KR102443486B1 - Method and apparatus for displaying threat alert type - Google Patents

Abstract

A threat alert type display device and method may be provided. A device for displaying a threat alert type according to an embodiment includes a database storing information on a plurality of previously generated threat alert types and a candidate threat alert type that is likely to occur thereafter with respect to each of the plurality of past threat alert types , an input unit for receiving a target threat alert type to be analyzed, an information acquisition unit for acquiring a past threat alert type in which the target threat alert type is assigned to the candidate threat alert type from among the plurality of past threat alert types, and the target threat alert Based on the type, the display unit may include a display unit for displaying the acquired past threat alert type in connection with the target threat alert type.

Description

THREAT ALERT TYPE DISPLAY DEVICE AND METHODS

The present invention relates to a threat alert type display apparatus and method. More specifically, the present invention relates to an apparatus and method for displaying a correlation analysis result between cyber threat alert types.

Advanced Persistent Threat (APT), Denial Of Service (DOS), and Distributed Denial Of Service (DDOS) attacks that continuously attack specific organizations to achieve attack goals such as data exfiltration ) and other recent cyber attacks are occurring more frequently and their methods are becoming more sophisticated.

In order to respond to such cyber attacks, most organizations have network devices such as routers and switches, general-purpose network security devices such as intrusion detection systems (IDS) and firewalls, web application firewalls (WAFs) and anti Application-level network security devices such as DDOS equipment and application-level solutions such as Digital Rights Management (DRM) and Anti-Virus (AV) have been introduced and operated. In addition, most organizations are obligated to keep system logs for audit purposes or for accident analysis and response in case of intrusion.

In addition, Enterprise Security Management (ESM) and Security Information and Event System (SIEM) are introduced to respond to cyber attacks by analyzing information and system logs collected from various security solutions. has been operated. Alternatively, technologies for detecting and responding to various cyber attacks by integrating and managing various logs are being developed.

However, current cyber attacks are not limited to one-time attacks, and attackers sequentially perform various attack methods for a long time to achieve their attack goals. it is important To this end, there is a need for a method for identifying specific attacks by collecting and analyzing various information, and for tracking and responding to the history of a cyber attack based on a scenario.

An object of the present invention is to provide an apparatus and method for displaying a correlation analysis result between cyber threat alert types.

Another object of the present invention is to provide an apparatus and method capable of grasping the context of a current attack based on a scenario.

Another object of the present invention is to provide an apparatus and method capable of predicting an attack that will occur in the future by grasping the context of a current attack based on a scenario.

The technical problems to be achieved in the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those of ordinary skill in the art to which the present invention belongs from the description below. will be able

The threat alert type display device according to an embodiment of the present invention provides information on a plurality of previously generated past threat alert types and a candidate threat alert type that is likely to occur thereafter for each of the plurality of past threat alert types. database to store; an input unit receiving an input of a target threat alert type to be analyzed; an information acquisition unit configured to acquire a past threat alert type in which the target threat alert type is assigned to the candidate threat alert type from among the plurality of past threat alert types; and a display unit for displaying the acquired past threat alert type with the target threat alert type as the center of the target threat alert type.

In the device for displaying the threat alert type, the information acquiring unit further acquires a candidate threat alert type that is likely to occur after the target threat alert type from the database, and the display unit includes: Candidate threat alert types can be further linked and displayed.

In the device for displaying the threat alert type, the display unit is configured to determine a connection relationship between the target threat alert type and the acquired past threat alert types, a connection relationship between the target threat alert type and the acquired candidate threat alert types; can be displayed differently.

In the device for displaying a threat alert type, a probability of occurrence of a candidate threat alert type that is likely to occur thereafter for each of the plurality of past threat alert types may be stored as a probability in the database.

In the device for displaying a threat alert type, a generation condition for a candidate threat alert type that is likely to occur thereafter for each of the plurality of past threat alert types may be additionally stored in the database.

In the device for displaying the threat alert type, the database further stores attribute information for each of the plurality of past threat alert types, and the information acquisition unit includes: the target threat alert type and the acquired past threat alert type attribute information is obtained from the database and clustered, and the display unit may display the target threat alert type and the acquired past threat alert type based on the clustering result.

The method for displaying a threat alert type according to another embodiment of the present invention may be performed by the threat alert type display device, and thereafter for a plurality of previously generated threat alert types and each of the plurality of past threat alert types storing information on candidate threat alert types that are likely to occur in the database; receiving a target threat alert type to be analyzed; acquiring a past threat alert type in which the target threat alert type is assigned to the candidate threat alert type from among the plurality of past threat alert types; and linking the acquired past threat alert type to the target threat alert type and displaying the acquired threat alert type based on the target threat alert type.

In the method for displaying a threat alert type, the acquiring includes: acquiring a candidate threat alert type that is likely to occur after the target threat alert type from the database, and the displaying includes: The method may include additionally connecting and displaying the acquired candidate threat alert type to the alert type.

In the method for displaying a threat alert type, the displaying comprises: establishing a connection relationship between the target threat alert type and the acquired past threat alert types, and connecting the target threat alert type and the acquired candidate threat alert types It can be displayed differently from the relationship.

In the method for displaying a threat alert type, a probability of occurrence of a candidate threat alert type that is likely to occur thereafter for each of the plurality of past threat alert types may be stored as a probability in the database.

In the method for displaying a threat alert type, a generation condition for a candidate threat alert type that is likely to occur thereafter for each of the plurality of past threat alert types may be additionally stored in the database.

In the method for displaying the threat alert type, the database additionally stores attribute information for each of the plurality of past threat alert types, and the acquiring includes: the target threat alert type and the acquired past threat alert type and clustering by acquiring attribute information on the from the database, wherein the displaying comprises: displaying the target threat alert type and the acquired past threat alert type based on the clustered result may include steps.

According to the present invention, an apparatus and method for displaying a correlation analysis result between cyber threat alert types may be provided.

Also, according to the present invention, an apparatus and method capable of grasping the context of a current attack based on a scenario may be provided.

Further, according to the present invention, an apparatus and method for predicting an attack to occur in the future by grasping the context of a current attack based on a scenario may be provided.

The effects obtainable in the present invention are not limited to the above-mentioned effects, and other effects not mentioned may be clearly understood by those of ordinary skill in the art from the following description. will be.

1 is a diagram for explaining a threat alert type display device according to an embodiment of the present invention.
2 and 3 are diagrams for explaining a connection relationship between threat alert types according to an embodiment of the present invention.
4 to 6 are diagrams for explaining a display form of a threat association graph according to an embodiment of the present invention.
7 and 8 are diagrams for explaining a display form of a threat-related alert status according to an embodiment of the present invention.
9 is a diagram for explaining a method for displaying a threat alert type according to an embodiment of the present invention.

Advantages and features of the present invention and methods of achieving them will become apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various different forms, and only these embodiments allow the disclosure of the present invention to be complete, and common knowledge in the technical field to which the present invention pertains It is provided to fully inform those who have the scope of the invention, and the present invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout.

In describing the embodiments of the present invention, if it is determined that a detailed description of a well-known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, the terms to be described later are terms defined in consideration of functions in an embodiment of the present invention, which may vary according to intentions or customs of users and operators. Therefore, the definition should be made based on the content throughout this specification.

Hereinafter used '… wealth', '… The term 'group' means a unit for processing at least one function or operation, which may be implemented as hardware or software, or a combination of hardware and software.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram for explaining a threat alert type display device according to an embodiment of the present invention.

Referring to FIG. 1 , an apparatus 100 for displaying a threat alert type according to an embodiment of the present invention may include a database 110 , an input unit 120 , an information acquisition unit 130 , and a display unit 140 . . However, the present invention is not limited thereto, and may further include a module necessary for displaying a threat alert type.

A threat alert is an alert corresponding to a cyber attack, and may be classified into one or more threat alert types according to a preset taxonomy. In this case, the preset classification system may refer to a classification system for classifying threat alerts according to cyber attack types. In addition, the threat alert may be mapped to one of each level in the threat classification system defined according to the kill chain stage, tactics, behaviors, skills and procedural levels.

The database 110 may store information on at least one or more types of threat alerts. The at least one or more threat alert types stored in the database 110 may include a previously generated past threat alert type and a candidate threat alert type that has not yet been detected for the past threat alert type but is likely to occur thereafter. There may be at least one candidate threat alert type.

In this case, the database 110 may store the occurrence condition and occurrence probability of a candidate threat alert type that has not yet been detected for each of the plurality of past threat alert types, but is likely to occur thereafter.

The occurrence probability may mean a probability that a candidate threat alert type may occur from a past threat alert type for a specific occurrence condition. For example, threat alert type 'A' followed by threat alert type 'B' 5 times, threat alert type 'A' followed by threat alert type 'C' 6 times, and 'A' If there is no history of occurrence of a threat alert type other than 'B' or 'C' after ', '5/11' may be stored with the probability that 'B' will occur after 'A' in the database, and 'A' Thereafter, '6/11' may be stored as a probability of occurrence of 'C'.

In addition, attribute information for each of a plurality of past threat alert types may be stored in the database 110 . The attribute information may be a classification criterion in the kill chain stage of the threat classification system. For example, the attribute information may be at least one of reconnaissance, infiltration, base capture, goal achievement, and attack support. The display form of the threat alert type according to the classification criteria in the kill chain stage will be described later in the description related to FIG. 7 .

The database 110 may include at least one of a volatile memory and a non-volatile memory.

The input unit 120 may receive a target threat alert type to be analyzed. Specifically, the input unit 120 may receive a target threat alert type classified according to a preset classification system for the target threat alert. Alternatively, the input unit 120 may receive a target threat alert itself, and the received threat alert may be classified into one or more target threat alert types according to a classification system preset in the threat alert type display apparatus 100 . The attribute information on the target threat alert type may be stored in the database 110 .

The information acquisition unit 130 may acquire a past threat alert type in which a target threat alert type is assigned to a candidate threat alert type from among a plurality of past threat alert types stored in the database 110 .

For example, A and B may be stored as past threat alert types in the database 110 , and C and D may be assigned to A and B as candidate threat alert types, respectively. In this case, if the target threat alert type received through the input unit 120 is C, the information acquisition unit 130 may acquire the past threat alert type A to which C is assigned as the candidate threat alert type.

Also, the information acquisition unit 130 may acquire a candidate threat alert type that is likely to occur after the target threat alert type from the database 110 .

For example, when the target threat alert type is C, the information acquisition unit 130 may acquire a candidate threat alert type that is likely to occur after C from the database 110 .

In addition, the information acquisition unit 130 may perform clustering by acquiring attribute information on the target threat alert type and the past threat alert type from the database 110 . In this case, the attribute information may be a classification criterion in the kill chain stage of the aforementioned threat classification system. Specifically, the information acquisition unit 130 may cluster the target threat alert type and the past threat alert type to a higher level based on the attribute information. A display form of a threat alert type according to clustering will be described later in the description related to FIGS. 5 and 6 .

The display unit 140 may display the target threat alert type by connecting the past threat alert type to the target threat alert type. Also, the display unit 140 may additionally connect and display the candidate threat alert type to the target threat alert type.

In this case, the display unit 140 may display the connection relationship between the target threat alert type and the acquired past threat alert types differently from the connection relationship between the target threat alert type and the acquired candidate threat alert types. have. For example, the display unit 140 may display a connection relationship between the target threat alert type and the acquired past threat alert types in the form of a solid line, and a connection relationship between the target threat alert type and the acquired candidate threat alert types can be displayed in the form of a dotted line. In this case, the solid line and the dotted line may be displayed with different thicknesses depending on the probability that there is a correlation.

In addition, the display unit 140 may display the target threat alert type and the past threat alert type clustered to a higher level based on the attribute information in the information acquisition unit 130 .

The display unit 140 may display the correlation of the threat alert type in the form of at least one of a threat correlation graph and a threat alert status. The threat association graph will be described later in the description related to FIGS. 4 to 6 , and the threat alert status will be described later in the description related to FIGS. 7 and 8 .

2 and 3 are diagrams for explaining a connection relationship between threat alert types according to an embodiment of the present invention.

2 and 3 , each threat alert type is indicated in a circle, and the order of reception/detection of the threat alert type is described in each circle. Hereinafter, a form in which a target threat alert type is connected to a past threat alert type and a form in which a target threat alert type is connected to a candidate threat alert type will be described.

For example, referring to FIGS. 2A and 2B , when target threat alert types '1' and '2' are not assigned as candidate threat alert types of other threat alert types, the target threat alert Types '1' and '2' are not connected with other threat alert types in the form of a solid line, but may only be connected with a candidate threat alert type in the form of a dotted line for each target threat alert type. For example, candidate threat alert types of target threat alert types '1' and '2' may include threat alert type '3'. 2 shows that there are two candidate threat alert types, but is not limited thereto.

Also, referring to FIG. 2( c ), when the target threat alert type is '3' and the past threat alert types assigned '3' as a candidate threat alert type are '1' and '2', respectively, FIG. 2 As shown in (c), the target threat alert type '3' may be connected to the past threat alert types '1' and '2' in the form of a solid line. Also, candidate threat alert types of target threat alert type '3' may be connected by a dotted line. In this case, the candidate threat alert type of the target threat alert type '3' may include the threat alert type '4'.

Also, referring to FIG. 3( a ), when the target threat alert type is '4', the past threat alert type '3', which assigned '4' as a candidate threat alert type, is the target threat alert type '4' and a solid line. form can be connected. Also, referring to FIG. 3(b) , when a threat alert type '5' is assigned to a threat alert type '5' as a candidate threat alert type in the past threat alert type '4', if a target threat alert type '5' is input, the past threat alert type A '4' and a target threat alert type '5' may be connected in the form of a solid line.

Therefore, as shown in FIGS. 2 and 3 , the past threat alert types that occurred before the currently generated threat alert type are connected with a solid line, and the candidate threat alert type that will occur after the currently generated threat alert type is displayed with a dotted line. In this case, the attack flow performed by the attacker so far can be analyzed at a glance, and it can be effective for administrators to predict the stage and direction of the attack in the future.

4 to 6 are diagrams for explaining a display form of a threat association graph according to an embodiment of the present invention. Hereinafter, attributes 1 to 3 of FIGS. 4 to 6 are threat alert type attribute information, and the attribute information may be a classification criterion in the kill chain stage of the threat classification system. For example, the attribute information may be at least one of reconnaissance, infiltration, base capture, goal achievement, and attack support. In addition, although it is illustrated that there are three attributes in FIGS. 4 to 6 , the present invention is not limited thereto.

4 shows a threat correlation graph of the alert stage. Specifically, each threat alert is divided into different colors according to attribute information (eg, attribute 1, attribute 2, and attribute 3), and correlated threat alerts may be connected and displayed in the form of a solid line.

For example, referring to FIG. 4 , threat alert '109' having attribute 3 may be correlated with threat alert '116' having attribute 1 to be connected in the form of a solid line. Also, the threat alert '116' having the attribute 1 has a correlation with the threat alert '117' having the attribute 2, and thus may be connected in the form of a solid line.

5 and 6 are threat correlation graphs, in which a plurality of threat alert types are connected based on correlation, and are divided into different colors according to attribute information (eg, attribute 1, attribute 2, and attribute 3). In this case, FIG. 5 is a threat association graph of 'step 1', and may be a threat association graph of an upper stage in which the threat alert types of 'step 2' shown in FIG. 6 are clustered. That is, the threat alert types shown in FIG. 6 may be clustered to a higher level according to attribute information of each threat alert type and displayed as shown in FIG. 5 . Although it is illustrated that there are two steps in FIGS. 5 and 6 , the present invention is not limited thereto.

For example, step 1 may be a 'tactical' step in the threat classification system, and step 2 may be a 'action' stage in the threat classification system, but is not limited thereto.

In addition, each threat alert type (eg, types 1 to 7) illustrated in FIG. 5 may be a threat alert type corresponding to step 1 (eg, tactical stage). For example, types 1 to 7 may be at least one of privilege elevation, internal reconnaissance, execution, command control communication, information leakage, information collection, defense evasion, and asset information collection.

In addition, each threat alert type (eg, types 8 to 16) illustrated in FIG. 6 may be a threat alert type corresponding to stage 2 (eg, action stage). For example, types 8 to 16 may be at least one of a weak access control exploit, data compression, command control communication, remote service use, collection from a local system, OS/software information discovery, and vulnerability exploitation.

In this case, although 16 types of threat alerts are illustrated in FIGS. 5 and 6 , the present invention is not limited thereto.

Therefore, according to an embodiment of the present invention, past threat alert types that occurred before the current threat alert type are connected by a solid line and attribute information of each threat alert type is displayed, so that an administrator can easily understand the attack context. It works. In addition, as shown in FIG. 5 , as the result of clustering each threat alert type to a higher level is displayed, the administrator can analyze a multi-level attack based on a scenario, understand the attack context of the current attack, and effectively respond to it. have.

7 and 8 are diagrams for explaining a display form of a threat-related alert status according to an embodiment of the present invention.

FIG. 7 shows the threat alert status in a kill chain view, and FIG. 8 shows the threat alert status in a timeline view.

The kill chain view may be a classification of each threat alert type according to attribute information as a classification criterion. For example, the attribute information may be at least one of reconnaissance, infiltration, base capture, goal achievement, and attack support. Specifically, referring to FIG. 7 , threat alert types are classified according to each attribute information (eg, attributes 1 to 3), and a correlation between each threat alert type is connected in the form of a solid line and/or a dotted line.

In this case, when a specific threat alert type is selected in the kill chain view, the candidate threat alert types assigned by the threat alert type may be connected and displayed in the form of a dotted line.

Also, the threat alert types that are correlated may be connected and displayed in the form of a solid line.

For example, referring to FIG. 7 , when the threat alert type '6' is selected, the candidate threat alert types '1' and '8' allocated by the threat alert type '6' are separated from the threat alert type '6' by a dotted line. It can be connected and displayed in the form of In addition, past threat alert types '2', '4' and '5' in which the threat alert type '6' is assigned as the candidate threat alert type may be displayed in connection with the threat alert type '6' in the form of a solid line.

Also, although not shown, the kill chain view may also be clustered and displayed in at least one step based on attribute information, as in FIGS. 5 and 6 described above.

In the timeline view, each threat alert type may be displayed in chronological order. For example, referring to FIG. 8 , threat alert type '6' generated/detected at '2020-03-05 00:42:24' occurs/at '2020-03-05 00:42:24' There is a correlation with the detected threat alert type '5' and is connected in the form of a solid line.

9 is a diagram for explaining a method for displaying a threat alert type according to an embodiment of the present invention.

The threat alert type display device according to an embodiment of the present invention provides information on a plurality of previously generated past threat alert types and a candidate threat alert type that is likely to occur thereafter for each of the plurality of past threat alert types. It can be stored in the database (S901). However, the step S901 may be previously performed before the execution of the threat alert type display method.

Also, the threat alert type display device may receive a target threat alert type to be analyzed (S902).

Also, the device for displaying a threat alert type may acquire a past threat alert type in which the target threat alert type is assigned to the candidate threat alert type from among a plurality of past threat alert types ( S903 ).

In this case, the step S903 may include acquiring a candidate threat alert type that is likely to occur after the target threat alert type from the database.

In addition, the step S903 may include clustering by acquiring the target threat alert type and attribute information on the acquired past threat alert type from the database.

In addition, the threat alert type display device may display the acquired past threat alert type with the target threat alert type as the center of the target threat alert type ( S904 ).

In this case, the step S904 may include displaying the obtained candidate threat alert type by additionally connecting to the target threat alert type.

In addition, in step S904, the connection relationship between the target threat alert type and the acquired past threat alert types may be displayed differently from the connection relationship between the target threat alert type and the acquired candidate threat alert types. .

In addition, the step S904 may include displaying the target threat alert type and the acquired past threat alert type based on the clustered result.

Combinations of each block in the block diagram attached to this specification and each step in the flowchart may be performed by computer program instructions. These computer program instructions may be embodied in a processor of a general-purpose computer, special-purpose computer, or other programmable data processing equipment, such that the instructions executed by the processor of the computer or other programmable data processing equipment correspond to each block in the block diagram or in the flowchart. Each step creates a means for performing the described functions. These computer program instructions may also be stored in a computer-usable or computer-readable memory that may direct a computer or other programmable data processing equipment to implement a function in a particular manner, and thus the computer-usable or computer-readable memory. The instructions stored in the block diagram may produce an article of manufacture containing instruction means for performing the functions described in each block in the block diagram or in each step in the flowchart. The computer program instructions may also be mounted on a computer or other programmable data processing equipment, such that a series of operational steps are performed on the computer or other programmable data processing equipment to create a computer-executed process to create a computer or other programmable data processing equipment. It is also possible that instructions for performing the processing equipment provide steps for performing the functions described in each block of the block diagram and each step of the flowchart.

Further, each block or each step may represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function(s). It should also be noted that in some alternative embodiments it is also possible for the functions recited in blocks or steps to occur out of order. For example, it is possible that two blocks or steps shown one after another may in fact be performed substantially simultaneously, or that the blocks or steps may sometimes be performed in the reverse order according to the corresponding function.

The above description is merely illustrative of the technical idea of the present invention, and various modifications and variations will be possible without departing from the essential quality of the present invention by those skilled in the art to which the present invention pertains. Accordingly, the embodiments disclosed in the present specification are for explanation rather than limiting the technical spirit of the present invention, and the scope of the technical spirit of the present invention is not limited by these embodiments. The protection scope of the present invention should be construed by the following claims, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

100: threat alert type display device
110: database
120: input unit
130: Information Acquisition Department
140: display unit

Claims (12)

A threat alert type display device comprising:
a database for storing information on a plurality of previously generated past threat alert types and a candidate threat alert type that is likely to occur thereafter for each of the plurality of past threat alert types;
an input unit receiving an input of a target threat alert type to be analyzed;
an information acquisition unit configured to acquire a past threat alert type in which the target threat alert type is assigned to the candidate threat alert type from among the plurality of past threat alert types; and
and a display unit for displaying the acquired past threat alert type, centered on the target threat alert type, connected to the target threat alert type,
In the database,
Attribute information for each of the plurality of past threat alert types is additionally stored,
The information acquisition unit,
A candidate threat alert type that is likely to occur after the target threat alert type is additionally acquired from the database, and attribute information about the target threat alert type and the acquired past threat alert type is acquired from the database, and clustering is performed. and
The display unit,
The target threat alert type is additionally connected to the acquired candidate threat alert type and displayed, and a connection relationship between the target threat alert type and the acquired past threat alert types is determined by the target threat alert type and the acquired candidate threat. A threat that displays differently from the connection relationship between alert types, displays the target threat alert type and the acquired past threat alert type based on the clustered result, and classifies each threat alert type according to the attribute information Displays the alarm status in the form of a kill chain view or a timeline view,
In the form of the kill chain view, when a specific threat alert type is selected, the line connection status between the threat alert types correlated with the line connection status for the candidate threat alert type assigned by the threat alert type is displayed differently;
In the timeline view form, each threat alert type is displayed in chronological order.
Threat alert type display device. delete delete According to claim 1,
In the database,
For each of the plurality of past threat alert types, the probability of occurrence of a candidate threat alert type that is likely to occur thereafter is stored as a probability.
Threat alert type display device. According to claim 1,
In the database,
For each of the plurality of past threat alert types, an occurrence condition for a candidate threat alert type that is likely to occur thereafter is additionally stored.
Threat alert type display device. delete A method for displaying a threat alert type performed by a threat alert type display device, the method comprising:
storing, in a database, information on a plurality of previously generated past threat alert types and candidate threat alert types that are likely to occur thereafter for each of the plurality of past threat alert types;
receiving a target threat alert type to be analyzed;
acquiring a past threat alert type in which the target threat alert type is assigned to the candidate threat alert type from among the plurality of past threat alert types; and
centering on the target threat alert type, and displaying the acquired past threat alert type in connection with the target threat alert type,
In the database,
Attribute information for each of the plurality of past threat alert types is additionally stored,
The obtaining step is
acquiring a candidate threat alert type that is likely to occur after the target threat alert type from the database, and acquiring attribute information about the target threat alert type and the acquired past threat alert type from the database for clustering ) comprising the step of
The displaying step is
additionally connecting and displaying the acquired candidate threat alert type to the target threat alert type, and establishing a connection relationship between the target threat alert type and the acquired past threat alert types, the target threat alert type and the acquired Displaying differently from the connection relationship between candidate threat alert types, displaying the target threat alert type and the acquired past threat alert type based on the clustered result, and each threat alert according to the attribute information Displaying the threat alert status classified by type in the form of a kill chain view or a timeline view,
In the form of the kill chain view, when a specific threat alert type is selected, the line connection status between the threat alert types correlated with the line connection status for the candidate threat alert type assigned by the threat alert type is displayed differently;
In the timeline view form, each threat alert type is displayed in chronological order.
How to display threat alert types. delete delete 8. The method of claim 7,
In the database,
For each of the plurality of past threat alert types, the probability of occurrence of a candidate threat alert type that is likely to occur thereafter is stored as a probability.
How to display threat alert types. 8. The method of claim 7,
In the database,
For each of the plurality of past threat alert types, an occurrence condition for a candidate threat alert type that is likely to occur thereafter is additionally stored.
How to display threat alert types. delete

Images