KR102468156B1 - Apparatus, method, computer-readable storage medium and computer program for calculating priority of targets in response to cyber threats - Google Patents

Abstract

The present invention relates to a cyber threat countermeasure priority calculation device, a method thereof, a computer-readable recording medium, and a computer program. More specifically, according to the cyber threat countermeasure priority calculation device, the method thereof, the computer-readable recording medium, and the computer program, by providing threat countermeasure priority information on cyber assets, damage to cyber assets can be prevented.

Description

Apparatus, method, computer readable recording medium and computer program for calculating cyber threat response target priority

The present invention relates to an apparatus, method, computer readable recording medium, and computer program for calculating cyber threat response target priority, and more particularly, to prevent damage to cyber assets by providing threat response priority information on cyber assets. It relates to a device, method, computer readable recording medium, and computer program for calculating priorities of cyber threat countermeasures that are helpful for

As information technology continues to develop in modern times, computer systems are susceptible to many security threats and vulnerabilities. What's more, not only can system administrators be burdened with collecting and maintaining information about new vulnerabilities, but they may also have to grapple with determining which patches should be applied to which systems.

Therefore, in the cyber system, it is necessary to efficiently perform tasks such as collecting information generated from various types of security devices, detecting cyber attacks, responding to occurred attacks, and finding the cause of threats through threat analysis. there is

In addition, all cyber assets have missions, and assets and components constituting assets operate in conjunction with each other to achieve missions. In particular, in modern warfare, the issue of cyber threats is very important to the extent that it is expressed as cyber warfare. became the most important part.

Therefore, as the scale of a large number of cyber assets and related application services increases, a technique for preventing damage to cyber assets by analyzing the priority of a threat response target is required.

Republic of Korea Patent No. 10-2322171 Republic of Korea Patent No. 10-1941039

Therefore, the present invention has been proposed to solve the above-described problems, and a cyber threat response target priority calculation device that helps prevent damage to cyber assets by providing threat response priority information on cyber assets. , a method, a computer readable recording medium, and a computer program.

Objects of the present invention are not limited to those mentioned above, and other objects not mentioned above will be clearly understood by those skilled in the art from the description below.

In order to achieve the above object, according to an embodiment of the present invention, a cyber threat response target priority calculation device includes an information collection unit that collects and pre-processes cyber asset information about cyber assets; a classification unit that classifies the cyber asset information by asset; a database unit for storing and managing the classified cyber asset information; and calculating a target connectivity index and a target urgency index of the cyber asset information, and calculating a priority score for threat response for each cyber asset based on the calculated target connectivity index and target urgency index. includes wealth

Here, it further includes an input/output unit for inputting information about cyber assets for calculating the threat response target priority score or outputting the calculated threat response target priority information.

In addition, the information collection unit collects at least one of vulnerability information, network information, and application information about the cyber asset as the cyber asset information.

In addition, the classification unit classifies the cyber asset information by hardware, software, and network.

In addition, the database unit may include: a target connection diagram DB for quantifying and storing information about connection relationships between an asset corresponding to the cyber asset information transmitted from the classification unit and other assets on a network; and a target criticality DB for quantifying and storing the relationship and impact of the mission supported by the asset with the asset.

In addition, the priority calculation unit calculates the target connectivity index by quantifying the connectivity level of the cyber asset in relation to at least one of the number and strength of connectivity with other assets on the network connected to the cyber asset. do.

In addition, the priority calculation unit, the target connectivity index

는 호스트 i의 표적연결도 값이고,

는 호스트 j에서 호스트 k까지 최단경로,

는 네트워크 토폴로지 상의 모든 두 호스트 간의 최단 경로 개수,

는 네트워크 토폴로지 상의 모든 두 호스트 간의 최단경로 개수 중 임의의 호스트(i)가 포함되는 최단경로 개수를 의미)를 통해 산출한다.(here,

is the target connectivity value of host i,

is the shortest path from host j to host k,

is the number of shortest paths between all two hosts in the network topology,

means the number of shortest paths including a random host (i) among the number of shortest paths between all two hosts on the network topology).

In addition, the priority calculation unit comprehensively quantifies the value evaluation score for the mission supported by the cyber asset, the contribution to the mission, and the degree of impact on the mission when the service of the corresponding cyber asset is interrupted, Calculate the index.

In addition, the target urgency index,

는 호스트 i의 표적긴요도 값이고, x는 호스트 i의 자산중요도 값이며, MIN(최소값)

MAX(최대값))를 통해 산출한다.(here,

is the target importance value of host i, x is the asset importance value of host i, and MIN(minimum value)

MAX (maximum value)).

In addition, the input/output unit receives at least one of data, commands, setting values, and variables from a user, or outputs a threat countermeasure target priority analysis result calculated from the priority calculation unit.

According to another aspect of the present invention, a method for calculating priority of a cyber threat response target includes collecting and pre-processing cyber asset information about cyber assets; classifying the pre-processed cyber asset information by asset; Calculating a target connectivity index and a target urgency index of the classified cyber assets; and calculating a threat response target priority score based on the calculated target connectivity index and target urgency index.

The method may further include at least one of inputting information for calculating the threat response target priority score and outputting the calculated threat response target priority score.

In addition, the step of calculating the target connectivity index digitizes the level of connectivity of the cyber asset in relation to at least one of the number of connections with other cyber assets on the network connected to the cyber asset and the strength of the connection relationship. Calculate the target connectivity index.

In addition, the step of calculating the target criticality index comprehensively quantifies the value evaluation score of the mission supported by the asset, the degree of contribution to the mission, and the degree of impact on the mission when the service of the asset is discontinued. Calculate the urgency index.

Another aspect of the present invention is a computer readable recording medium storing a computer program, wherein the computer program, when executed by a processor, collects and pre-processes cyber asset information about cyber assets; classifying the pre-processed cyber asset information by asset; Calculating a target connectivity index and a target urgency index of the classified cyber assets; and calculating a priority score for threat response for each cyber asset based on the calculated target connectivity index and target urgency index.

Another aspect of the present invention is a computer program stored in a computer readable recording medium, wherein the computer program, when executed by a processor, collects and pre-processes cyber asset information about cyber assets; classifying the pre-processed cyber asset information by asset; Calculating a target connectivity index and a target urgency index of the classified cyber assets; and calculating a priority score for threat response for each cyber asset based on the calculated target connectivity index and target relevance index, comprising instructions for causing the processor to perform a method including; can be

According to the apparatus and method for calculating cyber threat response target priorities according to an embodiment of the present invention, damage to cyber assets can be prevented by analyzing threat response target priorities related to cyber assets.

Effects of the present invention are not limited to those mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below.

1 is a block diagram showing the configuration of an apparatus for calculating the priority of a cyber threat countermeasure target according to an embodiment of the present invention.
2 is a flowchart for explaining a method for calculating the priority of a cyber threat countermeasure target according to an embodiment of the present invention.
3 is a flowchart for explaining a process of calculating a target connectivity index of a cyber asset according to an embodiment.
4 is a flowchart illustrating a process of calculating a target criticality index of a cyber asset according to an embodiment of the present invention.
5 is a flowchart for explaining a process of calculating a target exposure index according to an embodiment of the present invention.

Objects and effects of the present invention, and technical configurations for achieving them will become clear with reference to embodiments to be described later in detail in conjunction with the accompanying drawings. In describing the present invention, if it is determined that a detailed description of a known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description will be omitted. In addition, the terms described later are terms defined in consideration of the structure, role, and function in the present invention, which may vary according to the intention or custom of a user or operator.

However, the present invention is not limited to the embodiments disclosed below and may be implemented in a variety of different forms. Only these embodiments are provided to complete the disclosure of the present invention and to fully inform those skilled in the art of the scope of the invention, and the present invention is described only in the claims. It is only defined by the scope of the claims. Therefore, the definition should be made based on the contents throughout this specification.

Throughout the specification, when a certain component is said to "include", it means that it may further include other components without excluding other components unless otherwise stated.

Hereinafter, with reference to the accompanying drawings, preferred embodiments of the present invention will be described in more detail.

1 is a block diagram showing the configuration of an apparatus for calculating the priority of a cyber threat countermeasure target according to an embodiment of the present invention.

The device 100 for calculating priorities for countermeasures against cyber threats of FIG. 1 is according to an embodiment, and all the blocks shown in FIG. 1 are not essential components, and the device for calculating priorities for countermeasures against cyber threats in another embodiment ) may be added, changed or deleted.

Referring to FIG. 1 , an apparatus 100 for calculating cyber threat response targets priorities according to an embodiment of the present invention includes an information collection unit 110, a classification unit 130, an input/output unit 150, and a database unit 170. And it may include a priority calculator 190.

The information collection unit 110 may collect at least one of network information, application information, and vulnerability information about cyber assets as cyber asset information, convert the collected cyber asset information into a regular format, and process it.

The information collection unit 110 may include an information collection module 111 and a preprocessing module 113 .

The information collection module 111 may collect network information, application information, and vulnerability information of cyber assets or extract them from a predetermined database.

Here, the vulnerability information may be information including open vulnerability information and vulnerability check result information of cyber assets.

The network information may be information including network topology of cyber assets, access control list information, and the like.

The application information may be information including application service information executable in the cyber asset, owner account information, authentication information, and the like. Here, the application service information may include information about the name and version of the application service.

The pre-processing module 113 may convert or process the information collected by the information collection module 111 into a regular format.

The classification unit 130 may classify the pre-processed cyber asset information collected by the information collection unit 110 and converted into a regular format for each information asset corresponding to a threat countermeasure target.

To this end, the classification unit 130 may include a classification module 131 for each asset.

The asset-specific classification module 131 may classify the pre-processed cyber asset information provided by the information collection unit 110 by threat countermeasure target information assets.

Cyber asset information may be a generic term for information and information systems subject to priority analysis, and as an example, may include all hardware, software, and networks subject to priority analysis.

The input/output unit 150 may receive data, commands, setting values, or variables from a user or user terminal, or output information to inform or notify the user. To this end, the input/output unit 150 may include an input module 151 and an output module 153.

The input module 151 may receive data, commands, set values, or variables from a user. For example, the input module 151 may be provided as an input device constituting a computer, such as a keyboard and a mouse, and may employ known or to-be-known elements capable of inputting data or commands, such as an input device using voice recognition. can

The output module 153 may be a component that notifies the user of the calculated information or the priority analysis result of the threat countermeasure target. For example, the output module 153 may employ a device constituting a general computer such as a monitor and a speaker, and any type of device may be used as long as it is capable of transmitting information to a user.

The database unit 170 may store data on cyber asset information. The cyber asset information may be information about asset connectivity, asset value, asset exposure, and the like. Here, the connectivity diagram of an asset may be referred to as information based on a connection relationship between an asset and other assets. The value of an asset is information based on an assessment of the asset's target criticality. The exposure of an asset may be referred to as information based on vulnerability information related to an asset.

The database unit 170 may include a target connectivity DB 171 , a target urgency DB 173 , and a target exposure DB 175 .

The target connectivity diagram DB 171 is a DB for storing a target connectivity diagram generated by digitizing information on network connectivity between cyber assets corresponding to the cyber asset information transmitted from the classification unit 130 and other cyber assets. can

The target criticality DB 172 may be a DB for storing a generated target criticality generated by quantifying the relationship and influence between a mission supported by a cyber asset and the cyber asset.

In one embodiment, the target criticality of cyber assets may be managed in grades such as high, medium, and low based on the evaluation of each cyber asset. Accordingly, in the target criticality DB 172, the target criticality generated based on the evaluation of the value of cyber assets can be digitized and stored, and a target criticality grade can be stored according to the corresponding numerical value. A target urgency index according to a target urgency level may be stored.

The target exposure DB 173 may be a DB that stores target exposure generated by digitizing open vulnerabilities related to cyber asset information and vulnerability diagnosis results.

In general, the exposure of assets can be managed in a grade classified as good or vulnerable based on the result of vulnerabilities diagnosis of cyber assets.

Accordingly, the target exposure DB 173 can store the numerical value according to the diagnosis result of the cyber asset, and also store the grade classified according to the numerical value. can be saved

The priority calculation unit 190 calculates the target connectivity index, the target urgency index, and the target exposure index of the cyber asset information, and calculates the target connectivity index, the target urgency index, and the target exposure index of the cyber asset information. Based on this, it is possible to calculate the priority score of the threat countermeasure target.

In one embodiment, the priority calculation unit 190 comprehensively quantifies connectivity information on at least one of the number of connections between cyber assets and other assets on the connected network and the strength of the connections to obtain a target connectivity index. can be calculated

Specifically, the target connectivity index can be obtained through Equation 1 below.

[Equation 1]

는 호스트 i의 표적연결도 값이고,

는 호스트 j에서 호스트 k까지 최단경로,

는 네트워크 토폴로지 상의 모든 두 호스트 간의 최단 경로 개수,

는 네트워크 토폴로지 상의 모든 두 호스트 간의 최단경로 개수 중 임의의 호스트(i)가 포함되는 최단경로 개수를 의미한다.here,

is the target connectivity value of host i,

is the shortest path from host j to host k,

is the number of shortest paths between all two hosts in the network topology,

Means the number of shortest paths including a random host (i) among the numbers of shortest paths between all two hosts on the network topology.

In addition, the priority calculation unit 190 comprehensively quantifies the value of the mission supported by the cyber asset, the degree of contribution to the mission, and the degree of impact on the mission when the service of the corresponding cyber asset is stopped to calculate the target urgency index. can do.

Specifically, the target urgency index can be obtained through Equation 2 below.

[Equation 2]

는 호스트 i의 표적긴요도 값이고, x는 호스트 i의 자산중요도 값이며, MIN(최소값)

MAX(최대값)이다.

is the target importance value of host i, x is the asset importance value of host i, and MIN(minimum value)

is MAX (maximum value).

In addition, the priority calculation unit 190 may calculate a target exposure index by comprehensively digitizing vulnerability information related to a corresponding cyber asset and an application loaded in the corresponding cyber asset, and a vulnerability analysis result related to the corresponding cyber asset.

Specifically, the target exposure index can be obtained through Equation 3 below.

[Equation 3]

는 호스트 i의 표적노출도 값이고, MAX는 최대값, CVSS(Common Vulnerability Scoring System)는 호스트의 취약점(Common Vulnerabilities and Exposures)에 대응하는 값이며,

는 CVSS 목록에서 k번째 해당하는 CVSS 값이다. here,

is the target exposure value of host i, MAX is the maximum value, CVSS (Common Vulnerability Scoring System) is a value corresponding to the host's vulnerabilities (Common Vulnerabilities and Exposures),

is the k-th corresponding CVSS value in the CVSS list.

2 is a flow chart illustrating a method for calculating the priority of a cyber threat countermeasure target according to an embodiment of the present invention, and FIGS. 3 to 5 are a target connectivity index and target criticality index of cyber assets according to an embodiment of the present invention. It is a flowchart for explaining the process of calculating each degree index and target exposure index.

The method for calculating the priority of cyber threat countermeasures according to the present embodiment may be performed in substantially the same configuration as that of the apparatus 100 of FIG. 1 . Accordingly, components identical to those of the device 100 of FIG. 1 are given the same reference numerals, and repeated descriptions are omitted.

In addition, the method for calculating the priority of cyber threat countermeasures according to an embodiment of the present invention may be executed by software.

Referring to FIG. 2 , in the method for calculating priority of cyber threat countermeasures according to an embodiment of the present invention, first, cyber asset information may be collected and pre-processed (S110).

To this end, the cyber threat response target priority calculator 100 collects at least one of network information, application information, and vulnerability information about cyber assets as cyber asset information, converts the collected cyber asset information into a regular format, and processes it. can do.

For example, network information, application information, and vulnerability information of cyber assets may be collected or extracted from a predetermined database. Here, the vulnerability information may be information including open vulnerability information and vulnerability check result information of cyber assets. The network information may be information including network topology of cyber assets, access control list information, and the like. The application information may be information including application service information executable in the cyber asset, owner account information, authentication information, and the like. Here, the application service information may include information about the name and version of the application service.

In addition, the cyber threat response target priority calculator 100 may convert or process the collected information into a regular format.

Next, the pre-processed cyber asset information may be classified by asset (S120).

To this end, the apparatus 100 for calculating priority of cyber threat countermeasure targets may classify preprocessed cyber asset information collected in the previous step and converted into a regular format for each information asset corresponding to a threat countermeasure target.

In one embodiment, cyber asset information may be a generic term for information and information systems subject to priority analysis, and may include all hardware, software, and networks subject to priority analysis.

Next, the target connectivity index, target urgency index, and target exposure index of the classified cyber assets may be calculated (S130).

To this end, the cyber threat response target priority calculation device 100 digitizes connectivity information about at least one of the number of connections between cyber assets and other assets on the network and the strength of the connections to obtain a target connectivity index. can be calculated

Specifically, referring to FIG. 3 , the cyber threat response target priority calculator 100 may receive information about a path between two hosts on a network topology (S210). Then, it is determined whether a reference value and a target connectivity weight exist in the database unit (S220), and if it is determined that there is no reference value and target connectivity weight, a reference value and a weight for the target connectivity index may be set (S230). Here, the target connectivity weight may be a concept of importance given to the target connectivity index when the target connectivity index is greater than or equal to a predetermined value.

Meanwhile, when it is determined that the database unit has the reference value and target connectivity weights, the reference value and target connectivity weights may be detected from the database unit (S240). Next, the target connectivity index for each asset may be calculated through Equation 1 described above (S250).

는 호스트 i의 표적연결도 값이고,

는 호스트 j에서 호스트 k까지 최단경로,

는 네트워크 토폴로지 상의 모든 두 호스트 간의 최단 경로 개수,

는 네트워크 토폴로지 상의 모든 두 호스트 간의 최단경로 개수 중 임의의 호스트(i)가 포함되는 최단경로 개수를 의미한다.here,

is the target connectivity value of host i,

is the shortest path from host j to host k,

is the number of shortest paths between all two hosts in the network topology,

Means the number of shortest paths including a random host (i) among the numbers of shortest paths between all two hosts on the network topology.

In addition, the cyber threat counterpriority calculation device 100 comprehensively quantifies the value evaluation score for the mission supported by the cyber asset, the contribution to the mission, and the degree of impact on the mission when the service of the corresponding cyber asset is stopped. Thus, the target urgency index can be calculated.

Specifically, referring to FIG. 4 , the apparatus 100 for calculating cyber threat response target priorities may receive mission-related information including a mission value evaluation score, mission contribution, and mission impact (S310). Then, it is determined whether the reference value and the target urgency weight exist in the database unit (S320), and if it is determined that they do not exist, the reference value and weight for the target urgency index may be set (S330). Here, the target urgency weight may be a concept of importance given to the target urgency index when the target urgency index is greater than or equal to a predetermined value.

Meanwhile, when it is determined that the reference value and target urgency weight exist in the database unit, the reference value and target urgency weight may be detected from the database unit (S340). Next, the target urgency index for each asset may be calculated through Equation 2 described above (S350).

는 호스트 i의 표적긴요도 값이고, x는 호스트 i의 자산중요도 값이며, MIN(최소값)

MAX(최대값)이다.

is the target importance value of host i, x is the asset importance value of host i, and MIN(minimum value)

is MAX (maximum value).

In addition, the cyber threat counterpriority calculation device 100 can calculate a target exposure index by comprehensively quantifying vulnerability information related to a corresponding cyber asset and an application installed in the cyber asset, and a vulnerability analysis result related to the corresponding asset. have.

Specifically, referring to FIG. 5 , the apparatus 100 for calculating cyber threat response target priority receives vulnerability information associated with an asset (S410). Then, it is determined whether a reference value and a target exposure weight exist in the database unit (S420), and if it is determined that there is no reference value and a target exposure weight, the reference value and weight for the target exposure index may be set (S430). Here, the target exposure weight may be a concept of importance given to the target exposure index when the target exposure index is greater than or less than a predetermined value.

On the other hand, if it is determined that the database unit has the reference value and target exposure weights, the reference value and target exposure weights may be detected from the database unit (S440). Next, the target exposure index for each asset can be calculated through Equation 3 above (S450).

는 호스트 i의 표적노출도 값이고, MAX는 최대값, CVSS(Common Vulnerability Scoring System)는 호스트의 취약점(Common Vulnerabilities and Exposures)에 대응하는 값이며,

는 CVSS 목록에서 k번째 해당하는 CVSS 값이다. here,

is the target exposure value of host i, MAX is the maximum value, CVSS (Common Vulnerability Scoring System) is a value corresponding to the host's vulnerabilities (Common Vulnerabilities and Exposures),

is the k-th corresponding CVSS value in the CVSS list.

Next, based on the target connectivity index, the target urgency index, and the target exposure index, a threat countermeasure priority score for each cyber asset may be calculated (S140).

To this end, the apparatus 100 for calculating priority of countermeasure against cyber threats may, for example, collect a target connectivity index, a target urgency index, and a target exposure index to calculate a priority score for each asset to be counteracted against a threat. Here, the priority score calculation method for each asset subject to threat response is not limited to this, and in addition to collection, average calculation and

The cyber threat counterpriority calculation device 100 can calculate threat response priority information according to the target connectivity index, target criticality index, and target exposure index for each asset capable of responding to threats in real time, and calculates Priority information may be notified to the user.

Various embodiments of the present document are software (eg, machine-readable storage media) (eg, memory (internal memory or external memory)) including instructions stored in a storage medium readable by a machine (eg, a computer). : program). A device is a device capable of calling a stored command from a storage medium and operating according to the called command, and may include an electronic device (eg, a device) according to the disclosed embodiments.

When the command is executed by a processor (eg, a processor), the processor may directly or use other components under the control of the processor to perform a function corresponding to the command. An instruction may include code generated or executed by a compiler or interpreter. The device-readable storage medium may be provided in the form of a non-transitory storage medium. Here, 'non-temporary' only means that the storage medium does not contain a signal and is tangible, but does not distinguish whether data is stored semi-permanently or temporarily in the storage medium.

According to one embodiment, the method according to various embodiments disclosed in this document may be provided by being included in a computer program product.

The above description is merely an example of the technical idea of the present invention, and various modifications and variations can be made to those skilled in the art without departing from the essential qualities of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical spirit of the present invention, but to explain, and the scope of the technical spirit of the present invention is not limited by these embodiments. The protection scope of the present invention should be interpreted according to the claims below, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

100: Priority calculator for cyber threat response
110: information collection unit
130: classification unit
150: input/output unit
170: database unit
190: priority calculation unit

Claims (18)

an information collection unit that collects and pre-processes cyber asset information on cyber assets;
a classification unit that classifies the cyber asset information by asset;
a database unit for storing and managing the classified cyber asset information; and
A priority calculation unit that calculates a target connectivity index and a target urgency index of the cyber asset information, and calculates a priority score for responding to threats for each cyber asset based on the calculated target connectivity index and target urgency index. include,
The database unit,
a target connection diagram DB for quantifying and storing information on network connectivity between an asset corresponding to the cyber asset information transmitted from the classification unit and other assets; and
A target criticality DB for quantifying and storing the relationship and impact of the mission supported by the asset with the asset;
The target criticality DB manages the target criticality by grade based on the evaluation of the value of the cyber asset information, and calculates the priority of the target to respond to cyber threats, characterized in that it stores the target criticality index according to the grade. Device. According to claim 1,
The cyber threat response target priority calculation device further comprising an input/output unit inputting information on cyber assets for calculating the threat response target priority score or outputting the calculated threat response target priority information. According to claim 1,
The information collection unit,
The cyber threat response target priority calculation device, characterized in that for collecting at least one of vulnerability information, network information, and application information on the cyber asset as the cyber asset information. According to claim 1,
The classification unit,
A cyber threat response target priority calculation device, characterized in that for classifying the cyber asset information by hardware, software and network. delete According to claim 1,
The priority calculator,
Counteracting cyber threats characterized in that the target connectivity index is calculated by quantifying a connectivity level of the cyber asset in relation to at least one of the number and strength of connectivity with other assets on a network connected to the cyber asset. Target Priority Calculator. According to claim 1,
The priority calculator,
The target connectivity index

(here,

is the target connectivity value of host i,

is the shortest path from host j to host k,

is the number of shortest paths between all two hosts in the network topology,

means the number of shortest paths including a random host (i) among the number of shortest paths between all two hosts on the network topology). According to claim 1,
The priority calculator,
Comprehensively quantifying the value evaluation score for the mission supported by the cyber asset, the contribution to the mission, and the degree of impact on the mission when the service of the cyber asset is interrupted to calculate the target urgency index Priority calculation device for countermeasures against cyber threats. According to claim 1,
The target urgency index is

(here,

is the target importance value of host i, x is the asset importance value of host i, and MIN(minimum value)

An apparatus for calculating the priority of a cyber threat response target, characterized in that for calculating through MAX (maximum value)). According to claim 2,
The input/output unit,
A cyber threat response target priority calculation device, characterized in that for receiving at least one of data, commands, setting values, and variables from a user, or outputting a threat response target priority analysis result calculated from the priority calculator. Collecting and pre-processing cyber asset information about cyber assets;
classifying the pre-processed cyber asset information by asset;
Calculating a target connectivity index and a target urgency index of the classified cyber assets; and
Calculating a threat response target priority score based on the calculated target connectivity index and target urgency index;
In the step of calculating the target connectivity index and target urgency index of the cyber asset,
quantifying a target criticality generated based on the evaluation of the value of the cyber asset information;
Storing the digitized target urgency according to ranks; and
and storing the target criticality index according to the rank. According to claim 11,
inputting information for calculating the threat response target priority score; and
The method of calculating the priority of the cyber threat response target, further comprising at least one step of outputting the calculated priority score of the target response target to the threat. According to claim 11,
The step of calculating the target connectivity index,
The cyber threat characterized by calculating the target connectivity index by quantifying the connectivity level of the cyber asset in relation to at least one of the number and strength of connectivity with other cyber assets on a network connected to the cyber asset. Method of calculating response target priority. According to claim 11,
The step of calculating the target connectivity index,

(here,

is the target connectivity value of host i,

is the shortest path from host j to host k,

is the number of shortest paths between all two hosts in the network topology,

means the number of shortest paths including a random host (i) among the number of shortest paths between all two hosts on the network topology). According to claim 11,
In the step of calculating the target urgency index,
Cyber threat response characterized in that the target criticality index is calculated by comprehensively quantifying the value evaluation score of the mission supported by the asset, the contribution to the mission, and the impact on the mission when the service of the asset is stopped Target priority calculation method. According to claim 11,
In the step of calculating the target urgency index,

(here,

is the target importance value of host i, x is the asset importance value of host i, and MIN(minimum value)

A method for calculating the priority of cyber threat countermeasures, characterized in that it is calculated through MAX (maximum value)). A computer-readable recording medium storing a computer program,
When the computer program is executed by a processor,
Collecting and pre-processing cyber asset information about cyber assets;
classifying the pre-processed cyber asset information by asset;
Calculating a target connectivity index and a target urgency index of the classified cyber assets; and
Calculating a threat response target priority score for each cyber asset based on the calculated target connectivity index and target urgency index;
In the step of calculating the target connectivity index and target urgency index of the cyber asset,
quantifying a target criticality generated based on the evaluation of the value of the cyber asset information;
Storing the digitized target urgency according to ranks; and
Including instructions for causing the processor to perform a method including; storing the target urgency index according to the rank
A computer-readable recording medium. As a computer program stored on a computer-readable recording medium,
When the computer program is executed by a processor,
Collecting and pre-processing cyber asset information about cyber assets;
classifying the pre-processed cyber asset information by asset;
Calculating a target connectivity index and a target urgency index of the classified cyber assets; and
Calculating a threat response target priority score for each cyber asset based on the calculated target connectivity index and target urgency index;
In the step of calculating the target connectivity index and target urgency index of the cyber asset,
quantifying a target criticality generated based on the evaluation of the value of the cyber asset information;
Storing the digitized target urgency according to ranks; and
Including instructions for causing the processor to perform a method including; storing the target urgency index according to the rank
A computer program stored on a recording medium.

Images