KR102001958B1 - System and method for analyzing trend of infringement by calculating entropy of graph data and computer program for the same - Google Patents

Abstract

A system for analyzing invasion activity trend comprises: an event processing unit configured to determine whether to call for entropy calculation; an information amount change calculation unit called by the event processing unit, and configured to generate a graph query for the entropy calculation and calculate an entropy value of a graph database based on a return value received in response to the graph query from the graph database including one or more graph data related to an invasion activity; a graph database query processing unit configured to receive the graph query from the information amount change calculation unit, and receive the return value by inquiring the graph database based on the graph query; and a threshold monitoring unit configured to monitor a sum of entropy values calculated at a plurality of time points by the information amount change calculation unit. According to the system for analyzing invasion activity trend, it is possible to realize continuous monitoring of threat information, which is currently in an inactive state (or a state before activity) through periodic entropy calculation and extraction of graph data.

Description

BACKGROUND OF THE INVENTION Field of the Invention The present invention relates to a system and method for analyzing trends in infiltration activity through calculation of entropy of graph data,

More particularly, the present invention relates to a system and method for analyzing trends in infringing activities and a computer program for the same. More particularly, the present invention relates to a technique for analyzing trends of infringing activities by observing data variation through calculation of entropy values for graph data Lt; / RTI >

As the big data related technologies are actively researched, researches in the field of machine learning that classifies and predicts the technology for storing and managing big data and data are actively being carried out. Pattern classification technology is used for document classification such as news, blog, SNS, issue classification, emotional classification. On the other hand, a relational database for storing data in the form of a table has been mainly used as a technique for storing and managing data.

In recent years, as a data storage and management technique, a graph database has emerged as a solution for expressing and storing each data object and the association relation of the object. Compared to a relational database that stores each object in accordance with the schema structure defined in the table, the graph database stores each data as one object and maintains the relationship between the objects without detracting from the characteristics of each object And it is advantageous for integrated storage management of fixed and unstructured data.

For example, as Figure 1 is an exemplary form of the graph data stored in the graph _{database, [R 1: A → B} ], [R 2: A + B → C + D], [R 3: D → E] Is represented by graph data. A to E represent reactants participating in the chemical reaction, which correspond to each node of the graph data. R ₁ to R ₃ represent chemical reactions, which correspond to the respective edges of the graph data.

Korean Patent Registration No. 10-1697875

According to one aspect of the present invention, as a utilization method of data stored in the form of a graph, periodic entropy calculation and extraction of graph data to continuously monitor the current inactive state (or the pre-activity state) And a computer program for the infiltration activity change analysis system and method.

The infiltration activity trend analyzing system according to an embodiment includes an event processor configured to determine whether to call for entropy calculation; Invoking by the event processor to generate a graph query for entropy computation and to retrieve entropy of the graph database based on a return value received corresponding to the graph query from a graph database containing one or more graph data associated with an infringement activity, An information amount change calculation unit configured to calculate a value; A graph database query processing unit configured to receive the graph query from the information amount change calculation unit, receive the return value by querying the graph database based on the graph query; And a threshold monitoring unit configured to monitor a sum of the entropy values calculated at a plurality of time points by the information amount change calculation unit.

In one embodiment, the event processing unit is further configured to call the information amount change calculation unit in response to a request received from the user or periodically.

In one embodiment, the threshold monitoring unit is further configured to monitor whether a cumulative sum of the periodically calculated entropy values exceeds a preset threshold value.

In one embodiment, the information amount change calculation unit may calculate, in the graph database, the entropy value using the ratio of the number of graph data that satisfies the preset condition for the number of graph data satisfying the preset condition and newly generated or changed Lt; / RTI >

라고 할 경우,

의 수학식에 의하여 상기 엔트로피 값을 계산하도록 더 구성된다.In one embodiment, the information amount change calculator calculates the entropy value as H (x), the number of graph data satisfying the preset condition as G, the time as t, the time interval i, G _i is the number of generated or changed graph data, and the probability that the newly generated or changed graph data appears in the entire graph data satisfying the preset condition

If so,

To calculate the entropy value according to the following equation.

The method for analyzing infringement activity according to an exemplary embodiment includes the steps of: an event processing unit of an infringement activity trend analyzing system calls an information amount change calculating unit of the infringement activity trend analyzing system; Wherein the information amount change calculation unit generates a graph query for entropy calculation; Receiving a return value from the graph database by querying a graph database including one or more graph data based on the graph query, the graph database query processing unit of the infiltration activity trend analysis system; Calculating an entropy value of the graph database based on the return value; And a threshold monitoring unit of the infiltration activity trend analyzing system monitors the sum of the entropy values calculated at a plurality of time points by the information amount change calculating unit.

In one embodiment, the step of calling the information amount change calculator is performed in response to a request received from the user to the event processing unit or periodically.

In one embodiment, monitoring the sum of the entropy values comprises monitoring whether the cumulative sum of the periodically calculated entropy values exceeds a predetermined threshold.

In one embodiment, the step of calculating the entropy value may include calculating, in the graph database, a ratio of the number of graph data that satisfies the preset condition for the number of graph data satisfying the preset condition and newly generated or changed And calculating the entropy value.

라고 할 경우,

의 수학식에 의하여 상기 엔트로피 값을 산출하는 단계를 포함한다.In one embodiment, the step of calculating the entropy value may include calculating the entropy value as H (x), the number of graph data satisfying the preset condition as G, the time as t, G _i is the number of graph data that satisfies the predetermined condition, and G _i is the number of newly generated or changed graph data.

If so,

And calculating the entropy value according to the following equation.

The computer program according to one embodiment may be stored in a computer-readable medium for execution of the infringement activity trend analysis method according to the above-described embodiments in combination with hardware.

According to an exemplary embodiment of the present invention, there is provided a system and method for analyzing an infringement activity, comprising: a scheduler for extracting a change amount with respect to threat information in a graph database in a form of an entropy value according to a predetermined schedule (e.g., Through the monitoring of the sum of entropy values, infiltration threat information accumulated in the graph database can be continuously inquired and extracted. Using the extracted entropy and the time series change information, it is possible to detect the current inactive state It is possible to implement continuous monitoring (function or service type) on the information.

1 is a conceptual diagram showing an exemplary form of graph data stored in a graph database.
2 is a schematic block diagram of an infringement activity trend analysis system according to an embodiment.
FIG. 3 is a flowchart of a method for analyzing an infringement activity trend according to an embodiment.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

2 is a schematic block diagram of an infringement activity trend analysis system according to an embodiment.

In one embodiment, the infringement activity trend analysis system includes an event processing unit 10, an information amount change calculation unit 20, a graph database query processing unit 31, and a threshold value monitoring unit 40. In one embodiment, the infringement activity trend analysis system further includes a graph database storage 32 in which a graph database containing one or more graph data is stored.

The infiltration activity trend analysis system 10 according to the embodiments may be entirely hardware, or partially hardware, and partially software. For example, each unit included in the infringement activity trend analysis system 10 may collectively refer to hardware and related software for processing data of a specific type and contents and / or for exchanging data by an electronic communication method. The terms "part", "module", "device", "terminal", "server" or "system" are used herein to refer to a combination of hardware and software driven by that hardware. For example, the hardware may be a data processing device comprising a CPU or other processor. Also, the software driven by the hardware may refer to a running process, an object, an executable, a thread of execution, a program, and the like.

In addition, each element constituting the infringing activity trend analysis system according to the present embodiment is not intended to refer to a separate apparatus which is physically separated from each other. That is, the event processing unit 10, the information amount change calculation unit 20, the graph database query processing unit 31, the graph database storage unit 32, and the threshold value monitoring unit 40 of FIG. 2 constitute an infringement activity trend analysis system The hardware is functionally divided according to the operation performed by the corresponding hardware, but the respective units do not necessarily have to be provided independently of each other. Of course, depending on the embodiment, at least one of the event processing unit 10, the information amount change calculation unit 20, the graph database query processing unit 31, the graph database storage unit 32, and the threshold value monitoring unit 40 may physically It is also possible to implement them as separate devices which are distinguished.

The graph database storage unit 32 stores a graph database including one or more graph data. The graph data of the graph database stored in the graph database storing unit 32 includes a plurality of nodes corresponding to the data objects and an edge connecting between the nodes and indicating an association between the data objects . At this time, a plurality of nodes may be connected to one edge at the same time. Further, each edge may be a vector having directionality.

At this time, one or more graph data included in the graph database may be related to infringement activity. In this specification, infringing activity refers to any malicious activity that causes unauthorized access, malfunction, misuse, modification, destruction, etc. to a process, a file, a registry, a network, do. Graph data can store various types of Indicators of Compromise (IoC) data objects associated with these infringing activities and their associations.

For example, "A specific hacker group A attacked a specific domain using a software tool with a particular hash value, and the IP interval used for the bypass was XXX.XXX.XXX.XXX ~ YYY.YYY. YYY.YYY "is to be stored as graph data. At this time, the data structure of the graph data is defined as nodes of the data object, such as IP, domain, software tool, hash value, and hacker group A, which are infringement information included in the sentence, .

Also, in the embodiments, the graph data may be a property graph, but it is not limited thereto, in which there can exist several relations and weights at edges between objects.

The infiltration activity trend analysis system according to the present embodiment is a system for analyzing infringement activity according to the present invention by calculating and extracting periodic entropy on the graph database storing the graph data as described above, The purpose of this study is to implement continuous monitoring function.

For this purpose, the event processing unit 10 may call the information amount change calculation unit 20 in accordance with a request from the user or periodically according to a specific time or a specific event.

When invoked by the event processing unit 10, the information amount change calculation unit 20 can generate a graph query for entropy calculation. The graph query may be generated by combining a graph query language for extracting threat information data from the graph data. The information amount change calculation unit 20 can transmit the generated graph query to the graph database query processing unit 31.

The graph database query processing unit 31 can obtain a return value by querying the graph database stored in the graph database storage unit 32 based on the transmitted graph query. The graph database query processing unit 31 and the graph database storage unit 32 may be implemented as one database storage device 30, but the present invention is not limited thereto.

The information amount change calculator 20 can calculate an entropy value of threat information in the current time zone with respect to the graph database based on the return value from the graph database. Also, the information amount change calculation unit 20 may store and store the time value and the calculated entropy value. The entropy value may be stored together with the graph database in the graph database storage unit 32 or may be stored in the information amount change calculation unit 20 itself.

The threshold value monitoring unit 40 can check whether the total sum of entropy values of the specific threat information exceeds a predetermined threshold value by checking the sum of entropy values stored by the information amount change calculation unit 20. [ For example, the threshold monitoring unit 40 may periodically check the sum of the time series entropy values. When the sum of the entropy values exceeds the threshold value, the threshold monitoring unit 40 may notify the user apparatus (not shown) or the linkage system (not shown) of the information.

FIG. 3 is a flowchart of a method for analyzing an infringement activity trend according to an embodiment. For convenience of explanation, the method of analyzing the infringing activity according to the present embodiment will be described below with reference to FIG. 2 and FIG.

First, in the event processing unit 10, a preset event processing cycle is checked (S2), and it can be determined whether the cycle is a paging cycle for entropy calculation (S3). The event processing cycle may be configured to be invoked at certain times according to time, or may be configured such that a call is made in response to a specific action of the user.

If the paging cycle has arrived, the event processing unit 10 calls the information amount change calculation unit 20 for entropy calculation (S4). In one embodiment, the information amount change calculator 20 compares the data stored in the graph database in the previous time period to determine whether there is a change in data at the current time (S5). The confirmation of the data change can be made using the capacity and the modification date of the electronic file corresponding to the graph database or the hash value of the graph database generated and stored by the information amount change calculator 20. [

When there is a change in information, the event processing unit 10 generates a graph query and inquires the graph database storage unit 32 through the graph database query processing unit 31 on the basis of the generated graph query to receive a return value from the graph database do. Next, the event processing unit 10 can calculate the entropy using the return value from the graph database (S6).

Specifically, the calculation of the entropy by the information amount change calculation unit 20 is based on the ratio of the number of graph data newly generated or changed while satisfying the predetermined condition with respect to the number of graph data satisfying a predetermined condition in the graph database . ≪ / RTI > At this time, the predetermined condition is to find Indicators of Compromise (IoC) corresponding to the infringing activity in the graph data, and may be variously set according to the infringing activity.

라고 할 경우, 정보량 변화 계산부(20)는 하기 수학식 1에 의하여 엔트로피 값을 산출할 수 있다.For example, when the entropy value obtained by the information amount change calculation unit 20 is H (x), the total number of graph data satisfying the condition of the infringing activity is G, the time is t, Let G _i denote the number of newly created or changed graph data, and let the probability that the newly generated or changed graph data appears in the entire graph data satisfying the infringing activity condition

, The information amount change calculation section 20 can calculate the entropy value by the following equation (1).

[Equation 1]

Equation (1) corresponds to the information entropy (or the Shannon entropy) derived on the basis of the information theory. The information of the ratio of the graph newly generated or changed in the graph data is the expected value The entropy value of Equation (1) is formed and a random variable represented by a probability distribution is formed. In this case, the entropy value of Equation (1) is for measuring a change amount of information with respect to existing information by causing a relatively low information amount to occur frequently and a relatively high information amount to occur at a low frequency occurrence, The entropy value is defined using the logarithm of the event so that the event has a high information amount, and the logarithm of the probability value between 0 and 1 is added so that the resultant value does not deviate from the range.

Next, the information amount change calculation unit 20 can store the calculated entropy value as data (S7). The entropy value may be stored in the graph database storage unit 32 or may be stored in the information amount change calculation unit 20 itself. The calculation and storage of the above entropy values are repeatedly performed in accordance with the paging cycle.

The threshold value monitoring unit 40 requests the entropy value calculated by the information amount change calculation unit 20 and monitors the sum of the entropy values (S8). The threshold value monitoring unit 40 observes whether the sum of the entropy values calculated in a time series (for example, periodically) exceeds a predetermined threshold value (S9). If the sum exceeds the threshold value, the threshold value monitoring unit 40 outputs the information to the user device It is possible to perform an operation of propagating to the linking system (S12).

On the other hand, when the total sum of the entropy values calculated at the present stage does not exceed the threshold value, the threshold value monitoring unit 40 returns to the normal operation to check the threshold value inspection period (S10). When the inspection period comes ), The entropy value is requested and the total sum is reviewed (S8).

Specifically, an example of a process of calculating a sum of time-series entropy values by the threshold value monitoring unit 40 is shown in Table 1 below.

Time (t) 0 One 2 3 4 5 G _i 55 25 10 15 20 30 G 55 80 90 105 125 155 H (x) 0 0.5243975 0.3522139 0.4010507 0.423017 0.4585614 H (x) sum 0 0.52439745 0.87661136 1.2776621 1.7006791 2.1592404

Referring to Table 1, since the number of change G _i of the graph data corresponding to the infringement condition at time t = 0 is 55, and the time t = 0 is the first time period, the total number of graph data corresponding to the infringement condition is 55 .

Next, when the number of change G _i of the graph data corresponding to the infringement condition at time t = 1 is 25, the number G of the entire graph data corresponding to the infringement condition is 80 (= 55 + 25). At this _{time, G i / G = 25/80 =} 0.3125 , and this value is substituted in the right-hand side of equation (1) (-1) * (0.3125) * entropy value by the calculation of the (log ₂ (0.3125)) H (x ) Is obtained as about 0.52439745.

Next, when the entropy value H (x) is calculated at the time t = 2 in the same manner as described above, a value of about 0.3522139 is obtained. At this time, since the threshold value monitoring unit 40 calculates the sum of time series entropy values, the sum of H (x) is (0.52439745 + 0.3522139), and the value of 0.87661366 is obtained. In the same way, the threshold value monitoring unit 40 can obtain the sum of the values of H (x) at t = 3, 4, and 5 as 1.2776621, 1.7006791, and 2.1592404, respectively.

At this time, the threshold monitoring unit 40 compares the sum of H (x) as shown in Table 1 with a preset threshold value and detects when the sum of H (x) exceeds a specific threshold value. For example, in the example of Table 1, assuming that the threshold is 1, the time interval of t = 3, 4, and 5 corresponds to the point at which the information propagation operation must be performed because the total of H (x) exceeds the threshold value.

According to the embodiments of the present invention described above, a scheduler for extracting a change amount in the form of an entropy value with respect to threat information in a graph database according to a predetermined schedule (for example, a time value) The threat information on the graph database can be continuously inquired and extracted by using the extracted entropy and time series change information to continuously monitor threat information in the current inactive state (Function or service type).

Particularly, in the embodiments, the entropy value extracted from the graph database can be accumulated in a time-series form (time sequence data), and the life cycle analysis and change trend of a specific invasion accident can be managed based on the entropy value. For example, the threshold monitoring unit 40 manages the time series data of the infringing information continuously according to the use purpose of the data and the request, and when the entropy value exceeds the threshold value or management is performed according to the life cycle of the infringement analyzed through the time series data If it is deemed necessary, a data optimization operation for reducing entropy can be performed. In this way, there is an advantage that the threat information connection graph can be continuously managed and combined with other technologies by responding to the trend of infringement change which can not be measured with simple threat information.

The operations according to the infringing activity trend analysis method according to the embodiments described above can be at least partially implemented in a computer program and recorded on a computer readable recording medium. The program for realizing the operation according to the infiltration activity trend analysis method according to the embodiments is recorded, and the computer readable recording medium includes all kinds of recording apparatuses in which data that can be read by the computer is stored. Examples of the computer-readable recording medium include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like. The computer readable recording medium may also be distributed over a networked computer system so that computer readable code is stored and executed in a distributed manner. In addition, functional programs, codes, and code segments for implementing the present embodiment may be easily understood by those skilled in the art to which this embodiment belongs.

While the invention has been shown and described with reference to certain embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. However, it should be understood that such modifications are within the technical scope of the present invention. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

Claims (11)

An event processing unit configured to determine whether or not to call for entropy calculation;
Invoking by the event processor to generate a graph query for entropy computation and to retrieve entropy of the graph database based on a return value received corresponding to the graph query from a graph database containing one or more graph data associated with an infringement activity, An information amount change calculation unit configured to calculate a value;
A graph database query processing unit configured to receive the graph query from the information amount change calculation unit, receive the return value by querying the graph database based on the graph query; And
And a threshold monitoring unit configured to monitor a sum of the entropy values calculated at a plurality of time points by the information amount change calculation unit,
The graph data comprising a plurality of nodes corresponding to an infringing indicator data object and an edge between the nodes corresponding to an association between the infringing indicator data objects,
Wherein the event processing unit is further configured to periodically call the information amount change calculation unit,
The threshold monitoring unit monitors whether a cumulative sum of the entropy values calculated periodically exceeds a preset threshold value and performs a data optimization operation for reducing entropy when the cumulative sum of the entropy values exceeds the threshold value More structured infiltration activity analysis system. delete delete The method according to claim 1,
The information amount change calculation unit may calculate the entropy value using the ratio of the number of graph data that satisfies the preset condition for the number of graph data satisfying the preset condition and is newly generated or changed in the graph database Infiltration activity trend analysis system. 5. The method of claim 4,
The information amount change calculator calculates,
G is the number of pieces of graph data satisfying the predetermined condition, Gi is time, t is the number of graph data that satisfies the preset condition and newly generated or changed at time interval i, Gi is the number of pieces of graph data, The probability that the newly generated or changed graph data appears in the entire graph data satisfying the predetermined condition

If so,

To calculate the entropy value according to the following equation: < EMI ID = 1.0 > An event processing unit of the infringement activity trend analysis system calls an information amount change calculation unit of the infringement activity trend analysis system;
Wherein the information amount change calculation unit generates a graph query for entropy calculation;
Receiving a return value from the graph database by querying a graph database including one or more graph data based on the graph query, the graph database query processing unit of the infiltration activity trend analysis system;
Calculating an entropy value of the graph database based on the return value; And
Monitoring a total of the entropy values calculated at a plurality of time points by the information amount change calculation unit, wherein the threshold monitoring unit of the violation activity trend analysis system includes:
The graph data comprising a plurality of nodes corresponding to an infringing indicator data object and an edge between the nodes corresponding to an association between the infringing indicator data objects,
The step of calling the information amount change calculator is periodically performed,
Wherein monitoring the sum of entropy values comprises:
Monitoring whether a cumulative sum of the entropy values periodically calculated exceeds a preset threshold value; And
And performing a data optimization operation for reducing entropy when a cumulative sum of the entropy values exceeds the threshold value. delete delete The method according to claim 6,
Wherein the calculating of the entropy value comprises: calculating, in the graph database, the entropy value by using a ratio of the number of graph data that satisfies the preset condition for the number of graph data satisfying the preset condition and newly generated or changed A method for analyzing the trend of infringing activities including a step of calculating the infringing activity. 10. The method of claim 9,
The step of calculating the entropy value includes:
G is the number of pieces of graph data satisfying the predetermined condition, Gi is time, t is the number of graph data that satisfies the preset condition and newly generated or changed at time interval i, Gi is the number of pieces of graph data, The probability that the newly generated or changed graph data appears in the entire graph data satisfying the predetermined condition

If so,

And calculating the entropy value according to the following equation. A computer program stored in a medium for execution in accordance with any one of claims 6, 9 or 10 in combination with a computer.

Images