KR102120232B1 - Cyber targeted attack detect system and method using kalman-filter algorithm - Google Patents

Abstract

The present invention relates to a cyber target attack detection system using a Kalman-filter algorithm and a method thereby and, more particularly, to a cyber target attack detection system using a Kalman-filter algorithm which includes: an attack collection unit (100) that collects related information on previously generated cyber target attacks; an attack analysis unit (200) that constructs big data using the information collected by the attack collection unit (100) and calculates the degree of risk of a corresponding cyber target attack by analyzing the big data; a keyword collection unit (300) for collecting issue keywords by analyzing morphemes contained in various text materials on the Internet; a keyword analysis unit (400) for selecting social issues keywords by performing a correlation analysis between the issue keywords collected by the keyword collection unit (300); and an integrated analysis unit (500) that determines whether the corresponding cyber target attack is a social issue-type cyber target attack, analyzes server operation data collected in real time through a correlation analysis between the risk information calculated by the attack analysis unit (200) and the social issue keywords selected by the keyword analysis unit (400), and detects a cyber target attack by using the degree of attack generation risk of a corresponding site using the Kalman filter algorithm.

Description

Cyber targeted attack detect system and method using kalman-filter algorithm}

The present invention relates to a cyber target attack detection system using the Kalman filter algorithm and a detection method thereof, and more specifically, to analyze and analyze social issues and threat information, thereby enabling security enhancement and prevention for cyber target attacks. A cyber target attack detection system using a Kalman filter algorithm and a detection method thereof.

In addition, by performing data analysis using the Kalman filter algorithm, it relates to a cyber target attack detection system and a detection method using the Kalman filter algorithm that can save analysis time (detection time).

Cyber targeted attacks are targeted by individuals targeted at specific entities and attacked by a set of latent and persistent computer hacking processes, usually targeting individual groups, countries or businesses or political groups (servers).

This cyber target attack requires a considerable degree of stealth for a long time, uses malicious software to attack vulnerabilities in the targeted system, and continuously generates data about target targets from the outside to create such malicious software Monitor and extract.

Because these cyber target attacks attack unknown vulnerabilities, it is difficult to defend with signature-based detection of existing security systems, and systems that detect abnormal traffic also attempt to attack very slowly for a long period of time to neutralize them, so they do not recognize the damage itself. There is a problem that can not be.

Conventionally, in order to solve this problem, in Korean Patent Publication No. 10-2014-0077405 ("Cyber Attack Detection Apparatus and Method"), information sources related to cyber target attacks are collected for a predetermined period, and then stored in advance. Disclosed is a technique for detecting the behavior of an attack by comparing the similarity with the behavior.

Domestic Publication Patent No. 10-2014-0077405 (published on 2014.06.24.)

The present invention has been devised to solve the problems of the prior art as described above, and the object of the present invention is to perform a social analysis of the cyber target attack and the social issue that occurred in the corresponding period. It is to provide a cyber target attack detection system and a detection method using a Kalman filter algorithm capable of proactively responding to a social issue type cyber target attack that may occur by analyzing a target attack.

Cyber target attack detection system using a Kalman filter algorithm according to an embodiment of the present invention, the attack collection unit 100 for collecting the related information on the pre-occurring cyber target attack, the attack collection unit 100 to the big data Attack analysis unit (200) to calculate the risk of the corresponding cyber target attack by analyzing the constructed information, keyword collection unit (300) to collect morphemes included in various text data on the Internet, and to collect issue keywords The keyword analysis unit 400 for selecting a social issue keyword by performing association analysis between the issue keywords collected by the unit 300 and the risk analysis unit 400 and the risk information calculated by the attack analysis unit 200 ), analyzes the correlation between social issue keywords selected, determines whether the corresponding cyber target attack is a social issue type cyber target attack, analyzes the server operation data collected in real time, and uses the Kalman filter algorithm to It is preferably configured to include an integrated analysis unit 500 for detecting a cyber target attack using the risk of attack occurrence.

Furthermore, it is preferable that the attack collection unit 100 receives log information about a cyber target attack that has already occurred from the outside, collects it, and makes it big data.

Further, the attack analysis unit 200 is a standardization unit 210 that formalizes the big data according to a predetermined criterion, a statistical analysis unit 220 that performs predetermined statistical analysis on the standardized data, and deep learning. Further comprising a learning unit 230 for performing learning on the structured data using the risk calculation unit 240 for estimating the risk for the detection of a cyber target attack according to the learning results of the learning unit 230 It is preferably configured.

Furthermore, the keyword collection unit 300 receives a period information to be collected from the outside, a text collection unit 310 for collecting various text data on the Internet of the corresponding period, and a morpheme for the collected text data Through analysis, an issue keyword setting unit 320 for setting an issue keyword is further included, but the issue keyword setting unit 320 excludes a preset blacklist morpheme from among the analyzed morphemes and uses the remaining morphemes as the issue keyword. It is desirable to set.

Further, the keyword analysis unit 400, according to a predetermined criterion, the keyword grouping unit 410 for grouping the issue keywords set by the issue keyword setting unit 320, and the association between issue keywords in each group It is preferable to further include a social issue selection unit 420 for selecting social issue keywords based on the frequency of keyword generation by performing analysis.

Furthermore, the integrated analysis unit 500 analyzes the correlation between the risk for the detection of the cyber target attack calculated by the attack analysis unit 200 and the social issue keywords selected by the keyword analysis unit 400, corresponding The correlation analysis unit 510 for determining whether a cyber-targeted cyber target attack is a cyber target attack, and analyzes operational data of a specific server received in real time, thereby increasing the risk of a social-issue cyber target attack for a specific server. Predictively, it is preferable that the risk prediction unit 520 is further configured to correct the occurrence risk predicted using the Kalman filter algorithm.

The cyber target attack detection method using the Kalman filter algorithm according to an embodiment of the present invention collects related information on a previously generated cyber target attack, configures big data using the collected information, and thereby through this cyber target attack The attack analysis step (S100) for calculating the risk of collecting the issue keywords by analyzing the morphemes contained in various text data on the Internet, and the social issue keywords among the issue keywords by analyzing the association between the collected issue keywords The cyber target attack society through analysis of the correlation between the risk information calculated in the selected social issue analysis step (S200) and the attack analysis step (S100) and the social issue keyword selected in the social issue analysis step (S200) It is desirable to consist of an integrated analysis step (S300) that determines whether an issue is a cyber target attack and analyzes the server operation data collected in real time and uses a Kalman filter algorithm to determine the risk of a social issue type cyber target attack at the site. Do.

Further, in the attack analysis step (S100), the big data configuration step (S110) of receiving log information about a cyber target attack that has been generated from the outside and collecting it to make it big data, and formalizing the big data according to predetermined criteria According to the standardization step (S120), the statistical analysis step (S130) for performing predetermined statistical analysis on the standardized data, the learning step (S140) for learning the structured data using deep learning, and the learning result, It is preferable to consist of a risk estimating step (S150) for estimating the risk for detecting a cyber target attack.

Further, in the social issue analysis step (S200), a text collection step (S210) for receiving various periods of text data on the Internet in the corresponding period by receiving information about a period to be collected from the outside, in step S210, for the collected text data Through morpheme analysis, an issue keyword setting step (S220) for setting an issue keyword, a keyword grouping step (S230) for grouping the set of issue keywords according to a predetermined criterion, and an analysis of association between issue keywords in each group By performing, it is preferable to consist of a social issue keyword selection step (S240) for selecting social issue keywords based on the frequency of keyword occurrence.

Further, in the setting of the issue keyword (S220), it is preferable to set the remaining morphemes as the issue keywords, except for the preset blacklist morphemes among the analyzed morphemes.

Furthermore, the integrated analysis step (S300) is through the correlation analysis between the risk information for the detection of the cyber target attack calculated in the attack analysis step (S100) and the social issue keyword selected in the social issue analysis step (S200). , Correlation analysis step (S310) of determining whether a cyber-attack is a cyber-attack of a previously generated cyber target attack, and risk of occurrence of a social-issue cyber target attack on a specific server by analyzing operation data of a specific server input in real time It is composed of a risk prediction step (S320) for predicting, the risk prediction step (S320) is preferably to correct the occurrence risk predicted using the Kalman filter algorithm.

The cyber target attack detection system and the detection method using the Kalman filter algorithm of the present invention according to the above-described configuration are analyzed by data generated by the conventional cyber target attacks, and the society targeting each attack group (attacker organization)/ Target groups that are vulnerable by analyzing economic issues (for example, summit, Olympics, cryptocurrency, etc.) and attack techniques, and analyzing and analyzing social issues and cyber target attack techniques. It has the advantage of being able to preemptively respond to cyber targeted attacks that the (target organization) can face.

In particular, by analyzing and analyzing social issues and cyber target attacks that occur, it is possible to quickly detect and predict an attacker's attack path, a source of malicious code infection, etc., thereby proactively responding to a target attack that may occur. .

In addition, by using the Kalman filter algorithm, it is possible to save detection time in analyzing a large number of social issues related information and information related to a cyber target attack, which has the advantage of analyzing/detecting a cyber target attack more quickly. .

Through this, it is possible to minimize the cyber target attack damage caused by social issues generated in real time in the target group, and if the social issue associated with the cyber target attack appears again in the past, strengthen the security in the expected target group and In addition, through continuous monitoring, it is possible to prevent cyber target attacks in advance, and to take preventive and prompt measures.

1 is a block diagram showing a cyber target attack detection system using a Kalman filter algorithm according to an embodiment of the present invention.
2 to 6 is a detailed configuration operation diagram of each configuration of the cyber target attack detection system using the Kalman filter algorithm according to an embodiment of the present invention.
7 is a flowchart illustrating a cyber target attack detection method using a Kalman filter algorithm according to an embodiment of the present invention.

Hereinafter, a cyber target attack detection system and its detection method using the Kalman filter algorithm of the present invention will be described in detail with reference to the accompanying drawings. The drawings introduced below are provided as examples in order to sufficiently convey the spirit of the present invention to those skilled in the art. Accordingly, the present invention is not limited to the drawings presented below and may be embodied in other forms. In addition, the same reference numbers throughout the specification indicate the same components.

At this time, unless there are other definitions in the technical terms and scientific terms used, it has the meanings commonly understood by those of ordinary skill in the art to which this invention belongs, and the subject matter of the present invention in the following description and the accompanying drawings Descriptions of well-known functions and configurations that may unnecessarily obscure are omitted.

In addition, a system refers to a set of components, including devices, instruments and means, which are organized and regularly interacted to perform the necessary functions.

The cyber target attack detection system and the detection method using the Kalman filter algorithm according to an embodiment of the present invention can be attacked by a target group (individual, organization, country, business, or political organization) that has a vulnerability. In order to preemptively respond to attacks, especially social issue-type cyber target attacks, it is desirable to detect the attack path of the attacker and the source of malicious code by analyzing and analyzing the cyber target attacks that have occurred.

In particular, while analyzing a large number of data, in order to reduce the detection time that may cause problems, by using a Kalman-Filter algorithm (Kalman-Filter algorithm), there is an advantage that can maximize the effect.

The cyber target attack detection system and the detection method using the Kalman filter algorithm according to an embodiment of the present invention collects big data about the cyber target attack that occurred in the past and analyzes the collected big data to analyze the risk of cyber target attack Is calculated, collects keywords for social issues that have occurred in the past, analyzes social issues with the collected keywords, and uses the analysis results for cyber targeted attacks and social issues to analyze'social issues. It is desirable to detect a cyber target attack.

In particular, by learning the patterns that appear in the occurrence of social issue-type cyber target attacks, it is possible to detect the'social issue-type cyber target attacks' that are likely to appear in the future and to prevent the damage caused by cyber attacks by strengthening security for this. There is an advantage that can be prevented.

1 to 6 are configuration diagrams showing a cyber target attack detection system using a Kalman filter algorithm according to an embodiment of the present invention, with reference to FIGS. 1 to 6 Kalman filter according to an embodiment of the present invention The cyber target attack detection system using the algorithm will be described in detail.

The cyber target attack detection system using the Kalman filter algorithm according to an embodiment of the present invention, as shown in Figure 1, the attack collection unit 100, the attack analysis unit 200, the keyword collection unit 300, keyword analysis It is preferably configured to include the unit 400 and the integrated analysis unit 500.

In addition, it is preferable to further include a database unit 600 that receives, receives, and generates data from each of the components, and then stores and manages the database.

To learn more about each configuration,

It is preferable that the attack collection unit 100 collects information related to a cyber target attack that has already occurred.

In detail, it is preferable that the attack collection unit 100 collects an attack log for a cyber target attack that has occurred in the past.

That is, in order to detect a cyber target attack that is currently occurring or may occur, analysis of a cyber target attack that has occurred in the past is required. Accordingly, it is desirable to receive log information for all types of cyber target attacks, not certain types of cyber target attacks, and collect them to form big data.

To this end, as shown in FIG. 2, the attack collection unit 200 sets and manages various cyber security control operating organizations (security control centers, etc.) that store log information related to the cyber target attack, while they are stored. It is desirable to receive log information related to all types of cyber target attacks.

At this time, rather than simply collecting all log information and configuring it as big data, it is determined whether the format of the received log information is a database format or a file format, and in the case of a database format, the database unit 600 is interlocked with SQL. In the'cyber target attack data', and in the case of a file format, it is preferable to extract the file and store it as'cyber target attack data' in the database unit 600.

It is preferable that the attack analysis unit 200 calculates the risk of a corresponding cyber target attack by analyzing the information using the big data collected and collected by the attack collection unit 100.

At this time, as shown in Figure 1, the attack analysis unit 200 is configured to include a shaping unit 210, a statistical analysis unit 220, a learning unit 230 and a risk calculation unit 240 desirable.

The shaping unit 210 receives the big data from the attack collection unit 100, and it is preferable to shape the big data according to a preset criterion, and the statistical analysis unit 220 may include the shaping unit 210 It is preferable to perform a preset statistical analysis on data structured by ).

In addition, the learning unit 230, using deep learning, performs learning on the data normalized by the shaping unit 210, and through the risk calculation unit 240, the learning unit 230 It is desirable to calculate the risk for the detection of cyber target attacks according to the learning results.

In detail, as shown in FIG. 3, the attack analysis unit 200 collects data from each server (various cyber security control operating organizations, etc.) and makes it big data to the'cyber target attack data' in the database unit 600. Deep learning learning and statistical analysis are performed on the information stored and managed by the analysis.

At this time, through the shaping unit 210, it is preferable to precede the shaping process.

Formalization means digitizing various data such as characters, character strings, and integers to perform data analysis. Through the statistical analysis unit 220, the digitized data, that is, the standardized data, using an attack date, an attack type, an attack target, etc. as input variables, various statistical analyzes such as preset frequency analysis and regression analysis are performed. It is preferred to perform.

In addition, by learning the structured data using deep learning through the learning unit 230, each learning result (for example, an attack occurrence date and a main attack pattern by attack time zone) by the risk calculation unit 240 Learning result, attack pattern learning result by attacker group (departure IP information, origin PORT information, etc.), attack pattern learning result by main victim organizations (destination IP information, destination PORT information, etc.), attack pattern learning results appearing in payload, etc. ), and weighted sum is calculated to calculate the risk for cyber target attack detection.

At this time, it is preferable that the learning unit 230 learns not only the structured data, but also the result data of the statistical analysis unit 220.

Here, the risk for detecting a cyber target attack calculated by the risk calculating unit 240 means calculating a criterion for detecting a cyber target attack, and high-frequency behavior information appearing in the cyber target attack that occurred in the past ( Using payload, IP address, target organization, etc.) to learn patterns that appear before the cyber target attack, storing and managing the information as'cyber target attack analysis result data' of the database unit 600 desirable.

That is, when the cyber target attack occurs, the risk calculated by the risk calculation unit 240 learns a pattern that may be characteristic before the occurrence (just before), and analyzes the server operation data in real time later (eg For example, if a pattern similar/same as the pattern learned from the operation data of a specific web site) is recognized, it can be determined that there is a risk of cyber target attack.

It is preferable that the keyword collection unit 300 analyzes the morphemes included in various text data on the Internet, and collects the issue keywords.

To this end, as illustrated in FIG. 1, the keyword collection unit 300 may include a text collection unit 310 and an issue keyword setting unit 320.

Preferably, the text collection unit 310 receives information on a period to be collected from the outside, and collects various text data on the Internet in a corresponding period, and the issue keyword setting unit 320 includes the text collection unit 310 ), it is preferable to set an issue keyword through morpheme analysis on the text data collected.

At this time, it is preferable that the issue keyword setting unit 320 sets the remaining morphemes as the issue keywords except for the preset blacklist morphemes among the morphemes analyzed by the text collection unit 310.

Through this, the keyword collection unit 300 collects various keywords existing in a preset period by utilizing news sites and SNS existing on the Internet.

In detail, as shown in FIG. 4, it is desirable to collect all articles uploaded through portal sites (search sites), various broadcaster sites, and various broadcasters' SNSs as text materials.

At this time, while inputting a portal site (search site), various broadcaster sites, URL links corresponding to various broadcasters' SNS, and the like, and separating the parameter parts including the upload dates of all articles, the text collection unit 310 By entering, you can collect articles by date as text materials.

In order to increase the efficiency of the analysis, it is preferable to collect all articles within a corresponding period by setting a predetermined period or a predetermined period received in advance.

For example, when an external administrator (user) inputs a specific period desired, the text collection unit 310 collects text data included in all articles corresponding to a specific period using a crawl module.

The issue keyword setting unit 320 extracts a keyword by performing morphological analysis on the text data collected by the text collection unit 310, and as described above, the keyword is meaningless or frequently appears. In this case, it is desirable to register this as a blacklist and set the rest of the morphemes as an issue keyword.

As an example of the blacklist, it is desirable to register words that appear frequently and without meaning in most articles, such as reporter name, news name, site name, weather information, and the like.

Here, the absence of meaning does not mean the morpheme itself, but means that the morpheme necessarily (mostly) exists in the basic format of the article, regardless of the cyber target attack.

It is preferable to store and manage the issue keyword thus set as'collection keyword list data' of the database unit 600.

Preferably, the keyword analysis unit 400 selects a social issue keyword by performing a correlation analysis between the issue keywords collected by the keyword collection unit 300.

To this end, as illustrated in FIG. 1, the keyword analysis unit 400 may include a keyword grouping unit 410 and a social issue selection unit 420.

The keyword analysis unit 400 may derive a social issue by analyzing the association between issue keywords in a corresponding period using the issue keywords collected by the keyword collection unit 300. Here, the term “period” refers to a period in which text data is collected by the text collection unit 310 because the text collection unit 310 collects text data for each period.

As illustrated in FIG. 5, it is preferable that the keyword analysis unit 400 groups the issue keywords according to a preset criterion through the keyword grouping unit 410 in order to perform relevance analysis.

At this time, as a preset criterion, it is generally desirable to set a large category of articles, such as economy, politics, society, culture, and entertainment.

It is preferable that the social issue selection unit 420 selects social issue keywords based on the frequency of keyword occurrence by performing association analysis between issue keywords in each group. In other words, if the frequency of occurrence of morphemes analyzed from text data collected within a specific period is high, it is desirable to select the morpheme as a social issue keyword.

It is preferable to select this as a social issue keyword because it is highly likely that it is a social issue keyword because it means that it is frequently referred to as an article.

At this time, the social issue selection unit 420 stores and manages the selected social issue keywords as'collection keyword analysis data' of the database unit 600, but does not simply store the social issue keywords. It is also desirable to store and manage the specific period of time when the social issue keyword occurs in a database.

Through this, if a desired period is input to search for a social issue keyword in the future, the'social issue keyword' of the corresponding period may be checked.

The integrated analysis unit 500 analyzes the correlation between the risk information calculated by the attack analysis unit 200 and the social issue keywords selected by the keyword analysis unit 400, and the social issue type cyber of the corresponding cyber target attack Target attack will be judged.

In addition, it is desirable to analyze the server operation data collected in real time, and to determine the risk of occurrence of a social issue type cyber target attack of the corresponding server using a Kalman filter algorithm.

To this end, the integrated analysis unit 500 is preferably configured to include a correlation analysis unit 510 and a risk prediction unit 520.

Preferably, the integrated analysis unit 500 determines whether a social issue type cyber target attack is performed through a correlation analysis module using the result data of the attack analysis unit 200 and the result data of the keyword analysis unit 400. Do.

That is, in other words, through the correlation analysis unit 510, the correlation between the risk for detection of the cyber target attack calculated by the attack analysis unit 200 and the social issue keywords selected by the keyword analysis unit 400 Through analysis, it is desirable to determine whether the corresponding cyber target attack is a social issue type cyber target attack.

In other words, since the attack analysis unit 200 calculates the risk by analyzing log information of all types of cyber target attacks, in order to determine a'social issue type cyber target attack', a corresponding period, that is, a specific cyber target Analyzes whether the social issue keyword when the attack occurs has a correlation with the target group where the specific cyber target attack has been made, and if the correlation is more than a predetermined threshold, the specific cyber target attack is a'social issue type cyber target attack' It is desirable to judge.

In the case of such a social issue-type cyber target attack, it is possible to comparatively specify the target group by attacking the social issue, so when analyzing the social-issue type cyber target attack that occurred in the past and preparing a countermeasure against it, the same society When an issue occurs, the target group has the advantage of being able to prepare a preemptive countermeasure. That is, since it is practically impossible to provide a defense against all cyber targeted attacks, it is desirable to analyze the social issue-type cyber targeted attacks that can provide the most effective defenses and proactively respond to them.

The risk predicting unit 520 analyzes operational data of a specific server received in real time to predict the risk of a social issue-type cyber target attack on a specific server, but as shown in FIG. 6, the Kalman filter algorithm is used. It is desirable to correct the predicted risk of occurrence.

In detail, the risk predicting unit 520 includes operating data of a specific server including security event log and web traffic information received in real time from a security device (IPS, IDS, web firewall, etc.) installed on a specific website. Using the social issue type cyber target attack information determined by the correlation analysis unit 510, a risk of occurrence of a social issue type cyber target attack of a specific server is predicted, and the predicted risk level is corrected using a Kalman filter algorithm. do.

Here, the Kalman filter algorithm is an algorithm that predictively corrects through iterative calculation using an existing value and a newly input value (currently entered value), through which the risk of occurrence of a social issue type cyber target attack of a specific website It is preferable to predict by correcting.

It is preferable to store and manage the risk of occurrence of a social issue type cyber target attack of a specific website predicted as'social issue type attack analysis data' in the database unit 600.

7 is a flowchart illustrating a cyber target attack detection method using a Kalman filter algorithm according to an embodiment of the present invention, and a cyber target attack detection method using a Kalman filter algorithm according to an embodiment of the present invention with reference to FIG. Will be described in detail.

The cyber target attack detection method using the Kalman filter algorithm according to an embodiment of the present invention includes an attack analysis step (S100), a social issue analysis step (S200), and an integrated analysis step (S300), as shown in FIG. 7. It is preferred.

To learn more about each step,

In the attack analysis step (S100), information related to a cyber target attack that has already occurred may be collected, and big data may be configured using the collected information to calculate the risk of the cyber target attack.

In detail, the attack analysis step (S100) is preferably composed of a big data configuration step (S110), a formalization step (S120), a statistical analysis step (S130), a learning step (S140), and a risk estimation step (S150). .

In order to detect a cyber target attack that is currently occurring or may occur, analysis of a cyber target attack that has occurred in the past is required.

Accordingly, in the configuration of the big data (S110), the attack collection unit 100 collects an attack log for a cyber target attack that has occurred in the past, but not all types of cyber target attacks, but all types of cyber target attacks. It is desirable to receive log information for, collect it, and compose it into big data.

To this end, various servers (cyber security control operation agencies, security control centers, etc.) that store log information related to cyber target attacks are set up and managed, and all types of cyber target attack log information stored by them are received. It is preferred.

At this time, rather than simply collecting all log information and configuring it as big data, it is determined whether the format of the received log information is a database format or a file format, and in the case of a database format, the database unit 600 is interlocked with SQL. In the'cyber target attack data', and in the case of a file format, it is preferable to extract the file and store it as'cyber target attack data' in the database unit 600.

In the shaping step (S120), the shaping unit 210 preferably forms the big data according to a preset criterion. Specifically, formalization means digitizing various data such as characters, character strings, and integers in order to perform data analysis.

In the statistical analysis step (S130), the statistical analysis unit 220 performs predetermined statistical analysis on the structured data. In detail, it is desirable to perform various statistical analyzes such as preset frequency analysis and regression analysis using the attack date, attack type, attack target, and the like as input variables.

The learning step (S140), in the learning unit 230, performs learning on the structured data using deep learning, and the risk estimating step (S150) is the risk estimating unit 240, the learning step According to the learning result in S140, the risk for detecting a cyber target attack is calculated.

Specifically, in the learning step (S140), by learning the structured data using deep learning, each learning result (for example, an attack occurrence date and a main attack pattern by attack time zone) in the risk estimating step (S150) Learning result, attack pattern learning result by attacker group (departure IP information, origin PORT information, etc.), attack pattern learning result by main target organization (destination IP information, destination PORT information, etc.), attack pattern learning result appearing in payload, etc. ), and weighted sum is calculated to calculate the risk for cyber target attack detection.

At this time, the learning step (S140), as well as the standardized data, it is preferable to learn the result data in the statistical analysis step (S130).

The risk for detecting a cyber target attack calculated in the risk estimation step (S150) means calculating a criterion for detecting a cyber target attack, and frequent behavior information (payload) appearing in the cyber target attack that occurred in the past , IP address, attack target organizations, etc., it is desirable to learn patterns that appear before the cyber target attack, and store and manage the information as'cyber target attack analysis result data' of the database unit 600. .

That is, when the cyber target attack occurs, the risk calculated by the risk calculation unit 240 learns a pattern that may be characteristic before the occurrence (just before), and learns from the server operation data analyzed in real time later. If a pattern similar/same as the pattern is recognized, it can be determined that there is a risk of cyber target attack.

In the social issue analysis step (S200), it is necessary to collect the issue keywords by analyzing the morphemes included in various text data on the Internet, and to select the social issue keywords among the issue keywords by analyzing the association between the collected issue keywords. desirable.

To this end, the social issue analysis step (S200) is preferably composed of a text collection step (S210), an issue keyword setting step (S220), a keyword grouping step (S230), and a social issue keyword selection step (S240).

In the text collection step (S210), it is preferable that the text collection unit 310 receives the period information to be collected from the outside and collects various text data on the Internet in a corresponding period.

That is, various keywords existing in a preset period are collected by utilizing news sites and SNS existing on the Internet.

In detail, it is desirable to collect all articles uploaded through portal sites (search sites), various broadcaster sites, and various broadcasters' SNS as text materials.

At this time, while inputting a portal site (search site), various broadcaster sites, URL links corresponding to various broadcasters' SNS, and the like, and separating the parameter parts including the upload dates of all articles, the text collection unit 310 By entering, you can collect articles by date as text materials.

In order to increase the efficiency of the analysis, it is preferable to collect all articles within a corresponding period by setting a predetermined period or a predetermined period received in advance.

Through this, when a specific period desired by an external administrator (user) is input, a text module included in all articles corresponding to a specific period is collected using a crawl module.

In the issue keyword setting step (S220), it is preferable to set the issue keyword in the issue keyword setting unit 320 through the text collection step (S210) through morpheme analysis of the collected text materials. .

At this time, the issue keyword setting step (S220) performs a morpheme analysis on the collected text data, extracts a keyword. If the keyword is meaningless or frequently appears, register it as a blacklist, and It is desirable to set the remaining morphemes as issue keywords.

As an example of the blacklist, it is desirable to register words that appear frequently and without meaning in most articles, such as reporter name, news name, site name, weather information, and the like.

Here, the absence of meaning does not mean the morpheme itself, but means that the morpheme necessarily (mostly) exists in the basic format of the article, regardless of the cyber target attack.

It is preferable to store and manage the issue keyword thus set as'collection keyword list data' of the database unit 600.

The keyword grouping step (S230), in the keyword grouping unit 410, groups the issue keywords set according to a preset criterion.

In detail, in the keyword grouping step (S230), it is preferable to group the issue keywords according to a preset criterion in order to perform relevance analysis.

At this time, as a preset criterion, it is generally desirable to set a large category of articles, such as economy, politics, society, culture, and entertainment.

In the social issue keyword selection step (S240), the social issue selection unit 420 performs correlation analysis between issue keywords in each group grouped by the keyword grouping step (S230) to determine the frequency of keyword occurrence. Social issue keywords are selected based on the criteria. In other words, if the frequency of occurrence of morphemes analyzed from text data collected within a specific period is high, it is desirable to select the morpheme as a social issue keyword.

It is preferable to select this as a social issue keyword because it is highly likely that it is a social issue keyword because it means that it is frequently referred to as an article.

That is, it is possible to derive a social issue by analyzing the association between issue keywords of a corresponding period using the collected issue keywords. Here, the corresponding period refers to a period in which text data is collected in the text collection step (S210) because text data is collected for each period in the text collection step (S210 ).

At this time, the social issue selection unit 420 stores and manages the selected social issue keywords as'collection keyword analysis data' of the database unit 600, but does not simply store the social issue keywords. It is also desirable to store and manage the specific period of time when the social issue keyword occurs in a database.

Through this, if a desired period is input to search for a social issue keyword in the future, the'social issue keyword' of the corresponding period may be checked.

The integrated analysis step (S300) is a social issue type of a cyber target attack that has occurred in advance through analysis of the correlation between the risk information calculated in the attack analysis step (S100) and the social issue keyword selected in the social issue analysis step (S200). It will determine whether or not it is a cyber target attack.

In addition, by analyzing the server operation data collected in real time, it is possible to determine the risk of occurrence of a social issue type cyber target attack of the corresponding site by using a Kalman filter algorithm.

To this end, the integrated analysis step (S300) is composed of a correlation analysis step (S310) and a risk prediction step (S320).

The correlation analysis step (S310) is a social issue type of the corresponding cyber target attack through an analysis of the correlation between the risk for detecting the cyber target attack calculated by the correlation analysis unit 510 and the selected social issue keyword. It is desirable to judge whether or not a cyber target attack.

In other words, in the attack analysis step (S100), since the risk is calculated by analyzing log information of all types of cyber target attacks, in order to determine a'social issue type cyber target attack', a corresponding period, that is, a specific cyber target Analyzes whether the social issue keyword when the attack occurs has a correlation with the target group where the specific cyber target attack has been made, and if the correlation is more than a predetermined threshold, the specific cyber target attack is a'social issue type cyber target attack' It is desirable to judge.

In the case of such a social issue-type cyber target attack, it is possible to comparatively specify the target group by attacking the social issue, so when analyzing the social-issue type cyber target attack that occurred in the past and preparing a countermeasure against it, the same society When an issue occurs, the target group has the advantage of being able to prepare a preemptive countermeasure. That is, since it is practically impossible to provide a defense against all cyber targeted attacks, it is desirable to analyze the social issue-type cyber targeted attacks that can provide the most effective defenses and proactively respond to them.

In the risk prediction step (S320), the risk prediction unit 520 analyzes operational data of a specific server input in real time to predict the risk of a social issue-type cyber target attack on a specific server, but a Kalman filter algorithm. It is desirable to correct the predicted risk of occurrence using.

In detail, the risk prediction unit 520 operates data of a specific server including security event logs and web traffic information received in real time from security devices (IPS, IDS, web firewall, etc.) installed on a specific website. By analyzing and determining the risk of attack of a specific server and using the social issue type cyber target attack information determined by the correlation analysis unit 510, the risk of occurrence of a social issue type cyber target attack of a specific website is predicted, but Kalman The predicted risk of occurrence is corrected using a filter algorithm.

Here, the Kalman filter algorithm is an algorithm that predictively corrects through iterative calculation using an existing value and a newly input value (currently entered value), through which the risk of occurrence of a social issue type cyber target attack of a specific website It is preferable to predict by correcting.

It is preferable to store and manage the risk of occurrence of a social issue type cyber target attack of a specific website predicted as'social issue type attack analysis data' in the database unit 600.

As described above, the cyber target attack detection system and the detection method using the Kalman filter algorithm according to an embodiment of the present invention use the data stored and managed in the database unit 600 to operate a server ( Operators, etc.) have the advantage that they can provide countermeasures (prevention measures) to minimize the damage caused by cyber target attacks (social issue type cyber target attacks) according to social issues using the data.

Also, if a social issue related to a social issue-type cyber target attack that occurred in the past occurs again, in other words,'the social issue keyword related to a social issue-type cyber target attack reappears in a specific period, This has the advantage of strengthening the security of servers, websites, etc. operated by the highly targeted attack group and preventing and targeting cyber attacks by continuously monitoring them.

As described above, in the present invention, specific matters such as specific components and the like have been described by the limited embodiment drawings, but they are provided only to help the overall understanding of the present invention, and the present invention is limited to the above-described one embodiment. No, those skilled in the art to which the present invention pertains can make various modifications and variations from these descriptions.

Accordingly, the spirit of the present invention should not be limited to the described embodiments, and should not be determined, and all claims that are equivalent to or equivalent to the scope of the claims as well as the scope of the claims described below belong to the scope of the spirit of the invention. .

100: attack collection unit
200: attack analysis unit
210: shaping section 220: statistical analysis section
230: learning unit 240: risk calculation
300: keyword collection unit
310: text collection unit 320: issue keyword setting unit
400: keyword analysis unit
410: Keyword grouping unit 420: Social issue selection unit
500: integrated analysis unit
510: correlation analysis unit 520: risk prediction unit
600: database unit

Claims (11)

An attack collection unit 100 that collects related information on a previously generated cyber target attack;
An attack analysis unit 200 for calculating the risk of a corresponding cyber target attack by analyzing information constituting big data in the attack collection unit 100;
A keyword collection unit 300 that collects issue keywords by analyzing morphemes included in various text materials on the Internet;
A keyword analysis unit 400 for selecting a social issue keyword by performing a correlation analysis between the issue keywords collected by the keyword collection unit 300; And
Using the social issue keyword selected by the keyword analysis unit 400, the correlation between the social issue keyword in the past when a specific cyber target attack occurs and the target server having the corresponding specific cyber target attack has been analyzed and analyzed. When the correlation is more than a predetermined reference value, the corresponding specific cyber target attack is determined as a social issue type cyber target attack,
Analyzing the determined social issue type cyber target attack information, the risk target information of the cyber target attack calculated by the attack analysis unit 200, and server operation data collected in real time, and predicting the attack of the corresponding server using the Kalman filter algorithm An integrated analysis unit 500 that detects a cyber target attack using the occurrence risk;
It comprises,
The keyword collection unit 300
Issue that sets the issue keyword by receiving the period information to be collected from the outside and collecting various text data on the Internet for the relevant period, and through morpheme analysis on the collected text data The keyword setting unit 320 further includes,
The issue keyword setting unit 320
A cyber target attack detection system using a Kalman filter algorithm characterized in that the remaining morphemes are set as the issue keywords, except for the preset blacklist morphemes among the analyzed morphemes.

According to claim 1,
The attack collection unit 100
A cyber target attack detection system using a Kalman filter algorithm characterized by receiving log information of a cyber target attack that has already occurred from the outside, collecting it, and making it big data.
According to claim 2,
The attack analysis unit 200
A shaping unit 210 for shaping the big data according to a predetermined criterion;
A statistical analysis unit 220 that performs predetermined statistical analysis on the structured data;
A learning unit 230 that performs learning on the structured data using deep learning; And
A risk calculation unit 240 for estimating a risk for detecting a cyber target attack according to the learning result of the learning unit 230;
Cyber attack attack detection system using a Kalman filter algorithm, characterized in that further comprises a.
delete According to claim 1,
The keyword analysis unit 400
A keyword grouping unit 410 for grouping the issue keywords set by the issue keyword setting unit 320 according to a preset criterion; And
A social issue selection unit 420 which selects a social issue keyword based on the frequency of keyword occurrence by performing association analysis between issue keywords in each group;
Cyber attack attack detection system using a Kalman filter algorithm, characterized in that further comprises a.
The method of claim 5,
The integrated analysis unit 500
A social issue type cyber target attack of a corresponding cyber target attack through an analysis of a correlation between a risk for the detection of a cyber target attack calculated by the attack analysis unit 200 and a social issue keyword selected by the keyword analysis unit 400 Correlation analysis unit 510 for determining whether or not; And
A risk prediction unit 520 that analyzes operational data of a specific server input in real time and predicts a risk of occurrence of a social issue-type cyber target attack on a specific server, but corrects the predicted risk using a Kalman filter algorithm;
Cyber attack attack detection system using a Kalman filter algorithm, characterized in that further comprises a.
An attack analysis step (S100) of collecting relevant information on a previously generated cyber target attack and constructing big data using the collected information to calculate a risk of a cyber target attack through this;
A social issue analysis step (S200) of collecting issue keywords by analyzing morphemes contained in various text data on the Internet, and selecting social issue keywords among the issue keywords through analysis of association between the collected issue keywords; And
Using the social issue keyword selected in the social issue analysis step (S200), the correlation between the social issue keyword in the past when a specific cyber target attack occurs and the target server having the corresponding specific cyber target attack is analyzed and analyzed When a correlation is higher than a predetermined reference value, a specific cyber target attack is determined as a social issue type cyber target attack,
Analyzing the determined social issue type cyber target attack information, risk information of the cyber target attack calculated in the attack analysis step (S100), and server operation data collected in real time, and predicting the social issue of the corresponding server using the Kalman filter algorithm Integrated analysis step of determining the risk of the type cyber target attack (S300);
Is made of,
The social issue analysis step (S200)
Issue that sets issue keywords by receiving the period information to be collected from the outside and collecting various text data on the Internet in the corresponding period (S210), and through morpheme analysis of the collected text data Keyword setting step (S220), a keyword grouping step (S230) for grouping the set of issue keywords according to a predetermined criterion, and performing correlation analysis between issue keywords in each group, based on the frequency of keyword occurrence A social target keyword detection method using a Kalman filter algorithm, characterized in that it consists of a social issue keyword selection step (S240) for selecting social issue keywords.

The method of claim 7,
The attack analysis step (S100)
A big data configuration step (S110) of receiving log information about a cyber target attack that has already occurred from the outside and collecting it to make big data;
A shaping step of shaping the big data according to a predetermined criterion (S120);
A statistical analysis step of performing predetermined statistical analysis on the structured data (S130);
A learning step of performing learning on the structured data using deep learning (S140); And
According to the learning result, the risk calculation step of estimating the risk for the detection of a cyber target attack (S150);
Cyber target attack detection method using a Kalman filter algorithm, characterized in that consisting of.
delete The method of claim 7,
The issue keyword setting step (S220)
A cyber target attack detection method using a Kalman filter algorithm, characterized in that the remaining morphemes are set as the issue keywords, except for the preset blacklist morphemes among the analyzed morphemes.
The method of claim 7,
The integrated analysis step (S300)
Through the correlation analysis between the risk information for the detection of the cyber target attack calculated in the attack analysis step (S100) and the social issue keywords selected in the social issue analysis step (S200), the social issue type cyber of the previously generated cyber target attack Correlation analysis step to determine whether the target attack (S310); And
A risk prediction step (S320) of analyzing the operation data of the specific server received in real time and predicting the risk of occurrence of a social issue type cyber target attack on the specific server;
It consists of,
The risk prediction step (S320)
A cyber target attack detection method using the Kalman Filter algorithm, characterized by correcting the predicted risk of occurrence using the Kalman Filter algorithm.

Images