KR102002560B1 - Artificial intelligence based target account reconnaissance behavior detection apparatus - Google Patents

Abstract

The present invention relates to an artificial intelligence (AI)-based target account reconnaissance detection device. According to the present invention, the target account reconnaissance detection device comprises: a network activity collecting unit collecting network activities generated through data communications with an external device; an account search event determination unit determining an account search event among the network activities through a machine learning-based network event model; a spatial-temporal clustering determining unit determining the spatial-temporal clustering of the account search event; and a target account reconnaissance detection unit detecting target account reconnaissance behavior of an attacker by determining whether an account associated with the account search event corresponds to a target account based on the spatial-temporal clustering.

Description

AI-based target account reconnaissance detection device {ARTIFICIAL INTELLIGENCE BASED TARGET ACCOUNT RECONNAISSANCE BEHAVIOR DETECTION APPARATUS}

The present invention relates to an AI-based target account reconnaissance detection technology, and more specifically, to identify a target account based on spatiotemporal clustering and to detect a target account reconnaissance by internal and external attackers. It relates to a target account reconnaissance detection device.

The importance of software wars is increasing, and most companies and companies maintain business continuity through online services. Since most of these services are provided by utilizing server system resources, stable operation is essential in terms of security and availability of server systems to ensure business continuity.

Recently, server system protection measures are required due to the strengthening of information protection laws and regulations, and enterprise-wide servers including effective access control and audit trails to protect assets from internal and / or external attacks of various advanced techniques. A system control response plan is needed. In addition, existing server security technologies focus on external attacks, limiting their ability to respond to potential insider threats.

Korean Patent Laid-Open No. 10-2017-0122548 relates to a method and apparatus for recognizing an APT attack using analysis of related data of an abnormal process, and includes a vaccine program of a host device such as a server or a personal computer (PC) on a network of an enterprise or an organization. For an abnormal process (application), such as a malicious process detected in real time in the security system, historical association data is generated from past association data, and past association information on data relations and actions performed associated with the process is based on the APT step 5, that is, propagation ( Disclosed are techniques for detecting advanced cyber target attacks (APTs) by analyzing delivery, exploitation, installation, C0026 # C (Command 0026 # Control) communications, and actions.

Korean Laid-Open Patent Publication No. 10-2014-0078329 relates to an internal network target attack response device and method, and the internal network target attack response device includes ECDMAX (Exploit, C2, Download, Lateral Movement, External Network Attack, Exfiltration) in the behavior profile. Based on the step by step attack tracking and counteracting techniques are disclosed.

Korean Patent Publication No. 10-2017-0122548 (2017.11.06) Korean Patent Publication No. 10-2014-0078329 (2014.06.25)

An embodiment of the present invention is to provide an AI-based target account reconnaissance detection device that can detect the target account reconnaissance by the internal and external attacker by identifying the target account based on the spatiotemporal clustering.

An embodiment of the present invention is to provide an AI-based target account reconnaissance detection device that can classify account search events resulting in account search in network activity through machine learning.

An embodiment of the present invention is to provide an artificial intelligence-based target account reconnaissance detection device that can solve the detection of internal and external attacks by the conventional server security technology.

Among the embodiments, the artificial intelligence-based target account reconnaissance detection device is a network activity collecting unit for collecting network activities generated through data communication with an external device, the account of the network activities through a network learning model based on machine learning An account search event determining unit determining a search event, a spatiotemporal clustering determining unit determining a spatiotemporal clustering related to the account search event, and determining whether an account associated with the account search event corresponds to the target account based on the spatiotemporal clustering And a target account reconnaissance detection unit for detecting an attacker's target account reconnaissance.

In one embodiment, the account search event determiner may classify the network activities by machine learning the communication protocol and the port number of the network activities, and establish the network event model through the classification of the network activities.

In one embodiment, the account search event determiner may include at least one of an account login event, an account email event, and an account access event based on the network event model, and determine an event resulting in an account search as the account search event. .

In one embodiment, the spatiotemporal clustering determining unit may calculate the temporal density and the attacker's spatial density of the account access in the account search event.

In one embodiment, the target account reconnaissance detection unit may detect APT (Advanced Persistent Threat) based on the concentration of the account access or the attacker per unit time or concentration per cycle.

In one embodiment, the target account reconnaissance detection unit may determine that an account associated with the account search event corresponds to an attack target account when the concentration per unit time or concentration per cycle is greater than or equal to a certain criterion.

In one embodiment, if the target account reconnaissance detection unit detects the target account reconnaissance activity may be closed after the account access to send an authentication number to the associated smartphone or request to change the password after reducing the account authority.

The disclosed technique can have the following effects. However, since a specific embodiment does not mean to include all of the following effects or only the following effects, it should not be understood that the scope of the disclosed technology is limited by this.

Artificial intelligence-based target account reconnaissance detection apparatus according to an embodiment of the present invention can detect target account reconnaissance by internal and external attackers by identifying target accounts based on spatiotemporal clustering.

The AI-based target account reconnaissance detection apparatus according to an embodiment of the present invention may classify an account search event resulting in an account search in network activity through machine learning.

Artificial intelligence-based target account reconnaissance detection apparatus according to an embodiment of the present invention can solve that the internal and external attacks are not detected by the conventional server security technology.

1 is a diagram illustrating an AI-based target account reconnaissance detection system according to an embodiment of the present invention.
FIG. 2 is a diagram illustrating an AI-based target account reconnaissance detection device of FIG. 1.
FIG. 3 is a diagram illustrating functional elements of a processor of the artificial intelligence based target account reconnaissance detection apparatus of FIG. 1.
4 is a flowchart illustrating an AI-based target account reconnaissance method performed by the AI-based target account reconnaissance detection apparatus of FIG. 1.

Description of the present invention is only an embodiment for structural or functional description, the scope of the present invention should not be construed as limited by the embodiments described in the text. That is, since the embodiments may be variously modified and may have various forms, the scope of the present invention should be understood to include equivalents capable of realizing the technical idea. In addition, the objects or effects presented in the present invention does not mean that a specific embodiment should include all or only such effects, the scope of the present invention should not be understood as being limited thereby.

On the other hand, the meaning of the terms described in the present application should be understood as follows.

Terms such as "first" and "second" are intended to distinguish one component from another component, and the scope of rights should not be limited by these terms. For example, the first component may be named a second component, and similarly, the second component may also be named a first component.

When a component is referred to as being "connected" to another component, it should be understood that there may be other components in between, although it may be directly connected to the other component. On the other hand, when a component is referred to as being "directly connected" to another component, it should be understood that there is no other component in between. On the other hand, other expressions describing the relationship between the components, such as "between" and "immediately between" or "neighboring to" and "directly neighboring to", should be interpreted as well.

Singular expressions should be understood to include plural expressions unless the context clearly indicates otherwise, and terms such as "comprise" or "have" refer to a feature, number, step, operation, component, part, or feature thereof. It is to be understood that the combination is intended to be present and does not exclude in advance the possibility of the presence or addition of one or more other features or numbers, steps, operations, components, parts or combinations thereof.

In each step, an identification code (e.g., a, b, c, etc.) is used for convenience of description, and the identification code does not describe the order of the steps, and each step clearly indicates a specific order in context. Unless stated otherwise, they may occur out of the order noted. That is, each step may occur in the same order as specified, may be performed substantially simultaneously, or may be performed in the reverse order.

The present invention can be embodied as computer readable code on a computer readable recording medium, and the computer readable recording medium includes all kinds of recording devices in which data can be read by a computer system. . Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, and the like. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

All terms used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. Generally, the terms defined in the dictionary used are to be interpreted to coincide with the meanings in the context of the related art, and should not be interpreted as having ideal or excessively formal meanings unless clearly defined in the present application.

1 is a diagram illustrating an AI-based target account reconnaissance detection system according to an embodiment of the present invention.

Referring to FIG. 1, the AI-based target account reconnaissance detection system 100 may include an external device 110 and an AI-based target account reconnaissance detection apparatus 120.

The external device 110 corresponds to a computing device that communicates with the AI-based target account reconnaissance detection device 120 through data communication, and may be implemented as, for example, a smartphone, a laptop, or a computer. The present invention is not limited thereto and may be implemented in various devices such as a tablet PC. The external device 110 may be connected to the AI-based target account reconnaissance detection device 120 through a network, and the at least one external device 110 may be connected to the AI-based target account reconnaissance detection device 120. Can be connected at the same time.

The AI-based target account reconnaissance detection device 120 classifies the network activity generated through data communication with the external device 110 by machine learning and classifies the network event model based on the classified network activity. It may correspond to a server that detects the target account reconnaissance by establishing a target account. In one embodiment, the AI-based target account reconnaissance detection device 120 is a separate server or device capable of proactively responding to the attack by detecting the target account reconnaissance activity of the attacker in data communication with the external device 110. It may be implemented, but is not necessarily limited thereto.

In one embodiment, the AI-based target account reconnaissance detection apparatus 120 may be implemented including a database (not shown), and may be implemented independently of the database. When implemented independently of the database, the AI-based target account reconnaissance detection device 120 may be connected to the database by wire and / or wirelessly to transmit and receive data. Hereinafter, a more detailed description related to the AI-based target account reconnaissance detection apparatus 120 will be described with reference to FIG. 3.

The database is a storage device capable of storing information necessary for detecting the target account reconnaissance detection device 120 of the AI-based target account reconnaissance detection device. In one embodiment, the database may store a plurality of network activities learned through machine learning, but is not necessarily limited thereto, the AI-based target account reconnaissance detection device 120 performs the target account reconnaissance detection The information can be collected or processed in various forms.

FIG. 2 is a diagram illustrating an AI-based target account reconnaissance detection device of FIG. 1.

Referring to FIG. 2, an AI-based target account reconnaissance detection device 120 (hereinafter, referred to as a target account reconnaissance detection device) includes a processor 210, a memory 220, a user input / output unit 230, and a network input / output unit ( 240).

The processor 210 may perform AI-based target account reconnaissance detection in FIG. 4, manage the memory 220 that is read or written in this process, and the volatile memory in the memory 220. You can schedule synchronization times between nonvolatile memories.

The processor 210 may control the overall operation of the AI-based target account reconnaissance detection device 120 and is electrically connected to the memory 220, the user input / output unit 230, and the network input / output unit 240. You can control the data flow between them. The processor 210 may be implemented as a central processing unit (CPU) of the target account reconnaissance detection device 120.

The memory 220 may include a secondary memory device which is implemented as a nonvolatile memory such as a solid state disk (SSD) or a hard disk drive (HDD), and is used to store overall data necessary for the target account reconnaissance detection device 120. It may include a main memory device implemented with volatile memory such as random access memory (RAM).

The user input / output unit 230 includes an environment for receiving user input and an environment for outputting specific information to the user, and includes, for example, a mouse, a trackball, a touch pad, a graphic tablet, a scanner, a touch screen, a keyboard, or a pointing. It may include an input device including an adapter such as a device and an output device including an adapter such as a monitor. In one embodiment, the user input / output unit 230 may correspond to a computing device connected through a remote connection, in which case, the AI-based target account reconnaissance detection device 120 may be performed as a server.

The network input / output unit 240 may include an environment for connecting to the AI-based target account reconnaissance detection device 120, and may include, for example, an adapter for local area network (LAN) communication. . In one embodiment, the AI-based target account reconnaissance detection device 120 may be connected to the network through the network input and output unit 240.

FIG. 3 is a diagram illustrating functional elements of a processor of the artificial intelligence based target account reconnaissance detection apparatus of FIG. 1.

Referring to FIG. 3, the AI-based target account reconnaissance detection device 120 includes a network activity collector 310, an account search event determiner 320, a spatiotemporal clustering determiner 330, and a target account reconnaissance detection. The unit 340 and the controller 350 are included.

The network activity collector 310 may collect data associated with network activity. In detail, the network activity collector 310 may collect network activities generated through data communication with the external device 110. For example, the network activity collection unit 310 may collect network activities including e-mail reception, account login, account access, etc. by the user, but the network activity is not limited thereto. Do not.

In an embodiment, the network activity collector 310 may collect a packet generated in a data communication process with the external device 110 as information on network activity. For example, the network activity collecting unit 310 may collect at least one of an Internet Protocol (IP) address, a port number (Port Nunber), user information, and host information, but is not limited thereto.

The network activity collector 310 may transmit the network activities to the account search event determiner 320 to classify the collected network activities.

The account search event determiner 320 may receive at least one network activity from the network activity collector 310. More specifically, the account search event determiner 320 may classify network activities by machine learning a communication protocol and a port number of network activities. The account search event determiner 320 may include a communication protocol such as Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Hypertext Transfer Protocol (HTTP), or Simple Mail Transfer Protocol (SMTP), and a 16-bit integer between 0 and 65535. The machine can learn the port number represented by. For example, if the account search event determiner 320 corresponds to one of the port numbers 25, 465, and 587 (outgoing mail server), and the communication protocol corresponds to SMTP, the network activity may be sent by the user. -Mail) can be classified as incoming / outgoing event, that is, account email event.

The account search event determiner 320 may establish a network event model through classification of network activities. The account search event determiner 320 may establish a network event model based on the classified network activities by learning a communication protocol and a port number.

The account search event determiner 320 may determine an account search event among network activities through a machine learning based network event model. More specifically, the account search event determiner 320 may include at least one of an account login event, an account email event, and an account access event based on the network event model, and determine an event resulting from the account search as an account search event. have.

In the following description, it is assumed that a specific network activity includes an account email event for convenience of description.

In one embodiment, if the account navigation event determiner 320 determines that a specific network activity is an account email event, the account search event determiner 320 determines whether the account associated with the account email event exists on a specific server, and thus the event results in the account search. Can be analyzed. Here, the specific server may correspond to the target account reconnaissance detection device 120, or may correspond to a separate server linked to the target account reconnaissance detection device 120, but is not necessarily limited thereto. If the account associated with the account email event exists in a specific server, the account search event determiner 320 may determine that the specific network activity includes an account email event and result in account search, and determine the event as an account search event. have.

The spatiotemporal clustering determining unit 330 may determine the spatiotemporal clustering regarding the account searching event determined by the account searching event determining unit 320. Here, the spatiotemporal clustering may mean calculating the temporal density or the spatial density in the account search event. More specifically, the spatiotemporal clustering determining unit 330 may calculate the temporal density of the account access and the attacker's spatial density in the account search event.

In one embodiment, temporal density may represent the temporal concentration of network activities directed at a particular account and may include concentration per unit time or concentration per cycle. For example, the spatiotemporal clustering determining unit 330 calculates the concentration for 30 minutes from A time, 1 hour from A time, or 1 month, 1 year, etc. to calculate the temporal density of the account access in the account navigation event. The concentration per cycle can be calculated and the unit time and period settings can be set by the user.

In one embodiment, spatial density may indicate a concentration of account discovery events occurring at an Internet Protocol (IP) address or geographic location of a specific attacker, and may include concentration per unit time or concentration per cycle. Here, the specific attacker means an attacking terminal, that is, a computer, not a user.

The target account reconnaissance detection unit 340 may detect an advanced persistent threat (APT). Here, APT (Advanced Persistent Threat) refers to an intelligent hacking method that targets an organization or enterprise with an advanced persistent attack, and then employs various means over a long period of time, and is also called 'intelligent sustained threat' or 'intelligent sustainable threat'. . For example, Advanced Persistent Attacks (APTs) do not attempt to exploit hacking attacks in real time, but hide the malware in advance and run it simultaneously over time.

The target account reconnaissance detection unit 340 may detect an intelligent persistent attack (APT) based on an account access or an attacker's concentration per unit time or concentration per cycle. In one embodiment, the target account reconnaissance detection unit 340 may detect an advanced persistent attack (APT) by analyzing whether it is concentrated at a specific time. In another embodiment, the target account reconnaissance detection unit 340 may detect an advanced persistent attack (APT) by analyzing whether the target account is concentrated in a specific region, that is, a specific Internet Protocol (IP) address.

The target account reconnaissance detection unit 340 may determine that an account associated with an account search event corresponds to an attack target account when the concentration per unit time or the concentration per cycle is greater than or equal to a predetermined criterion. Here, the specific criteria may correspond to criteria that can be set by the user, and the target account may correspond to an account attacked by the attacker. In one embodiment, the target account reconnaissance detection unit 340 may determine that the account is attacked by internal and external attackers when the target account reconnaissance detection unit 340 is concentrated at a specific time or in a specific region, and through this process the target account is attacked You can decide that this corresponds to your account.

More specifically, the target account reconnaissance detection unit 340 determines whether an account associated with an account search event corresponds to an attack target account based on the spatiotemporal clustering determined by the spatiotemporal clustering determining unit 330. Can detect scouting The target account reconnaissance detection unit 340 may detect the target account reconnaissance behavior of internal and external attackers by monitoring the determined attack target account. For example, an attacker may exist as an internal or external attack terminal, and the target account reconnaissance may include reconnaissance of the target account, take account of the target account, and access to the target account for achieving the target such as file illegal manipulation (duplicate or change). It is possible, but is not limited to this.

That is, the target account reconnaissance detection unit 340 continuously detects the attack target to attack the target account by continuously monitoring the target account determined based on the spatiotemporal clustering. Artificial intelligence-based target account reconnaissance detection device 120 of the present invention can prevent attacks by internal and external attackers by detecting the target account reconnaissance behavior of the attacker in advance.

The target account reconnaissance detection unit 340 may close the account access when the attacker's target account reconnaissance is detected, and then transmit the authentication number to the associated smartphone. In one embodiment, the target account reconnaissance detection unit 340 may transmit an authentication number to a user terminal associated with the attack target account, that is, a smartphone, and the user may receive an authentication number to receive an account by detecting the target account reconnaissance activity. The access closure can be released. In another embodiment, the user may allow the account access to be closed even if the user receives the authentication number. For example, a user may want to close an account if the account has not been used for a certain period of time.

The target account reconnaissance detection unit 340 may reduce the account authority and request a password change when the attacker's target account reconnaissance is detected. In this case, reducing the account authority may include reducing the range that the user can access using the account, as shown in Table 1 below, and the access range may be changed by the administrator. It is not necessarily limited thereto.

Before zoom out After shrinking Accessible Access denied Accessible Accessible … … Accessible Access denied

The target account reconnaissance detection manager (hereinafter, the administrator) may set the range of account authority reduction according to the target account reconnaissance level. The target account reconnaissance step may be set from step 1 to N step, which may mean that the risk of the target account reconnaissance action increases as step N is not limited thereto. The administrator may reduce the authority of the account more as the target account reconnaissance detection detected by the target account reconnaissance detection unit 340 is at step 1, that is, at a high risk level, rather than at a low risk level. For example, step 1 can reduce one, while step N can reduce N.

The target account reconnaissance detection unit 340 may reduce the account authority of the target account, and request the user to change the password. For example, the target account reconnaissance detection unit 340 may increase the account authority of the corresponding account when the password change is detected by the user after requesting a password change. The target account reconnaissance detection unit 340 may restore the account authority before reducing the account authority.

The controller 350 may control the overall operation of the AI-based target account reconnaissance detection device 120, and may include a network activity collector 310, an account search event determiner 320, and a spatiotemporal clustering determiner 330. ) And the control flow or data flow between the target account reconnaissance detection unit 340.

4 is a flowchart illustrating an AI-based target account reconnaissance behavior method performed by the AI-based target account reconnaissance detection apparatus of FIG. 1.

In FIG. 4, the network activity collecting unit 310 may collect network activities generated through data communication with an external device (step S410).

The account search event determiner 320 may determine an account search event among network activities through the machine learning based network event model (step S420).

The spatiotemporal clustering determining unit 330 may determine the spatiotemporal clustering regarding the account search event (step S430).

The target account reconnaissance detection unit 340 may detect an attacker's target account reconnaissance by determining whether the account associated with the account search event corresponds to the target account based on the spatiotemporal clustering (step S440).

Although described above with reference to a preferred embodiment of the present invention, those skilled in the art will be variously modified and changed within the scope of the invention without departing from the spirit and scope of the invention described in the claims below I can understand that you can.

100: AI based target account reconnaissance detection system
110: external device
120: AI-based target account reconnaissance detection device
210: processor 220: memory
230: user input and output unit 240: network input and output unit
310: network activity collection unit 320: account navigation event determination unit
330: spatiotemporal clustering determining unit 340: target account reconnaissance detection unit
350: control unit

Claims (7)

A network activity collector configured to collect network activities generated through data communication with an external device;
Machine learning the communication protocol and port number of the network activities to classify the network activities, establish a network event model through the classification of the network activities, and determine an account discovery event among the network activities through the network event model. An account search event determiner;
A spatiotemporal clustering determining unit for determining a spatiotemporal clustering of the account search event; And
A target account reconnaissance activity detection unit for determining whether an account associated with the account search event corresponds to an attack target account based on the spatiotemporal clustering and detecting an attacker's target account reconnaissance activity;
The spatiotemporal clustering determining unit
Calculate a temporal density of account accesses representing the temporal concentration of the network activities towards a particular account in the account discovery event and a spatial density of attackers representing the concentration of the account discovery events occurring at a particular attacker's IP address or geographic location; ,
The target account reconnaissance detection unit
An AI-based target account reconnaissance detection device, characterized in that it detects APT (Advanced Persistent Threat) based on the account access or the attacker's concentration per unit time or concentration per cycle.
delete The method of claim 1, wherein the account search event determiner
AI-based target account reconnaissance action comprising at least one of an account login event, an account e-mail event, and an account access event based on the network event model and determining an event that results in an account search as the account search event Detection device.
delete delete The method of claim 1, wherein the target account reconnaissance detection unit
An AI-based target account reconnaissance detection device, characterized in that if the concentration per unit time or concentration per cycle is above a certain criterion, the account associated with the account search event is determined to correspond to an attack target account.
The method of claim 1, wherein the target account reconnaissance detection unit
When the target account reconnaissance detection is detected, AI-based target account reconnaissance detection device, characterized in that for sending an authentication number to the associated smartphone after account access closure or requesting a password change after reducing the account authority.

Images