeration (CPE), and Common Vulnerability Scoring System (CVSS) The purpose of this paper is to provide a standard data foundation security vulnerability countermeasure method and system for DB design.

In addition, the present invention provides vulnerability information for a hardware and / or software platform to be subjected to a specific cyber attack based on CVSS severity, based on Indicators of Compromise (IOC) analysis, The present invention also provides a system and method for responding to security vulnerabilities based on standard data, which enables a user to select a vulnerability suitable for creating a user-side version scenario.

In order to accomplish the above-mentioned object, in order to achieve the above-mentioned object, in order to determine whether the cyber attack is infiltrative or malicious attempt is successful, CVE Standard data for designing a security vulnerability DB that verifies the validity of cyber attacks based on open standard data such as Common Vulnerability and Exposure, Common Weakness Enumeration (CWE), Common Platform Enumeration (CPE), and Common Vulnerability Scoring System (CVSS) Based security vulnerability.

The standard data-based security vulnerability countermeasure method is a standard data-based security vulnerability countermeasure method for creating and verifying the interim scenario in the environment of the sideview configurator,

(a) creating a sideview scenario for the cyber attack simulation by the scenario generation module, arranging the model and changing attributes of the deployed model;

(b) querying the Common Platform Vulnerability and Exposure (CVE) with weak Common Platform Enumeration (CPE) information to a predefined security vulnerability database;

(c) querying the vulnerability CVE information for the CPE platform information by the query processing module to the vulnerability database;

(d) querying the Common Vulnerability Scoring System (CVSS) information for the CVE by the query processing module to the vulnerability database;

(e) the query processing module queries an IOC (Indicators of Compromise) information about the CVE to a security vulnerability database;

(f) the query processing module querying the security vulnerability database for a user analysis result for the CVE;

(g) querying the CVE description related keyword to the security vulnerability database by the query processing module;

(h) performing a simulation based on the interim version scenario by the simulated module; And

(i) the query processing module queries the security vulnerability database for validation information on an interim version attack.

In this case, the step (i) may further include determining whether the corresponding CPE has a CVE vulnerability, and determining whether there is a possibility of the CVE vulnerability, as a response value.

The method may further include storing the simulation result in the security vulnerability database according to the simulation end after the step (i).

Also, the security vulnerability database may be generated according to Table 1.

turn Table name Table identifier Contents One IOC table IOC IOC saves main field information 2 IOC-CVE mapping table IOC_has_CVE Save IOC and CVE mapping information 3 CVE-CPE-CWE mapping table NVD_CVE NVD Data feed data storage 4 CPE Dictionary Table Vul-platform-CPE Store CPE dictionary information 5 CVE-CWE mapping table CWE_has_NVD-CVE Save CVE and CWE mapping information 6 CWE basic information table CWE CWE Main Field Information Storage 7 CWE Vulnerability Scope Table CWE-Consequence_Scope Save CWE Consequence Range 8 CWE Technology Impact Tables CWE-Consequence_Technical_Impact Save CWE Consequence Technology Impact Mapping Information 9 Analysis result table Analysis_Result Save your analysis results 10 Analysis results CPE table Analysis_Result-CPE List of CPEs used in the analysis 11 Analysis of the CVE table Analysis_Result-CVE List of CVEs used in the analysis 12 CVE Basic Information Table CVE Save CVE description information 13 CVE Reference CVE-reference Store CVE reference information 14 CVE search keywords CVE_keywords Save CVE keyword information 15 Cyber Effect Keywords Cyber_Effect Save Cyber-effect information 16 CVE-CyberEffect mapping table CVE_has_Cyber_Effect Save CVE and Cyber-effect mapping information 17 CVE-CVE Keyword Mapping Table CVE_has_CVE_keywords Save CVE and CVE keyword mapping information 18 Cyber Effet-CVE Keyword Mapping Table Cyber_Effect_has_CVE_keywords Save Cyber-effect and CVE keyword mapping information

In addition, the IOC table may include an infringement event ID, an associated event ID, a date and time of discovery, a start date and time, an end date and time, a report date and time, an explanation, an evaluation, a use method and contact information.

Also, the IOC-CVE mapping table includes an event ID and CVE ID information, and the CVE-CPE-CWE mapping table includes CVE ID, CVSS score, CVSS access location, CVSS access complexity, CVSS authentication count, , CVSS Integrity Impact Factor, CVSS Availability Impact Factor, Source, and CWE ID information.

Also, the CPE dictionary table includes a CVE ID and CPE ID information, and the CVE-CWE mapping table may include CVE ID and CWE ID information.

The analysis result table includes an analysis result ID, an attack success rate, a defense success rate, a host infection rate, a host infection blocking rate, an IER (Information Security Information (IER) Information) information, a CWE ID, a classification, Exchange Requirement) success rate information.

Also, as a result of the analysis, the CPE table includes an analysis result ID and CPE ID information,

As a result of the analysis, the CVE table includes an analysis result ID and CVE ID information. The CVE basic information table includes a CVE ID, a status, a description, a related IOC count, a cumulative attack success rate, a cumulative host infection rate, Rate, cumulative IER success rate, and user analysis frequency information.

In addition, the CVE reference table includes a CVE ID, an information source, an information source management ID, and reference URL (uniform resource locator) information. The CWE vulnerability range table includes a CWE ID and vulnerability impact classification information. The impact table may include CWE ID, technical impact classification information.

Also, the CVE-Cyber Effect mapping table includes a CVE ID and cyber effect ID information, and the CVE-CVE keyword mapping table includes a CVE ID, an attack position, an attack agent, and attack behavior information, An attack position, an attack agent, and attack information.

In addition, the CVE-CVE keyword mapping table may include a cyber effect ID, an attack position, and attack agent information.

In addition, the responding CVE information is sorted based on the CVSS score, the number of related IOCs, the cumulative effect index, and the number of analyzed users, so that a vulnerability having a high degree of relevance for scenario creation purposes is presented first.

In addition, the sorting based on the number of related IOCs can be used based on the number of IOCs containing CVEs by using the CVE data included in the information of the IOC for sharing the cyber infringement accident information.

In addition, the sorting based on the cumulative effect index uses an average value of each interim effect index calculated as a result of executing the scenario including the CVE, and the sorting based on the user analysis count is performed by the user. And the number of times of use is used as a reference.

On the other hand, one embodiment of the present invention is a standard data-based security vulnerability countermeasure system for creating and verifying validity of an interim scenario in an environment of a sideview configurator, wherein the input information generated by the input unit is used for simulating a cyber attack A scenario generation module for generating a interim scenario and arranging the model and changing attributes of the deployed model; The method includes: querying vulnerable Common Platform Enumeration (CPE) information for Common Vulnerability and Exposure (CVE) to a previously set security vulnerability database; querying the vulnerability CVE information for the CPE platform information to the vulnerability database; The inquiry processing module queries the CVS information about the CVE to the security vulnerability database, queries the relevant IOC (Indicators of Compromise) information about the CVE to the security vulnerability database, A query processing module for querying the user analysis result of the CVE with the security vulnerability database and the query processing module querying the CVE description related keyword to the security vulnerability database; And a simulation module for performing simulation on the basis of the sideview scenario.

In this case, the inquiry processing module may query the security vulnerability database for validation information on the sideview attack.

 According to the present invention, by using the vulnerability database, it is possible to support the efficiency of creating the interim scenario by providing a selection criterion for selecting a vulnerability for exploiting the weakness when creating the interim scenario, in accordance with the purpose of the scenario.

In addition, as another effect of the present invention, vulnerability information known at the time of creating the interim scenario in the environment of the version version configurationmodule can be checked from the security vulnerability database to determine whether penetration of the cyber attack or malicious behavior attempt is successful before the execution of the scenario , And the ability to improve the efficiency of sideview scenario creation by providing vulnerability selection criteria for the purpose of creating a sideview scenario.

Further, as another effect of the present invention, CVE (Common Vulnerability and Exposure), Common Weakness Enumeration (CWE), Common Platform Enumeration (CPE), and Common Vulnerability Scoring System The vulnerable CPE information can be obtained from the CVE, and the CVE information existing in the CPE can be obtained for the CPE query.

In addition, another effect of the present invention is that the CVE description information can be retrieved through a keyword search, and the validity of a cyber attack can be confirmed.

Further, as another effect of the present invention, when providing vulnerability information for a specific CPE, it is based on CVSS severity, IOC analysis basis, effect index based on existing simulation analysis result, sort of vulnerability based on user analysis information, And the ability to provide information efficiently when responding to and analyzing vulnerabilities by presenting high-level vulnerabilities to users.

FIG. 1 illustrates a relationship between a security vulnerability DB table and a table of a vulnerability database 100 according to an embodiment of the present invention.
2 is a conceptual diagram illustrating a concept of a query and a response to the vulnerability DB 100 shown in FIG.
FIG. 3 is a flowchart illustrating a process of creating a scenario using a vulnerability DB in an environment of a version version configuration model according to an exemplary embodiment of the present invention.
4 is a block diagram of a system 400 for supporting a standard data-based security vulnerability according to an embodiment of the present invention.
FIG. 5 is a table showing a list of identifiers and contents of tables constituting a security vulnerability DB according to an embodiment of the present invention.
FIG. 6 is an exemplary screen provided to a user in response to a Common Vulnerability and Exposure (CVE) information response to a Common Platform Enumeration (CPE) according to an exemplary embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

Like reference numerals are used for similar elements in describing each drawing.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. The term "and / or" includes any combination of a plurality of related listed items or any of a plurality of related listed items.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Should not.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to the preferred embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to like elements throughout.

FIG. 1 illustrates a relationship between a security vulnerability DB table and a table of a vulnerability database 100 according to an embodiment of the present invention. Referring to FIG. 1, an IOC (Indicators of Compromise) table 110 includes an ID of an infringement event, an ID of an incident, a discovery date and time, a start date and time, a date and time, Contact information, and includes at least zero or more Common Vulnerability and Exposure (IOC-CVS) mapping table (IOC_has_CVE) 111 information.

The IOC-CVE mapping table 111 includes an event ID and CVE ID information and is always included in the IOC table 110 and the CVE basic information table 120. [

The CVE-CPE-CWE mapping table (NVD (CVE) -CVE) 131 includes CVE ID, Common Vulnerability Scoring System (CVSS) score, CVSS access location, CVSS access complexity, , CVSS confidentiality impact level, CVSS integrity impact level, CVSS availability impact level, source, Common Weakness Enumeration (CWE) ID information. Also, the CVE-CPE-CWE mapping table 131 has at least zero CPE-table-to-CPE 130 information and one or more CVE-CWE mapping table CWE_has_NVD-CVE 140 information , And may be included in the CVE basic information table 120.

The CPE dictionary table 130 includes a CVE ID and CPE ID information, and is necessarily included in the CVE-CPE-CWE mapping table 131.

The CVE-CWE mapping table 140 includes a CVE ID and CWE ID information and is necessarily included in the CVE-CPE-CWE mapping table 131 and the CWE basic information table 150.

The CWE basic information table 150 includes a CWE ID, classification, vulnerability name, status, and explanatory information.

The analysis result table (Analysis_Result) 161 may include an analysis result ID, an attack success rate, a defense success rate, a host infection rate, a host infection blocking rate, and an information exchange requirement (IER) success rate information. In addition, the analysis result table 161 has information on one or more analysis result CPE tables (Analysis_Result-CPE) 161 and one or more analysis result CVE tables (Analysis_Result-CVE) 121.

As a result of the analysis, the CPE table 161 includes an analysis result ID and CPE ID information and is necessarily included in the analysis result table 160.

As a result of analysis, the CVE table (Analysis_Result-CVE) 121 includes the analysis result ID and the CVE ID information and is included in the analysis result table (Analysis_Result) 160 and is included in one or more CVE basic information tables 120 .

The CVE basic information table 120 may include a CVE ID, a status, a description, the number of related IOCs, a cumulative attack success rate, a cumulative defense success rate, a cumulative host infection rate, a cumulative host infection blocking rate, a cumulative IER success rate, . The CVE basic information table 120 may have information on one CVE-CPE-CWE mapping table 131, and may include zero or more IOC-CVE mapping table 111 information, zero or more CVE reference tables (CVE- (122) information, at least one CVE-CyberEffect mapping table (CVE_has_Cyber_Effect) 123 information, and at least one CVE-CVE keyword mapping table (CVE_has_Cyber_keywords) 171 information.

The CVE reference table 122 includes a CVE ID, an information source, an information source management ID, and reference URL (uniform resource locator) information, and may be included in the CVE basic information table 120.

The CWE basic information table 150 includes at least one CVE-CWE mapping table 140 information and at least CWE-Consequence_Scope 151 (CWE-CWE) information including CWE ID, classification, vulnerability name, ) Information and zero or more CWE technology influence tables (CWE-Consequence_Technical_Impact) 152 information.

The CWE vulnerability range table 151 includes the CWE ID and the vulnerability impact classification information, and may be included in the CWE basic information table 150.

The CWE technology influence table 152 includes a CWE ID and a technology influence classification information and may be included in the CWE basic information table 150. [

The CVE-Cyber Effect mapping table (CVE_has_Cyber_Effect) 123 includes a CVE ID and cyber effect ID information, and may be included in the CVE basic information table 120 and the Cyber_Effect table 180.

The Cyber_Effect table 180 includes cyber effect ID information and has information of 0 or more CVE-Cyber Effect mapping table (CVE_has_Cyber_Effect) 123 and information of 0 or more Cyber Effect-CVE keyword mapping table (Cyber_Effect_has_CVE_keywords) 181 .

The CVE-CVE keyword mapping table (CVE_has_Cyber_keywords) 171 includes a CVE ID, an attack position, an attacking agent, and attacking information, and is necessarily included in the CVE basic information table 120 and the CVE search keyword table (CVE_keywords) do.

The search keyword table 170 includes an attack position, an attack agent, and attack action information, and includes information on the CVE_has_Cyber_keywords table 171 and information on the Cyber_Effect_has_CVE_keywords table 181.

The CVE-CVE keyword mapping table (Cyber_Effect_has_CVE_keywords) 181 includes a cyber effect ID, an attack position and an attacking agent information. The Cyber Effect keyword table (Cyber_Effect) 180 and the CVE search keyword table (CVE_keywords) .

2 is a conceptual diagram illustrating a concept of a query and a response to the vulnerability DB 100 shown in FIG. Referring to FIG. 2, the security vulnerability database 100 constructed based on FIG. 1 derives one or more CPE information having a corresponding vulnerability as a response value to the CVE query 270 at the time of creating a scenario in the environment of the sideview configurator, CVE information, which is a vulnerability of the platform, to the CPE query 260 is derived as a response value.

In response to the CVE information, the CVSS score, the number of related IOCs, the cumulative effect index, and the user analysis frequency information are provided together, and when the user selects each classification, the CVE information is sorted in descending order of the degree of threat.

CVSS score-based sorting is based on the CVSS score calculated based on CVSS access location, access complexity, number of authentications, confidentiality impact, integrity impact, and availability impact.

Relevant IOC-based sorting is based on the number of IOCs that contain CVEs using CVE data contained in the IOC's information for sharing cyber-infringement incident information.

Cumulative effect index-based sorting uses the average value of each interim effect index calculated as a result of execution of a scenario containing the CVE, and the sorting based on the number of analysis times is based on the number of times the corresponding CVE is used by the user .

In order to inquire detailed information about the related CVSS, the CVS access location, access complexity, authentication frequency, confidentiality degree, integrity impact degree, and availability impact score of the corresponding CVE are provided at the CVE inquiry (220). In order to inquire detailed information about the IOC, a list of related IOCs including the corresponding CVE is provided at the CVE inquiry 230. In order to inquire detailed information of the user analysis result, the existing analysis including the corresponding CVE at the CVE inquiry (240) Provide a list of results.

In addition, the security vulnerability DB derives CVE ID and description information as a response value through a CVE-related keyword search 210. When the simulation is performed based on the created scenario, the CPE detects a CVE vulnerability through the CVE query 250 And whether there is a possibility of damage.

FIG. 3 is a flowchart illustrating a process of creating a scenario using a vulnerability DB in an environment of a version version configuration model according to an exemplary embodiment of the present invention. Referring to FIG. 3, a scenario creation process using the security vulnerability DB in the environment of the Said version configuration model will be described with reference to FIG. 3. First, a scenario for the analysis target system and network construction of Said version configuration model is created (step S310) .

Then, the model is placed in the generated scenario and the attribute of the model is changed (step S320). In order to determine the model and attribute to be deployed, the vulnerable CPE information for the CVE is inquired (step S330), the vulnerability information for the CPE platform information is inquired (step S340), the CVSS query for CVE (step S350) The IOOC query (step S360), the user analysis result query for CVE (step S370), and the CVE description keyword (step S380).

Here, the weak CPE information query for CVE includes the CPE response to the CVE query, the vulnerability information query to the CPE platform information, the CVE response to the CPE query, the CVSS query to the CVE, the CVE item score response to the CVE query, The IOC query for the IOC consists of an IOC list response to the CVE query, a user analysis result for the CVE query result is an analysis result list response to the CVE query, and a CVE Description Keyword query consists of the CVE ID and Description response to the Keywords query.

Then, it is determined whether or not the scenario creation is completed (step S381). If it is determined in step S381 that the scenario creation is not completed, steps S310 to S381 are repeated. That is, if it is determined that the scenario creation is not completed, additional model placement and attribute change are performed.

On the other hand, if it is determined in step S381 that the scenario creation is completed, the process proceeds to the simulation execution by executing the scenario (step S390).

Thereafter, the security vulnerability DB is inquired for validity against the interim version attack during the simulation (step S391). The interim version attack validity information query consists of the victim response to the CPE and CVE queries.

Thereafter, the simulation end condition such as the simulation execution time is checked and it is determined whether or not it is finished (step S393). If it is determined in step S393 that the termination condition is satisfied, the simulation result is stored in the security vulnerability database (100 of FIG. 2) and the simulation is terminated (step S395).

On the other hand, if it is determined in step S393 that the end condition is not satisfied, the simulation execution is continued. If it is further determined, steps S390 to S393 are performed again.

When saving simulation results, it stores the effect indicators and CVE and CPE information used in simulation in the analysis result table, and updates cumulative effect indicators and user analysis counts of CVE table.

4 is a block diagram of a system 400 for supporting a standard data-based security vulnerability according to an embodiment of the present invention. 4, an input unit 410 for receiving input from a user and generating input information, a scenario generation module 430 for generating a scenario according to input information, and a vulnerability database (100 in FIG. 1) A query module 420 for querying and obtaining response information, a simulation module 440 for performing a simulation according to a scenario, a network 450 connected to a simulation module 440, and the like .

The scenario generation module 430 generates a sideview scenario for cyber attack simulation through the input information generated by the input unit 410, and arranges the model and changes the attributes of the deployed model.

The query processing module 420 queries the vulnerable Common Platform Enumeration (CPE) information for CVE (Common Vulnerability and Exposure) to a preset security vulnerability database, and the query processing module transmits vulnerability CVE information for the CPE platform information Querying the security vulnerability database, and the inquiry processing module queries the CVS information about the CVE to the security vulnerability database, and transmits related IOC (Indicators of Compromise) information to the security vulnerability database The query processing module queries the vulnerability database of the user analysis result of the CVE, and the query processing module performs a function of querying the CVE description related keyword to the security vulnerability database.

The network 450 may be a military communication network to which the scenario can be applied.

FIG. 5 is a table showing a list of identifiers and contents of tables constituting a security vulnerability DB according to an embodiment of the present invention.

FIG. 6 is an exemplary screen provided to a user in response to a Common Vulnerability and Exposure (CVE) information response to a Common Platform Enumeration (CPE) according to an exemplary embodiment of the present invention. Referring to FIG. 6, an example of a screen provided to a user in response to a CVE information response to a CPE includes CVE information about the CPE that the user has queried, CVSS score, number of related IOCs, cumulative average value, And provides the user with the desired CVE item through priority sorting for each item.

In addition, when the CVSS score part is inquired in detail, it provides information on access location, access complexity, number of authentication, confidentiality degree, integrity impact degree, availability impact degree of corresponding CVE, and IOC event ID, related event ID, date and time of discovery, date and time of start, end date, date and time of report, description, evaluation, usage technique, and contact information. In addition, it can provide a list of CPE and CVE that used the results analyzed by the past users in each effect indicator and analysis when detailing the user analysis part.

The terms " part, "" module," and the like, which are described in the specification, denote a unit for processing at least one function or operation, and may be implemented by hardware or software or a combination of hardware and software.

(DSP), a programmable logic device (PLD), a field programmable gate array (FPGA), a processor, a controller, a microprocessor, and the like, which are designed to perform the above- , Other electronic units, or a combination thereof. In software implementation, it may be implemented as a module that performs the above-described functions. The software may be stored in a memory unit and executed by a processor. The memory unit or processor may employ various means well known to those skilled in the art

100: Security Vulnerability Database
400: Standard Data Foundation Security Vulnerability Response System
410:
420: Query Processing Module
430: scenario generation module
440: Simulation module
450: Network

Claims (6)

In a standard data foundation security vulnerability countermeasure method for creating and verifying the interim scenario in the environment of the interim version configuration,
(a) creating a sideview scenario for the cyber attack simulation by the scenario generation module, arranging the model and changing attributes of the deployed model;
(b) querying the Common Platform Vulnerability and Exposure (CVE) with weak Common Platform Enumeration (CPE) information to a predefined security vulnerability database;
(c) querying the vulnerability CVE information for the CPE platform information by the query processing module to the vulnerability database;
(d) querying the Common Vulnerability Scoring System (CVSS) information for the CVE by the query processing module to the vulnerability database;
(e) the query processing module queries an IOC (Indicators of Compromise) information about the CVE to a security vulnerability database;
(f) the query processing module querying the security vulnerability database for a user analysis result for the CVE;
(g) querying the CVE description related keyword to the security vulnerability database by the query processing module;
(h) performing a simulation based on the interim version scenario by the simulated module; And
(i) the query processing module querying the security vulnerability database for validation information for an interim version attack;
And generating a SIDVISION scenario and verifying validity of the SIDVISION scenario.
The method according to claim 1,
The method of claim 1, wherein the step (i) further comprises the step of providing, as a response value, whether the CPE has a CVE vulnerability, How to respond to the vulnerability.
The method according to claim 1,
Wherein the security vulnerability database is generated according to Table 1, and a standard data-based security vulnerability countermeasure method for creating and validating a saver version scenario.
[Table 1]

The method of claim 3,
The IOC table includes an infringement event ID, an incident event ID, a discovery date and time, a start date and time, an end date and time, a report date and time, a description, an evaluation,
The IOC-CVE mapping table includes an event ID and CVE ID information,
The CVE-CPE-CWE mapping table includes CVE ID, CVSS score, CVSS access location, CVSS access complexity, CVSS authentication count, CVSS confidentiality impact degree, CVSS integrity impact degree, CVSS availability impact degree, source, CWE ID information,
The CPE dictionary table includes CVE ID and CPE ID information,
The CVE-CWE mapping table includes CVE ID and CWE ID information,
The CWE basic information table includes a CWE ID, a classification, a vulnerability name, a status, and explanation information,
The analysis result table includes the ID of the analysis result, the attack success rate, the defense success rate, the host infection rate, the host infection blocking rate, and the information exchange requirement (IER) success rate information,
As a result of the analysis, the CPE table includes an analysis result ID and CPE ID information,
As a result of the analysis, the CVE table includes an analysis result ID and CVE ID information,
The CVE basic information table includes CVE ID, status, description, related IOC count, accumulated attack success rate, cumulative defense success rate, cumulative host infection rate, cumulative host infection blocking rate, accumulated IER success rate,
The CVE reference table includes a CVE ID, an information source, an information source management ID, and a reference URL (uniform resource locator)
The CWE vulnerability range table includes a CWE ID and vulnerability impact classification information,
The CWE technology influence table includes CWE ID, technical impact classification information,
The CVE-Cyber Effect mapping table includes a CVE ID and cyber effect ID information,
The CVE-CVE keyword mapping table includes a CVE ID, an attack position, an attacking agent, and attacking action information,
Wherein the search keyword table includes an attack position, an attack agent, and attack behavior information,
Wherein the CVE-CVE keyword mapping table includes a cyber-effect ID, an attack location, and attacker information.
5. The method of claim 4,
The respondent CVE information is sorted based on the CVSS score, the number of related IOCs, the cumulative effect index, and the number of users analyzed.
The sorting based on the number of related IOCs is performed based on the number of IOCs containing the CVE using the CVE data included in the information of the IOC for sharing the cyber infringement accident information, Is used as an average value of the interim effect indicators calculated as a result of executing the scenario including the CVE, and the sorting is based on the number of times the corresponding CVE is used by the user based on the user analysis count. How to respond to standard data foundation security vulnerabilities for creating version scenarios and validating them.
In a standard data foundation security vulnerability countermeasure system for creating and validating interim scenarios in the environment of a middleware version,
A scenario generation module for generating an interim scenario for the cyber attack simulation through the input information generated by the input unit and arranging the model and changing attributes of the deployed model;
The method includes: querying vulnerable Common Platform Enumeration (CPE) information for Common Vulnerability and Exposure (CVE) to a previously set security vulnerability database; querying the vulnerability CVE information for the CPE platform information to the vulnerability database; The inquiry processing module queries the CVS information about the CVE to the security vulnerability database, queries the relevant IOC (Indicators of Compromise) information about the CVE to the security vulnerability database, A query processing module for querying the user analysis result of the CVE with the security vulnerability database and the query processing module querying the CVE description related keyword to the security vulnerability database; And
And a simulation module that performs simulation based on the Said version scenario,
Wherein the query processing module queries the security vulnerability database for validation information on the sideview attack, and generates a sideview scenario and validates the security vulnerability.

Images