KR102152317B1 - Method of deriving TTPS from IoC related with malware - Google Patents

Abstract

The present invention provides a method which generates an IoC table including at least one of a malware IoC, an IP blacklist IoC, and a URL blacklist IoC by analyzing a pre-detected malicious file by analyzing a detection event of an existing security solution, and extracts a process and a procedure (TTPs) of a malicious suspicious file using the generated IoC table, so as to provide fragmented information on targeted attacks and visibility into detailed techniques and procedures of the attack.

Description

Method of deriving TTPs from IoC related with malware using IoC of previously detected malicious files {Method of deriving TTPS from IoC related with malware}

The present invention relates to the security of a computer network, and in particular, to a technology that can contribute to improving the security of the network by extracting the TTPs of an attack from IoC related to a malicious file.

In the face of the Fourth Industrial Revolution, the importance of computer networks is increasing. People easily use desktops, laptops, tablets, or smartphones to access networks such as the Internet or intranet to obtain or provide information.

Networks such as the Internet and Intranet are widely used as infrastructure in various fields such as socio-cultural economy, but on the contrary, the security vulnerability of the Internet causes new social confusion factors such as paralysis of cyber culture and deterioration of the online trust foundation.

Various technologies are being developed to prevent threats by malicious users. One of them is the internal security solution, the Intrusion Detection/Prevention System (IDPS). The internal intrusion detection/prevention system detects and blocks threats based on already established rules. The other is external threat intelligence. External threat intelligence refers to a service that collects, shares, and provides threat information from various sources. In other words, it means responding to the threat by receiving information about cyber threats (IP, URL, Domain, Hash, YARA) that occur outside the organization, not from personnel or systems inside the organization.

However, it has only been using information on internal intrusion detection/prevention systems, external threat intelligence, and fragmentary attacks so far. In particular, the problem is a target attack. Network Vaughin requires accurate detection and analysis of targeted attacks and proactive response to potential threats, which is very difficult. Known malware can be countered by solutions such as existing anti-malware or vaccines. However, in the case of targeted attacks using new or variant malware, there is a limit to responding with solutions such as existing anti-malware or vaccines.

After all, detecting and responding to new or variant malware is a very important issue in improving the security of the network.

The inventors of the present invention analyze the detection event of the existing security solution after deeply thinking about this problem, and use the IoC of the previously detected malicious file to determine the process and procedures (TTPs: Tactics Techniques and Procedures) of the malicious file. By providing visibility, the present invention has been accomplished with respect to a device or method capable of efficiently responding to targeted attacks using new or variant malware.

It is an object of the present invention to analyze a detection event of a security solution and provide visibility to the process and procedures (TTPs: Tactics Techniques and Procedures) of a malicious file using the IoC of a previously detected malicious file, thereby preventing new or variant malware. It is to provide a method that can efficiently respond to the used targeted attack.

Meanwhile, other objects not specified of the present invention will be additionally considered within a range that can be easily deduced from the following detailed description and effects thereof.

In order to achieve the above task, the method of extracting TTPs (Tactics Techniques and Procedures) of malicious suspicious files according to a preferred embodiment of the present invention transmits events of previously detected malicious files and events of newly detected malicious suspicious files from an event source. Receiving and parsing; Indexing and storing the parsed event of the previously detected malicious file as malware IoC, IP blacklist IoC, URL blacklist IoC, and indexing and storing the parsed event of the newly detected malicious suspicious file as YARA file IoC; And generating a TTPs table by extracting TTPs using the malware IoC, IP blacklist IoC, URL blacklist IoC, and YARA file IoC generated from the newly detected malicious suspicious file from the previously detected malicious file; including; And, the step of generating the TTPs table is performed by a malware-based TTPs extraction method, and the malware-based TTPs extraction method includes (A-1) the remote IP of the hash of the malware IoC and the remote IP of the IP blacklist IoC. Extracting a list; (A-2) extracting a list in which the C&C of the hash of the malware IoC and the URL of the URL blacklist IoC are the same; (A-3) sorting the list extracted in steps A-1 and A-2 based on time; And (A-4) sorting based on the time for LIP (Local IP) in step A-3.
In order to achieve the above problem, the method of extracting TTPs (Tactics Techniques and Procedures) of malicious suspicious files according to another preferred embodiment of the present invention is a process and procedure (TTPs) of newly detected malicious files using previously detected malicious files. A method of extracting: receiving and parsing an event of a previously detected malicious file and an event of a newly detected malicious file from an event source; Indexing and storing the parsed event of the previously detected malicious file as malware IoC, IP blacklist IoC, URL blacklist IoC, and indexing and storing the parsed event of the newly detected malicious suspicious file as YARA file IoC; And generating a TTPs table by extracting TTPs using the malware IoC, IP blacklist IoC, URL blacklist IoC, and YARA file IoC generated from the newly detected malicious suspicious file from the previously detected malicious file; including; And, the step of creating the TTPs table is performed by an IP blacklist-based TTPs extraction method, and the IP blacklist-based TTPs extraction method includes (B-1) extracting a list of malware identical to the remote IP of the malware IoC. step; (B-2) extracting a CVE list having the same remote IP of the malware IoC; And (B-3) arranging the malware list and the CVE list in LIP (Local IP) based on time.

delete

delete

delete

delete

According to the problem solving means of the present invention as described above, the present invention includes at least one of malware IoC, IP blacklist IoC, and URL blacklist IoC by analyzing the previously detected malicious file by analyzing the detection event of the existing security solution. By creating an IoC table and extracting the process and procedures (TTPs) of the malicious suspicious file using the generated IoC table, not only fragmentary information on the targeted attack is provided, but also visibility of detailed techniques and procedures of the attack is provided. do.

Furthermore, by using the present invention, it is possible to quickly and accurately detect and respond to targeted attacks using new or variant malware, and to detect potential attacks.

On the other hand, even if it is an effect not explicitly mentioned herein, it is added that the effect described in the following specification and its provisional effect expected by the technical features of the present invention are treated as described in the specification of the present invention.

1 is a schematic structural diagram of an apparatus for extracting a process and procedures (TTPs) of a malicious suspicious file according to an embodiment of the present invention.
2 is a schematic flowchart of a process of a suspicious malicious file and a method of extracting TTPs according to another embodiment of the present invention.
The accompanying drawings are exemplified by reference for an understanding of the technical idea of the present invention, and the scope of the present invention is not limited thereto.

In the description of the present invention, when it is determined that the subject matter of the present invention may be unnecessarily obscured as matters apparent to those skilled in the art with respect to known functions related to the present invention, a detailed description will be omitted.

1 is a schematic structural diagram of an apparatus 100 for extracting a process and procedure (TTPs) of a malicious suspicious file according to an embodiment of the present invention. The apparatus 100 for extracting processes and procedures (TTPs) of malicious suspicious files according to an embodiment of the present invention may be configured based on a big data engine.

The apparatus 100 for extracting a process of a malicious suspicious file and a procedure (TTPs) according to an embodiment of the present invention may be implemented in various forms. It can be implemented in software using a computer-based device, or it can be implemented by configuring dedicated hardware. The apparatus 100 for extracting a process and procedure (TTPs) of a malicious suspicious file according to the present invention may be implemented using a Field Programmable Gate Array (FPGA). FPGAs are programmable semiconductors, and have a feature that allows users to implement hardware designed as needed with application specific integrated circuits (ASICs) that cannot be modified once they are manufactured. Since it is implemented as a hardware semiconductor by a logic device, it has the advantage of being much faster than software implementation. Meanwhile, the apparatus 100 for extracting a process and procedure (TTPs) of a malicious suspicious file according to an embodiment of the present invention may be manufactured based on a big data engine.

The apparatus 100 for extracting a process and procedure (TTPs) of a malicious suspicious file according to an embodiment of the present invention consists of an event parser 10, an IoC generator 20, an IoC storage 30 and a TTPs generator 40 do. In addition, it may be configured to further include a white list storage 50 and a risk assessor (60). The process of the malicious suspicious file and the operation process and result of the TTPs extraction apparatus 100 according to an embodiment of the present invention may be provided through a user interface 70 such as a display device. In this document, an event is described as a concept including a log.

The present invention uses information on malicious files previously detected by the event source 1, and extracts processes and procedures (TTPs) of malicious suspicious files newly detected by the event source 1. Processes and procedures of malicious suspicious files (TTPs) refer to techniques or procedures used in an attack, and through the processes and procedures (TTPs) of the extracted malicious suspicious files, it is possible to prepare for the behavior of malicious suspicious files. Here, an action means an action at the time of an attack by malware (file), such as creating a file, downloading a file (download, drop), creating a process, searching a file, creating a registry, encrypting a file, accessing a specific IP, domain, or URL. Etc.

Meanwhile, the event source 1 includes an endpoint security solution (vaccine, anti-malware, etc.), a packet-based intrusion detection and prevention system, and a network-based file detection system (network forensic equipment).

The event parser 10 collects events generated from the event source 1 or checks the log format, and transmits the result to the IoC generator 20. The event parser 10 of the present invention handles two types of events. The first is a previously detected malicious file, and the second is a newly detected suspicious file. The previously detected malicious file means that it is finally determined as a malicious file by the event source 1. Suspicious malicious files are unknown but suspected malware (virus) or unknown malware.

The IoC generator 20 indexes and stores information received from the event parser 10 according to the IoC structure for each type. The IoC generator 20 receiving the previously detected malicious file indexes the previously detected malicious file as a malware IoC (31), an IP blacklist IoC (32), and a URL blacklist IoC (33), and indexes the previously detected malicious file into the IoC storage (30). Save it. Malware IoC data structure is time, Hash[M5], Host IP[Endpoint IP](HIP), Remote IP(RIP), C&C, Malware category[Type](MT), Platform[Windows, Linux], Detection name[ malware name](DName) may be composed of some or all of them. The data structure of the IP blacklist IoC may be configured to include some or all of time, Remote IP (RIP), Common Vulnerability Exposure (CVE), Protocol, and Attack name (AName). The data structure of the URL blacklist IoC may include some or all of time, URL, and protocol. The IoC generator 20 receiving the newly detected malicious suspicious file indexes the YARA file IoC 34 and stores it in the IoC storage 30. The data structure of YARA file IoC includes time, Hash[m5], Host IP[Endpoint IP](HIP), Remote IP(RIP), URL, YARA category[Type](YT), and some or all of the protocol. Can be.

The TTPs generator 40 is created from malware IoC 31, IP blacklist IoC 32, URL blacklist IoC 33 and newly detected malicious suspicious files generated from previously detected malicious files stored in the above-described IoC storage. The TTPs table 45 is created and indexed using the YARA file IoC 34.

The TTPs generator 40 can generate the TTPs table 45 in various ways. A specific method will be described in the process of a malicious suspicious file and a method of extracting TTPs according to another embodiment of the present invention to be described later.

The risk evaluator 60 calculates the risk, including the malware category[type], Yara category[type], and CVE severity, of the related malware using TTPs generated from the YARA file IoC(34). Create detailed information and timeline of the event to be displayed.

The risk level calculated by the risk evaluator 60 and detailed information and timeline of the event are provided to the user through the user interface 70.

The process and procedure (TTPs) extraction apparatus 100 of a malicious suspicious file according to an embodiment of the present invention described above analyzes a detection event of an existing security solution, analyzes a previously detected malicious file, and analyzes the malware IoC, IP By creating an IoC table including at least one of blacklist IoC and URL blacklist IoC, and extracting the process and procedures (TTPs) of the malicious suspicious file using the generated IoC table, only fragmentary information on the targeted attack It does not provide visibility into the detailed techniques and procedures of an attack.

2 is a schematic flowchart of a process of a suspicious malicious file and a method of extracting TTPs according to another embodiment of the present invention. The process of extracting malicious suspicious files and procedures (TTPs) according to another embodiment of the present invention may be driven by the process of extracting malicious suspicious files and procedures (TTPs) according to the embodiment of the present invention. have.

First, a step (S10) of parsing an event from an event source is performed. In the parsing step (S10), events generated from the event source are collected or the log format is checked. In particular, the parsing step (S10) handles two types of events, one is a previously detected malicious file, and the other is a newly detected malicious suspicious file.

Then, the step of generating IoC (S20) is performed. In the step of creating IoC (S20), the previously detected malicious files are indexed and stored as malware IoC, IP blacklist IoC, and URL blacklist IoC, and newly detected malicious suspicious files are indexed and stored as YARA file IoC.

Next, a step (S30) of creating a TTPs table is performed. The step of creating the TTPs table (S30) is performed by extracting the TTPs using the malware IoC, IP blacklist IoC, URL blacklist IoC, and YARA file IoC generated from newly detected malicious files. do.

Looking at the step (S30) of creating the TTPs table in detail, there are three methods as follows.

The first is a method of extracting TTPs based on malware, the second is a method of extracting TTPs based on an IP blacklist, and the third is a method of extracting TTPs based on YARA.

The first method, a method of extracting TTPs based on malware, is as follows. The first method is that the TTPs generator 40 extracts the behavior of an internal endpoint for a specific malware. For example, internal endpoint behaviors include Hash, LIP, Remote IP, C&C, Malware category[Type], and Platform.

First, in step A-1, a list in which the remote IP of the hash and the remote IP of the IP blacklist IoC 32 are the same is extracted.

Subsequently, in step A-2, a list in which the C&C of the hash and the URL of the URL blacklist IoC 33 are identical is extracted.

In step A-3, the list extracted in steps A-1 and A-2 is sorted by time.

Sort the time criteria for the LIP in steps A-3 by step A-4.

As a final step A-5, the whitelisted files are removed compared to the file whitelist 51, the IP whitelist 52, and the URL whitelist 53 stored in the whitelist storage 50. Meanwhile, the data structure of the file whitelist 51 is composed of some or all of Hash[m5], File Type(FT), and Platfrom(Widows, Linux), and the data structure of the IP whitelist 52 is Remote IP( RIP) and a part or all of the protocol, and the data structure of the URL whitelist 53 is composed of URL.

The search period in steps A-1 to A-5 can be defined as any one of 1 day, 1 week, 1 month, 3 months and 6 months.

If all results in steps A-1 to A-4 are null, A-1 again for other malware that has the same Malware category [Type] as the specific malware that performed steps A-1 to A-4. Perform steps A-4.

The second method, the method of extracting TTPs based on the IP blacklist, extracts the vulnerabilities of the malware that has been invaded from a specific IP blacklist. Vulnerability can mean Remote, Hash, LIP, C&C, Common Vulnerability Exposure (CVE), etc.

First, in step B-1, a list of malware identical to the remote IP is extracted. Next, in step B-2, a CVE list with the same remote IP is extracted. In step B-3, the malware list and CVE list in the LIP are sorted by time.

The third method, YARA-based TTPs extraction, is to extract potential threats from specific malicious suspicious files. Potential threats are Hash1, Hash2, Similarity, LIP, Remote IP, Common Vulnerability, C&C, Platform, YARA Category[Type], Malware Category[Type], etc.

First, a Malware similarity score between the YARA file IoC 34 and the malware IoC 31 is calculated in step C-1. For malware similarity, ssdeep based on fuzzy hash can be used, or imphash can be used to determine the similarity by importing libraries and APIs having a specific order in an executable file. Even more preferably, malware similarity may be impfuzzy. Impfuzzy imports API like imphash, but it has the highest accuracy as it determines malware similarity by processing imported API as fuzzy hash. The degree of similarity can be determined by dividing the section into several levels. It can be classified as below.

Next, in step C-2, if the degree of similarity in step C-1 is higher than a certain level (for example, upper level), the remote IP for the malware is extracted.

In step C-3, if the degree of similarity in step C-1 is higher than a certain level (eg, phase), C&C for malware is extracted.

In step C-4, if the degree of similarity in step C-1 is higher than a certain level (for example, phase), CVE for malware is extracted.

When the step of generating the TTPs table (S30) is completed in the above manner, the step of calculating the risk (S40) is performed. In the step of calculating the risk (S40), the risk is calculated by using the generated TTPs, including the malware category[type], Yara category[type], and CVE severity of related malware.

For reference, a process of a malicious suspicious file and a method of extracting TTPs according to another embodiment of the present invention may be implemented in the form of program commands that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the present invention, or may be known and usable to those skilled in computer software.

Examples of computer-readable media include hard disks, magnetic media such as floppy disks and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magnetic-optical media such as floptical disks, and ROM, RAM, A hardware device specially configured to store and execute program instructions such as flash memory or the like may be included. Examples of program instructions include not only machine language codes created by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The above-described hardware device may be configured to operate as one or more software modules to perform the operation of the present invention, and vice versa.

The scope of protection of the invention is not limited to the description and expression of the embodiments explicitly described above. In addition, it is added once again that the scope of protection of the present invention may not be limited due to obvious changes or substitutions in the technical field to which the present invention pertains.

Claims (5)

As a method of extracting processes and procedures (TTPs) of newly detected malicious files by using previously detected malicious files:
Receiving and parsing an event of a previously detected malicious file and an event of a newly detected malicious suspicious file from an event source;
Indexing and storing the parsed event of the previously detected malicious file as malware IoC, IP blacklist IoC, URL blacklist IoC, and indexing and storing the parsed event of the newly detected malicious suspicious file as YARA file IoC; And
Generating a TTPs table by extracting TTPs using malware IoC, IP blacklist IoC, URL blacklist IoC, and YARA file IoC generated from newly detected malicious suspicious files. ,
The step of generating the TTPs table is performed by a malware-based TTPs extraction method,
The malware-based TTPs extraction method,
(A-1) extracting a list in which the remote IP of the hash of the malware IoC and the remote IP of the IP blacklist IoC are the same;
(A-2) extracting a list in which the C&C of the hash of the malware IoC and the URL of the URL blacklist IoC are the same;
(A-3) sorting the list extracted in steps A-1 and A-2 based on time; And
(A-4) Arranging based on the time for LIP (Local IP) in step A-3; containing,
Process and procedure of malicious suspicious files (TTPs) extraction method.
As a method of extracting processes and procedures (TTPs) of newly detected malicious files by using previously detected malicious files:
Receiving and parsing an event of a previously detected malicious file and an event of a newly detected malicious suspicious file from an event source;
Indexing and storing the parsed event of the previously detected malicious file as malware IoC, IP blacklist IoC, URL blacklist IoC, and indexing and storing the parsed event of the newly detected malicious suspicious file as YARA file IoC; And
Generating a TTPs table by extracting TTPs using malware IoC, IP blacklist IoC, URL blacklist IoC, and YARA file IoC generated from newly detected malicious suspicious files. ,
The step of generating the TTPs table is performed by an IP blacklist-based TTPs extraction method,
The IP blacklist-based TTPs extraction method,
(B-1) extracting a list of malware identical to the remote IP of the malware IoC;
(B-2) extracting a CVE list having the same remote IP of the malware IoC; And
(B-3) arranging the malware list and the CVE list in LIP (Local IP) based on time; including,
Process and procedure of malicious suspicious files (TTPs) extraction method.
delete delete delete

Images