KR102592624B1 - Threat hunting system and method for against social issue-based advanced persistent threat using artificial intelligence - Google Patents

Abstract

The present invention relates to a threat hunting system and method using artificial intelligence techniques to respond to social issue-type cyber targeted attacks. The present invention relates to a threat hunting system and method using artificial intelligence techniques to respond to social issue-type cyber targeted attacks, by performing simulations according to a virtual social issue-type cyber targeted attack scenario and analyzing the performance results. It is about technology that can eliminate threats caused by cyber-targeted attacks in the form of social issues in advance.

Description

Threat hunting system and method for against social issue-based advanced persistent threat using artificial intelligence}

The present invention relates to a threat hunting system and method using artificial intelligence techniques to respond to social issue-type cyber targeted attacks, and more specifically, to generate a virtual social issue-type cyber targeted attack scenario using artificial intelligence techniques. , It is about a threat hunting system and method using artificial intelligence techniques to respond to social issue-type cyber targeting attacks that can perform threat hunting for social issue-type cyber targeting attacks that may occur through simulation.

Cyber targeted attacks are a set of stealthy and persistent computer hacking processes, carried out by a person or persons targeting a specific entity, usually an individual, organization, country, business, or political organization (their operating server/operating system). targets.

These cyber-targeted attacks require a considerable degree of stealth over a long period of time, using malicious software to attack vulnerabilities within the targeted operating server (or operating system, etc.), and continuously deploy from the outside to create such malicious software. This monitors and extracts data on targeted targets.

Among these cyber targeted attacks, cyber targeted attacks based on social issues (SAPT, Social issue-based Advanced Persistent Threat) target social/economic issues (summit, Olympics, virtual currency, etc.) and attack techniques (individual, institutions, etc.), and the attack technique can be analyzed in relation to social issues, so this is called a social issue-type cyber targeted attack.

These social issue-type cyber targeted attacks usually cause a lot of damage to society by attempting cyber attacks simultaneously or sequentially against multiple attack targets.

Conventional cyber targeted attacks are judged to be a threat at the national level, and investment is increasing accordingly. However, in the case of social issue-type cyber targeted attacks, responses must be made from multiple agencies (targets of attack) rather than a single agency. Therefore, there are clear limitations to each security solution or security framework.

In other words, security techniques are applied individually on each server, so when a social issue-type cyber target attack occurs simultaneously and in a chain, it is not recognized as a single attack pattern and individual cyber target attacks are carried out. There is a problem in that the detection of the first social issue-type cyber target attack that occurs is delayed and the response to cyber attacks against multiple attack targets is delayed by making individual responses based on judgment only.

Therefore, these social issue-type cyber targeted attacks are responded to through technology that quickly recognizes and detects threats when the same or similar attack pattern occurs based on the attack technique that occurred. This is limited to quickly detecting known attacks, but technology is required to detect vulnerable areas in advance and defend against attacks by supplementing them.

Konkuk University Master's Thesis: Research on Rick Hash-based malware analysis for detecting cyber-targeted attacks based on social issues (August 2021)

The present invention was created to solve the problems of the prior art as described above. The purpose of the present invention is to preemptively respond to social issue-type cyber targeted attacks by using artificial intelligence algorithms to create virtual social issue-type attacks. A threat hunting system using artificial intelligence techniques to respond to social issue-type cyber-targeted attacks that can generate cyber-targeted attack scenarios and detect threats caused by social-issue-type cyber-targeted attacks that may occur through simulations, and That method is provided.

In the threat hunting system using artificial intelligence techniques to respond to social issue-type cyber targeted attacks according to an embodiment of the present invention, a past data collection unit 100 that collects data related to social issue-type cyber targeted attacks that occurred in the past; A learning processing unit 200 that performs learning processing on the data collected by the past data collection unit 100 using an artificial intelligence algorithm, and a new data collection unit 300 that collects keyword data generated in real time over a predetermined period of time. , an attack generation unit 400 that generates a virtual social issue-type cyber target attack scenario by applying the collected data of the new data collection unit 300 to the learning model by the learning processing unit 200, the attack generation unit Using the hypothetical social issue-type cyber target attack scenario of (400), an attack simulation is performed on the operating system of an organization that wants to respond to social issue-type cyber target attacks by applying a threat hunting system using artificial intelligence techniques. An execution unit 500, a result processing unit 600 that collects and analyzes related data generated by an attack simulation of the attack execution unit 500 from the operating system, and an analysis result by the result processing unit 600 is used. Therefore, it is desirable to include a threat management unit 700 that performs threat hunting for social issue-type cyber targeting attacks.

Furthermore, the past data collection unit 100 includes an attack collection unit 110 that collects data related to a large number of cyber-targeted attacks that occurred in the past, and keyword data that appears over a predetermined period of time based on the time when each cyber-targeted attack occurred in the past. It includes a keyword collection unit 120 that collects and a social issue collection unit 130 that analyzes the data collected by the keyword collection unit 120, performs grouping through correlation analysis between keyword data, and derives social issue data. It is desirable to do so.

Furthermore, the learning processor 200 performs adversarial iterative learning using Generative Adversarial Networks (GAN), and the attack generator 400 stores the new data in a learning model through adversarial iterative learning. It is desirable to input the collected data of the collection unit 300 to create a virtual social issue-type cyber target attack scenario.

Furthermore, the result processing unit 600 includes a result collection unit 610 that collects related data generated by the attack simulation of the attack execution unit 500 from the operating system and the collection of the result collection unit 610. It is desirable to include a result detection unit 620 that analyzes the data and generates threat hunting data due to a virtual social issue-type cyber target attack.

Furthermore, the threat management unit 700 uses the threat hunting data of the result detection unit 620 to defend against social issue-type cyber targeted attacks or to generate information that can be used to respond when social issue-type cyber targeted attacks occur. It is desirable to perform management of the operating system based on the generated information.

Artificial intelligence to respond to social issue-type cyber targeted attacks, where each step is performed by a threat hunting system using artificial intelligence techniques to respond to social issue-type cyber targeted attacks implemented by a computer according to another embodiment of the present invention. In a threat hunting method using an intelligence technique, an attack data collection step (S100) in which a past data collection unit collects data related to a number of cyber target attacks that occurred in the past, and a past data collection unit, the attack data collection step (S100) Keyword data collection step (S200) of collecting keyword data that appeared over a predetermined period of time based on the time when each cyber target attack occurred. The keyword data collected by the past data collection unit through the keyword data collection step (S200) A social issue data collection step (S300) in which social issue data is derived by analyzing and grouping through correlation analysis between keyword data; a learning processing unit using an artificial intelligence algorithm to collect the attack data (S100); A learning processing step (S400) that inputs data from the social issue data collection step (S300) as learning data and performs learning processing, and in the new data collection unit, new data that collects keyword data generated in real time over a predetermined period of time. In the collection step (S500), the attack generation unit applies the keyword data from the new data collection step (S500) to the learning model from the learning processing step (S400) to create a virtual social issue-type cyber target attack scenario. An attack scenario creation step (S600), an attack execution step (S700) in which an attack execution unit performs an attack simulation using the hypothetical social issue-type cyber target attack scenario in the attack scenario creation step (S600), In the result processing unit, related data generated by the attack execution step (S700) is collected, and the collected data is analyzed to generate threat hunting data caused by a virtual social issue-type cyber target attack. A result analysis step (S800) and threat In the management department, it is desirable to include a threat management step (S900) in which threat hunting for social issue-type cyber target attacks is performed using the analysis results of the result analysis step (S800).

Furthermore, the learning processing step (S400) preferably outputs a learning model through adversarial iterative learning using Generative Adversarial Networks (GAN).

Furthermore, the threat management step (S900) can use the threat hunting data from the result analysis step (S800) to prevent the occurrence of a social issue-type cyber targeted attack or to respond when a social issue-type cyber targeted attack occurs. It is desirable to generate existing information and perform management based on the generated information.

The threat hunting system and method using artificial intelligence techniques to respond to social issue-type cyber targeted attacks of the present invention with the above configuration inevitably have inherent vulnerabilities to specific social issues, which are highly likely to occur. In order to preemptively respond to social issue-type cyber-targeted attacks that may occur on servers/systems/processes, etc. (institutions, companies, individuals, etc.) that are subject to cyber-targeted attacks, a virtual social-issue-type cyber-targeted attack is randomly generated. There is an advantage in that threat hunting can be performed using the data generated accordingly.

At this time, in a scenario to generate a virtual social issue cyber target attack, a virtual cyber attack execution scenario is created using Generative Adversarial Networks (GAN), thereby creating a virtual but actual cyber attack pattern. Not only can it create a scenario with a high degree of similarity, but it also has the advantage of allowing anyone to perform threat hunting using the newly created attack scenario without relying on the capabilities of the threat hunter.

Accordingly, the threat hunting system and method using artificial intelligence techniques for responding to social issue-type cyber targeted attacks according to an embodiment of the present invention do not utilize cyber targeted attack scenarios generated according to the capabilities of the threat hunter. By using an adversarial generation neural network to create a virtual social issue-type cyber target attack scenario similar to an actual social issue-type cyber target attack and performing threat hunting through it, the attack vulnerabilities of social issue-type cyber targeted attacks that may occur are identified. There is an advantage in being able to carry out preemptive response.

Threat hunting system and method using artificial intelligence techniques to respond to social issue-type cyber targeted attacks
Figure 1 is an exemplary configuration diagram showing a monitoring system using a vibration signal domain transformation adversarial generative neural network according to an embodiment of the present invention.
Figure 2 is a sequence diagram showing a monitoring method using a vibration signal domain transformation adversarial generative neural network according to an embodiment of the present invention.

Hereinafter, with reference to the attached drawings, the threat hunting system and method using artificial intelligence techniques for responding to social issue-type cyber targeted attacks of the present invention will be described in detail. The drawings introduced below are provided as examples so that the idea of the present invention can be sufficiently conveyed to those skilled in the art. Accordingly, the present invention is not limited to the drawings presented below and may be embodied in other forms. Additionally, like reference numerals refer to like elements throughout the specification.

At this time, if there is no other definition in the technical and scientific terms used, they have the meaning commonly understood by those skilled in the art to which this invention pertains, and the gist of the present invention is summarized in the following description and attached drawings. Descriptions of known functions and configurations that may be unnecessarily obscure are omitted.

In addition, a system refers to a set of components including devices, mechanisms, and means that are organized and interact regularly to perform necessary functions.

Recently, ‘threat hunting’ technology has been on the rise.

Threat hunting is the process of finding hidden threats without knowing what threats exist. While investigating the environment and processes, suspicious or actual hidden threats are found, and as a result, action is taken or a policy or policy for threat detection is established. It serves to provide clues to generate algorithms.

In other words, it detects threats (or attackers) by exploring the network (or system) of an organization or internal system, and there is a clear difference from a security solution that blocks malicious traffic at the boundary between external and internal systems.

Through this, threat hunting does not block attack patterns when they occur by applying and updating detection rules for known attack patterns, but continuously detects internal threats by actively searching for threats that bypass existing security solutions and performing it repeatedly. It means the process of removing it.

The threat hunting system and method using artificial intelligence techniques for responding to social issue-type cyber targeted attacks according to an embodiment of the present invention inevitably have inherent vulnerabilities to specific social issues and are highly likely to occur. In order to preemptively respond to social issue-type cyber-targeted attacks that may occur on servers/systems/processes, etc. (institutions, companies, individuals, etc.) that are subject to cyber-targeted attacks, a virtual social-issue-type cyber-targeted attack is randomly generated. It is about a technology that can perform threat hunting using the data generated accordingly.

Figure 1 is an exemplary configuration diagram showing a threat hunting system using artificial intelligence techniques for responding to social issue-type cyber targeted attacks according to an embodiment of the present invention. Referring to Figure 1, according to an embodiment of the present invention. A threat hunting system using artificial intelligence techniques to respond to social issue-type cyber targeted attacks is explained in detail.

As shown in FIG. 1, the threat hunting system using artificial intelligence techniques to respond to social issue-type cyber targeted attacks according to an embodiment of the present invention includes a past data collection unit 100, a learning processing unit 200, and a new It is preferably configured to include a data collection unit 300, an attack generation unit 400, an attack execution unit 500, a result processing unit 600, and a threat management unit 700. In addition, each component includes at least a computer. It is preferable to perform the operation by being individually or integratedly included in one or more calculation processing means.

The general threat hunting process is to first create an attack scenario using malicious actions that can occur in the internal system environment (for example, performing remote commands using a server, backdoor communication, and data leakage), and then The attacker's tactics, techniques, and methods (connected data analysis, visualization, statistical analysis, machine learning, etc.) are used to analyze data (logs, connection data, network payload, etc.) generated by applying them to the internal system. TTPs, Tactics, Techniques, Procedures) are collected. Through this, if an attacker's new TTPs are discovered, they must be recorded and shared with the organization performing threat hunting, and the attack must be prevented in advance by tracking and managing it. Finally, an automated system will be built to continuously repeat existing scenarios so that you can focus on creating new threat hunting scenarios.

In this existing threat hunting, threat hunters (administrators, users, etc.) establish a cyber attack performance scenario based on their capabilities (security-related knowledge, latest threat-related data, etc.) and apply it to the internal system. This is a way to eliminate the threat that comes with it. However, as with most cyber security threats, even if new technologies are developed, they are always just chasing after a group of attackers. No matter how much a cyber attack scenario is established, it is based on information that is already known, so a cyber attack that has not yet occurred. It is virtually impossible to respond to performance.

Therefore, according to an embodiment of the present invention, a threat hunting system and method using artificial intelligence techniques for responding to social issue-type cyber targeted attacks according to an embodiment of the present invention are developed using an adversarial generative neural network (GAN). By creating a virtual cyber attack scenario using (Networks), not only can a scenario that is virtual but highly similar to an actual cyber attack pattern be created, but also a newly created attack can be created by anyone without relying on the capabilities of the threat hunter. Threat hunting can be performed using scenarios.

Through this, data generated through simulation of attack scenarios is analyzed to create security measures for the paths and starting points where cyber-targeted attacks contained in the internal system can occur, and to pre-develop attack techniques that may occur through these. We can suggest a way to remove it.

Let's take a closer look at each configuration of the threat hunting system using artificial intelligence techniques to respond to social issue-type cyber targeted attacks according to an embodiment of the present invention,

It is desirable that the past data collection unit 100 collects data related to social issue-type cyber targeted attacks that occurred in the past. At this time, the past data collection unit 100 is an operation server (or operation server) of an organization (individual, company, institution, etc.) that wants to apply a threat hunting system using artificial intelligence techniques to respond to social issue-type cyber targeted attacks. Security-related operational data from social issue-type cyber-targeted attacks that occurred in the past is received from the system and collected.

Here, the operation server of an organization that wants to apply a threat hunting system using artificial intelligence techniques to respond to the social issue-type cyber target attack is concerned about the occurrence of a cyber target attack, even if it is not necessarily a social issue-type cyber target attack. This refers to an operating server that intends to take proactive measures through .

To this end, the past data collection unit 100 is configured to include an attack collection unit 110, a keyword collection unit 120, and a social issue collection unit 130, as shown in FIG. 1.

It is desirable that the attack collection unit 110 collects data related to numerous cyber-targeted attacks that have occurred in the past. Specifically, we identify the types of cyber-targeted attacks that have occurred in the past and collect data related to cyber-targeted attacks, including information on the target organization at the time of occurrence, detailed type information of the attack, attacker information, attack code information, and attack code type information. It is desirable to do so.

That is, the attack collection unit 110 collects the attack strategies and techniques of the attacker group for cyber-targeted attacks that occurred in the past. It is desirable to collect attack techniques used in most cyber-targeted attacks that have occurred to date, and attack.mitre.org lists 14 types of cyber-targeted attack strategies and over 500 cyber-attack techniques, and is categorized by attacker group. It is also possible to collect attack techniques used when carrying out targeted cyber attacks.

The keyword collection unit 120 collects keyword data that appears over a predetermined period of time based on the time when each cyber target attack occurred in the past.

In detail, it is preferable that the keyword collection unit 120 collects data related to social issues for a predetermined period of time based on the time when a number of past cyber-targeted attacks collected through the attack collection unit 110 occurred. do. For example, if data related to cyber-targeted attacks A and B that occurred in the past were collected through the attack collection unit 110, the keyword collection unit 700 collects data for a predetermined period of time based on the time when the past cyber-targeted attack A occurred. Keyword data from before to after a certain period of time and keyword data from before to after a certain period of time are collected based on the time when the past B cyber target attack occurred. At this time, it is preferable to collect the keyword data by crawling various web document data (web page data, SNS, etc.) of sites subject to analysis. In other words, various keywords that exist in a set period (predetermined period) are collected using news sites and SNS that exist on the web. Since social issues can be searched in the news section of portal sites or SNS of various broadcasting companies, it is desirable to use this to extract keywords used in social issues.

Social issues can be inferred by looking at the articles being published by these media outlets. However, when collecting articles published (generated, created, uploaded, etc.) by media companies and extracting key keywords for them, for example, if it is analyzed that the keyword 'government' appears frequently through analysis of media articles, simply using only the relevant keywords Since it is difficult to infer the situation before and after, it cannot be derived as a social issue keyword.

In addition, even if this is determined to be a social issue, it is almost impossible to interpret the social situation later.

Therefore, it is preferable that the social issue collection unit 130 analyzes the data collected by the keyword collection unit 120, performs grouping through correlation analysis between keyword data, and derives the social issue data.

In detail, it is desirable to collect articles that are being published as issues by media companies, analyze the collected articles, extract related keywords based on the discovered keywords, group them into one group, and derive them as social issues. Through this, it is possible to clearly organize and confirm data on social issues that occurred during a specific period, as well as the reasons and progress of the social issues.

In other words, it is desirable that the social issue collection unit 130 uses the data collected by the keyword collection unit 120 to analyze the correlation between keywords for the relevant period to derive social issues. For correlation analysis, it is desirable to group keywords (politics, economy, society, culture, etc.) first, and perform frequency analysis and word combinations between keywords within the group to collect data on social issues (Olympics, hearings, trade sanctions, etc.). can be derived.

Accordingly, it is preferable that the social issue data is not simply a single word but a set of keywords that have become an issue during a specific period of time, that is, a set of related keywords.

The learning processing unit 200 uses a pre-stored artificial intelligence algorithm to collect data collected from the past data collection unit 100, that is, collected data from the attack collection unit 110, and the social issue collection unit 130. It is desirable to perform learning processing on the derived data. In detail, the learning processing unit 200 formalizes the collected cyber target attack strategies and techniques and derived social issue data so that they can be used for artificial intelligence learning, and applies the standardized learning data to a pre-stored artificial intelligence algorithm. By entering it, you will receive a learning result model.

Here, data normalization means digitizing various data such as characters, character translations, and integer types to input values into artificial intelligence learning.

In addition, the learning processing unit 200 preferably performs adversarial iterative learning using a generative adversarial network (GAN) with a pre-stored artificial intelligence algorithm and outputs the learning result model (learning model).

An adversarial generative neural network consists of a generator and a discriminator implemented as a convolutional neural network. The generator generates virtual data that is most similar to reality, and the discriminator distinguishes between real data and virtual data. The generator performs iterative learning to generate virtual data that is most similar to reality, and the discriminator also performs iterative learning to more accurately distinguish between real data and virtual data. In other words, the generator and discriminator repeatedly perform adversarial learning, and a learning model is output.

Through this, the learning processing unit 200 outputs the learning model by learning and processing the collected cyber target attack strategies and techniques and derived social issue data, and the learning model is a cyber target attack scenario that did not actually occur. However, the created virtual cyber target attack scenario is almost similar in strategy and technique to the actual cyber target attack.

The new data collection unit 300 preferably collects keyword data generated over a predetermined period of time in real time.

In detail, the new data collection unit 300 collects various keywords by crawling various web document data of analysis target sites. At this time, the new data collection unit 300 does not derive real-time social issue data, but collects real-time keyword data and utilizes the possibility that the keyword may be extended to social issue data and become the starting point of a cyber target attack. do.

The attack generation unit 400 inputs the data collected by the new data collection unit 300 into the learning model (learning result model) by the learning processing unit 200 to create a hypothetical social issue-type cyber target attack scenario. It is desirable to create

At this time, the hypothetical social issue-type cyber target attack scenario output through the learning model is a virtual social issue-type cyber target attack, but it is a virtual social issue-type cyber target attack based on the characteristics of an adversarial generative neural network and through adversarial iterative learning between the generator and discriminator. It is desirable that it is a scenario that can cause a similar social issue-type cyber target attack.

That is, the attack generation unit 400 is configured to generate an attack scenario to perform threat hunting, and is a virtual social issue-type cyber target attack based on keyword data collected by the new data collection unit 300. A scenario is created.

The attack execution unit 500 preferably performs an attack simulation on the organization's operating server (operating system, etc.) using a virtual social issue-type cyber target attack scenario generated by the attack generating unit 400. In other words, the attack execution unit 500 performs a cyber-targeted attack on the internal system in accordance with the hypothetical social issue-type cyber target attack scenario created by the attack generation unit 400, and threat hunting is an attack on the internal system. Since it is a process of analyzing information generated while performing, attack simulation through the attack execution unit 500 is essential.

The result processing unit 600 collects related data generated after an attack simulation according to a hypothetical social issue-type cyber target attack scenario by the attack execution unit 500 is performed from the organization's operating server (operating system, etc.). It is desirable to collect and analyze it.

In detail, the result processing unit 600 is comprised of a result collection unit 610 and a result detection unit 620, as shown in FIG. 1.

To put it briefly, the result collection unit 610 collects data generated as a virtual social issue-type cyber target attack progresses. For example, various information such as operating system logs, network information, file viewing records, and executable program lists that occur as a virtual social issue-type cyber target attack progresses from the organization's operating server (operating system, etc.) is collected, stored, and managed. I do it. It is desirable to include a separate database means for this.

The result detection unit 620 analyzes the collected data of the result collection unit 610 (for example, operating system logs, network information, file viewing records, executable program lists, etc.) to identify virtual social issue-type cyber targets. It is desirable to generate threat hunting data from attacks.

In detail, the result detection unit 620 uses various analysis techniques to collect data from the result collection unit 610, that is, statistical analysis, attacker behavior event analysis, network information analysis, operating system log analysis, and time series analysis. By performing analysis, etc., the attacker's tactics, techniques, and methods (TTPs, Tactics, Techniques, and Procedures), which are threat hunting data, are generated.

The threat management unit 700 uses the analysis results of the result processing unit 600 to perform threat hunting for social issue-type cyber targeted attacks.

In detail, the threat management unit 700 uses the threat hunting data from the result detection unit 620 to prevent the occurrence of a social issue-type cyber targeted attack, or when a social issue-type cyber targeted attack occurs. It is desirable to generate information that can be responded to quickly and perform threat management of the organization's operating server (operating system, etc.) based on the generated information.

Of course, the threat management unit 700 manages a new social issue-type cyber target attack scenario, which is a virtual social issue-type cyber target attack scenario generated by the attack generation unit 400, manages the learning result model, and manages the result detection unit. Threat hunting data is managed by (620) and the analysis results are managed accordingly.

The threat management unit 700 not only visualizes and displays the threat hunting data generated by the result detection unit 620, but also analyzes the degree of damage and damage path caused by a hypothetical social issue-type cyber target attack scenario, It can provide preparations for the starting point path, attack technique, etc. In addition, it is not only possible to detect social issue-type cyber targeted attacks that have occurred in the past, but has already learned about attacks through hypothetical social issue-type cyber target attack scenarios that have not occurred yet, so if an actual attack occurs, can respond quickly.

Figure 2 is a flow diagram showing a threat hunting method using artificial intelligence techniques to respond to social issue-type cyber targeted attacks according to an embodiment of the present invention. With reference to FIG. 2, a threat hunting method using an artificial intelligence technique for responding to a social issue-type cyber target attack according to an embodiment of the present invention will be described in detail.

As shown in FIG. 2, the threat hunting method using artificial intelligence techniques to respond to social issue-type cyber targeted attacks according to an embodiment of the present invention includes an attack data collection step (S100), a keyword data collection step (S200), Social issue data collection step (S300), learning processing step (S400), new data collection step (S500), attack scenario creation step (S600), attack execution step (S700), result analysis step (S800), and threat management step ( It is preferable that it is configured to include S900). In addition, each step is performed by a threat hunting system using artificial intelligence techniques to respond to computer-implemented social issue-type cyber targeting attacks.

To learn more about each step,

In the attack data collection step (S100), the past data collection unit 100 collects data related to social issue-type cyber targeted attacks that occurred in the past. At this time, social issue-type cyber attacks that occurred in the past from the operation server (or operating system) of an organization (individual, company, institution, etc.) that wants to apply a threat hunting system using artificial intelligence techniques to respond to social issue-type cyber targeted attacks. Security-related operational data from targeted attacks is input and collected.

Here, the operation server of an organization that wants to apply a threat hunting system using artificial intelligence techniques to respond to the social issue-type cyber target attack is concerned about the occurrence of a cyber target attack, even if it is not necessarily a social issue-type cyber target attack. This refers to an operating server that intends to take proactive measures through .

Through this, the attack data collection step (S100) includes data related to a large number of cyber-targeted attacks that have occurred in the past, that is, by identifying the types of cyber-targeted attacks that have occurred in the past, information on the target organization at the time of occurrence, detailed type information of the attack, Data related to cyber targeted attacks, including attacker information, attack code information, and attack code type information, is collected.

Through this, the attack data collection step (S100) collects the attack strategies and techniques of the attacker group for cyber-targeted attacks that occurred in the past. It is desirable to collect attack techniques used in most cyber-targeted attacks that have occurred to date, and attack.mitre.org lists 14 types of cyber-targeted attack strategies and over 500 cyber-attack techniques, and is categorized by attacker group. It is also possible to collect attack techniques used when carrying out targeted cyber attacks.

The keyword data collection step (S200) is performed in the past data collection unit 100, based on the time when a number of cyber-targeted attacks that occurred in the past by the attack data collection step (S100) occurred, related to social issues for a predetermined period of time. data is collected.

At this time, the keyword data is collected by crawling various web document data (web page data, SNS, etc.) of sites subject to analysis, and is collected for a period (period) set using news sites and SNS existing on the web. Various keywords that exist over a certain period of time are collected. Since social issues can be searched in the news section of portal sites or SNS of various broadcasting companies, keywords used in social issues can be extracted using this.

Social issues can be inferred by looking at the articles being published by these media outlets. However, when collecting articles published (generated, created, uploaded, etc.) by media companies and extracting key keywords for them, for example, if it is analyzed that the keyword 'government' appears frequently through analysis of media articles, simply using only the relevant keywords Since it is difficult to infer the situation before and after, it cannot be derived as a social issue keyword.

In addition, even if this is determined to be a social issue, it is almost impossible to interpret the social situation later.

Therefore, it is desirable to derive social issue data through the social issue data collection step (S300).

The social issue data collection step (S300) analyzes the data collected by the keyword data collection step (S200) in the past data collection unit 100, performs grouping through correlation analysis between keyword data, and performs grouping of the social issue data. Issue data is derived.

In detail, it is desirable to collect articles that are being published as issues by media companies, analyze the collected articles, extract related keywords based on the discovered keywords, group them into one group, and derive them as social issues. Through this, it is possible to clearly organize and confirm data on social issues that occurred during a specific period, as well as the reasons and progress of the social issues.

In other words, the social issue data collection step (S300) utilizes the data collected in the keyword data collection step (S200) to analyze the relationship between keywords in the relevant period to derive social issues, and for correlation analysis, keyword grouping ( Politics, economy, society, culture, etc.) is preferably preceded, and the social issue data (Olympics, hearings, trade sanctions, etc.) can be derived by performing frequency analysis and word combinations among keywords within the group.

Accordingly, it is preferable that the social issue data is not simply a single word but a set of keywords that have become an issue during a specific period of time, that is, a set of related keywords.

In the learning processing step (S400), the learning processing unit 200 uses an artificial intelligence algorithm to input the data from the attack data collection step (S100) and the social issue data collection step (S300) as learning data, Learning processing is performed.

The learning processing step (S400) formalizes the collected cyber target attack strategies and techniques and derived social issue data so that they can be used for artificial intelligence learning, and inputs the standardized learning data into a pre-stored artificial intelligence algorithm, The learning result model is output.

Here, data normalization means digitizing various data such as characters, character translations, and integer types to input values into artificial intelligence learning.

Adversarial iterative learning is performed using a pre-stored artificial intelligence algorithm using Generative Adversarial Networks (GAN), and the learning result model (learning model) is output.

An adversarial generative neural network consists of a generator and a discriminator implemented as a convolutional neural network. The generator generates virtual data that is most similar to reality, and the discriminator distinguishes between real data and virtual data. The generator performs iterative learning to generate virtual data that is most similar to reality, and the discriminator also performs iterative learning to more accurately distinguish between real data and virtual data. In other words, the generator and discriminator repeatedly perform adversarial learning, and a learning model is output.

Through this, the learning processing step (S400) outputs the learning model by learning and processing the collected cyber target attack strategies and techniques and derived social issue data, and the learning model is a cyber target attack that did not actually occur. Create a scenario, but the created virtual cyber target attack scenario is almost similar in strategy and technique to the actual cyber target attack.

In the new data collection step (S500), the new data collection unit 300 collects keyword data generated over a predetermined period of time in real time. In detail, by performing crawling on various web document data of sites subject to analysis and collecting various keywords, rather than deriving real-time social issue data, real-time keyword data is collected, and the keywords are social issue data. It will be extended to be used to determine if it has the potential to become a starting point for a cyber-targeted attack.

In the attack scenario creation step (S600), the attack generator 400 applies keyword data from the new data collection step (S500) to the learning model from the learning processing step (S400) to create a virtual social issue. This creates a cyber-targeted attack scenario.

At this time, the hypothetical social issue-type cyber target attack scenario output through the learning model is a virtual social issue-type cyber target attack, but it is a virtual social issue-type cyber target attack based on the characteristics of an adversarial generative neural network and through adversarial iterative learning between the generator and discriminator. It is desirable that it is a scenario that can cause a similar social issue-type cyber target attack.

The attack scenario creation step (S600) is a configuration that generates an attack scenario to perform threat hunting, and generates a virtual social issue-type cyber target attack scenario based on the keyword data from the new data collection step (S500). do.

In the attack execution step (S700), the attack execution unit 500 uses the hypothetical social issue-type cyber target attack scenario in the attack scenario generation step (S600) to run the organization's operating server (operating system, etc.). Attack simulation is performed.

In other words, a cyber-targeted attack is performed on an internal system in accordance with a hypothetical social issue-type cyber-targeted attack scenario. Since threat hunting is a process of analyzing information generated while performing an attack on an internal system, attack simulation is essential. do.

In the result analysis step (S800), the result processing unit 600 collects related data generated by the attack execution step (S700) and analyzes the collected data to detect threats caused by virtual social issue-type cyber targeted attacks. data is generated.

In detail, the result analysis step (S800) collects and analyzes related data generated after an attack simulation is performed according to a virtual social issue-type cyber target attack scenario from the organization's operating server (operating system, etc.). do.

In other words, data generated as a virtual social issue-type cyber target attack progresses (various information such as operating system logs, network information, file browsing records, executable program lists, etc.) is collected, stored, and managed, and this is analyzed to create a virtual social issue type. Threat hunting data is generated from targeted cyber attacks.

The result analysis step (S800) uses various analysis techniques, that is, statistical analysis, attacker behavior event analysis, network information analysis, operating system log analysis, time series analysis, etc. to perform threat hunting data, including the attacker's tactics and techniques. , methods (TTPs, Tactics, Techniques, Procedures) are created.

In the threat management step (S900), the threat management unit (700) performs threat hunting for social issue-type cyber targeted attacks using the analysis results of the result analysis step (S800).

The threat management step (S900) uses the threat hunting data that is the analysis result of the result analysis step (S800) to prevent the occurrence of a social issue-type cyber targeted attack, or when a social issue-type cyber targeted attack occurs. Information that can be responded to quickly is generated, and threat management of the organization's operating server (operating system, etc.) is performed based on the generated information.

In detail, it not only visualizes and displays threat hunting data, but also analyzes the degree of damage and damage path caused by a hypothetical social issue-type cyber target attack scenario, providing preparedness measures for the path that becomes the starting point of the attack and attack techniques. can do. In addition, it is not only possible to detect social issue-type cyber targeted attacks that have occurred in the past, but has already learned about attacks through hypothetical social issue-type cyber target attack scenarios that have not occurred yet, so if an actual attack occurs, can respond quickly.

In other words, the threat hunting system and method using artificial intelligence techniques for responding to social issue-type cyber targeted attacks according to an embodiment of the present invention utilize cyber targeted attack scenarios generated according to the capabilities of the threat hunter. Rather, by using an adversarial generative neural network to create a virtual social issue-type cyber target attack scenario similar to an actual social issue-type cyber target attack and performing threat hunting through it, the attack vulnerability of social issue-type cyber target attacks can occur. There is an advantage in being able to take preemptive action against .

As described above, the present invention has been described with reference to specific details such as specific components and drawings of limited embodiments, but this is only provided to facilitate a more general understanding of the present invention, and the present invention is not limited to the above-mentioned embodiment. No, those skilled in the art can make various modifications and variations from this description.

Accordingly, the spirit of the present invention should not be limited to the described embodiments, and all matters that are equivalent or equivalent to the claims of this patent as well as the claims described below shall fall within the scope of the spirit of the present invention. .

100: Past data collection unit
110: Attack collection unit 120: Keyword collection unit
130: Social Issue Collection Department
200: Learning processing unit
300: New data collection unit
400: Attack generator
500: Attack execution unit
600: Result processing unit
610: Result collection unit 620: Result detection unit
700: Threat Management Department

Claims (8)

A past data collection unit (100) that collects data related to social issue-type cyber targeting attacks that occurred in the past;
A learning processing unit 200 that performs learning processing on the data collected by the past data collection unit 100 using an artificial intelligence algorithm;
A new data collection unit 300 that collects keyword data generated over a predetermined period of time in real time;
An attack generation unit 400 that generates a virtual social issue-type cyber target attack scenario by applying the collected data of the new data collection unit 300 to the learning model by the learning processing unit 200;
An operating system for an organization that seeks to respond to a social issue-type cyber target attack by applying a threat hunting system using artificial intelligence techniques using the virtual social issue-type cyber target attack scenario generated by the attack generator 400. an attack execution unit 500 that performs attack simulation;
a result processing unit 600 that collects and analyzes related data generated by an attack simulation of the attack execution unit 500 from the operating system; and
a threat management unit 700 that performs threat hunting for a social issue-type cyber target attack based on the hypothetical social issue-type cyber target attack scenario using the analysis results of the result processing unit 600;
Includes,
The past data collection unit 100
An attack collection unit 110 that collects data related to numerous cyber-targeted attacks that occurred in the past;
a keyword collection unit 120 that collects keyword data that appears over a predetermined period of time based on the time when each cyber target attack occurred in the past; and
a social issue collection unit 130 that analyzes the data collected by the keyword collection unit 120, performs grouping through correlation analysis between keyword data, and derives social issue data;
Including,
The learning processing unit 200
Using Generative Adversarial Networks (GAN), data related to numerous cyber-targeted attacks that occurred in the past collected by the attack collection unit 110 and social issue data derived by the social issue collection unit 130 receives input and performs adversarial iterative learning processing,
The attack generator 400
By inputting keyword data generated over a predetermined period of time in real time by the new data collection unit 300 into the learning model created through the learning processing unit 200, the strategies and techniques are similar to cyber target attacks that have occurred in the past, but have not actually occurred. A threat hunting system using artificial intelligence techniques to respond to social issue-type cyber targeting attacks that generates hypothetical social issue-type cyber target attack scenarios.
delete delete According to clause 1,
The result processing unit 600
a result collection unit 610 that collects related data generated by an attack simulation of the attack execution unit 500 from the operating system; and
a result detection unit 620 that analyzes the data collected by the result collection unit 610 and generates threat hunting data caused by a virtual social issue-type cyber target attack;
A threat hunting system using artificial intelligence techniques to respond to social issue-type cyber targeted attacks, including.
According to clause 4,
The threat management unit 700
Using the threat hunting data of the result detection unit 620, information that can be used to defend against social issue-type cyber targeting attacks or respond to social issue-type cyber targeting attacks is generated, and the operation is performed based on the generated information. A threat hunting system using artificial intelligence techniques to manage the system and respond to social issue-type cyber targeted attacks.
In the threat hunting method using artificial intelligence techniques to respond to social issue-type cyber targeted attacks, where each step is performed by a threat hunting system using artificial intelligence techniques to respond to social issue-type cyber targeted attacks implemented by computers,
An attack data collection step (S100) in which the past data collection unit collects data related to a number of cyber-targeted attacks that occurred in the past;
In the past data collection unit, a keyword data collection step (S200) of collecting keyword data that appears over a predetermined period of time based on the time when each cyber target attack occurred in the attack data collection step (S100);
In the past data collection unit, the keyword data collected in the keyword data collection step (S200) is analyzed, grouping is performed through correlation analysis between keyword data, and social issue data is derived (S300) );
In the learning processing unit, the data from the attack data collection step (S100) and the social issue data collection step (S300) are input as learning data to Generative Adversarial Networks (GAN), and adversarial iterative learning processing is performed, A learning processing step (S400) that generates a learning model;
A new data collection step (S500) in which the new data collection unit collects keyword data generated over a predetermined period of time in real time;
In the attack generation unit, the keyword data from the new data collection step (S500) is applied to the learning model from the learning processing step (S400) to create a virtual target attack that is similar in strategy and technique to a cyber target attack that occurred in the past but did not actually occur. An attack scenario generation step (S600) that generates a social issue-type cyber target attack scenario;
In the attack execution unit, using the virtual social issue-type cyber target attack scenario created in the attack scenario creation step (S600), a threat hunting system using artificial intelligence techniques is applied to respond to social issue-type cyber target attacks. An attack execution step (S700) in which an attack simulation is performed on the operating system of the desired organization;
A result analysis step (S800) in which the result processing unit collects related data generated by the attack execution step (S700), analyzes the collected data, and generates threat hunting data by a virtual social issue-type cyber target attack; and
A threat management step (S900) in which the threat management department uses the analysis results from the result analysis step (S800) to perform threat hunting for a social issue-type cyber target attack based on the hypothetical social issue-type cyber target attack scenario. ;
A threat hunting method using artificial intelligence techniques to respond to social issue-type cyber targeted attacks, including.
delete According to clause 6,
The threat management step (S900) is
Using the threat hunting data from the result analysis step (S800), information that can be used to prevent the occurrence of a social issue-type cyber targeted attack or to respond in the event of a social issue-type cyber targeted attack is generated, based on the generated information. A threat hunting method using artificial intelligence techniques to respond to social issue-type cyber targeted attacks, which is managed with

Images