KR20180115581A - Integrated Dashboard Device and Methods for Military Cyber Penetration Test Training - Google Patents

Abstract

According to the present invention, a mock military cyber penetration test training method in a dashboard device comprises the following steps: a mock penetration testing step of conducting a mock penetration test using a testing tool on a network depending on assigned roles of testers; a test type and information input step of inputting a test type and test information to conduct the test; a test data collection step of collecting individual information collected by the tester in cooperation with the tester; and a collected information normalization step of normalizing collected information according to the content of the test type and test information regarding the collected information. The mock military cyber penetration test training method can be efficient for commanders to control and command in a situation to conduct the mock military cyber penetration to secure safety on defense network and to assess the same.

Description

 {Integrated Dashboard Device and Methods for Military Cyber Penetration Test Training}

The present invention relates to an integrated dashboard apparatus and method for penetration training of a military cyber mock. More particularly, the present invention relates to a method and system for conducting integrated penetration tester in which a commander performs role-divided analysis and training using a plurality of cyber mock penetration testers for analysis of vulnerabilities and cyber infringement potentials in a defense network system having a complex network Integrated dashboard devices and techniques.

Defense network is separated and operated according to each function and organization. So, simulation penetration testing and training on the defense network is also carried out as part of military operations, so the commander must observe and direct the performance of many mock penetration testers. However, most of the cybermethod penetration testing tools show the ability to perform independent penetration testing and the results of simulated penetration testing. Therefore, in the simulated penetration test on the defense network network that should be conducted and conducted as part of the military operation, it is difficult for the commander to conduct the command smoothly using the existing test tool, and it is difficult to grasp the current status of the commander in real time There is a problem.

In addition, the defense mock penetration test and training should be carried out after the operation, and after the operational process and the result analysis, the follow-up operation and the conduct should be evaluated. However, since existing test tools simply support one-time testing, there is a problem in that it does not provide information for evaluation of command control and operational performance required by the military.

Accordingly, an object and object to be solved by the present invention is to provide an integrated dashboard apparatus and method for supporting simulation penetration testing and training on a defense network and supporting command and control of a commander as part of military operations have.

According to another aspect of the present invention, there is provided a method for penetrating a military cyber mock-up in an integrated dashboard apparatus, wherein a testor performs a mock penetration test using a test tool for a network in accordance with role sharing Performing a simulated penetration test; A test type and an information input step of inputting a test type and test information for performing a test; A test data collection step of collecting individual information collected by the tester in cooperation with the tester; And a collection information normalization step of normalizing collected information according to the contents of the test type and the test information with respect to the collected information, wherein in the cyber simulation penetration operational environment of the group for securing and evaluating the safety of the defense network It can be effective in conducting command and control of the commander.

In one embodiment, the acquisition information includes project information corresponding to simulated penetration operations and training identification information; Tester information corresponding to the simulated infiltration operation and training tester information; Network and host information corresponding to connection information of the network and host information present in the target network; Service information corresponding to service information provided by each host; Simulated infiltration design information corresponding to simulated infiltration design and execution information for the network and the host; Occupied host detailed information corresponding to internal information of a host occupied in the network; And vulnerability information for the host obtained through a test on the network.

In one embodiment, a DB storage step of storing information collected by the tester and processed information in a database (DB); And an information analyzing step of analyzing the information stored in the DB to extract information to be watched by the commander.

In one embodiment, the information analysis step may include: a network configuration information processing step of processing subnet-based network configuration information on the network information collected by the tester; A mock penetration design information analysis step of processing mock penetration design configuration information for the host in a specific subnet; Analyzing host information in a subnet and a function of the host; And a filtering information analyzing step of filtering contents to be displayed in the visualization module.

In one embodiment, the collecting information normalization step includes collecting information input step of collecting information inputted by the testers through a data collecting module; Identifying a tester collecting the project and information according to the collected information and assigning a normalization value to the tester; An information-specific eigenvalue assigning step of assigning identification eigenvalues to the collected information; And a normalization step for each collection data item for normalizing the collected information for each item of design type, vulnerability type, and attack technique type.

In one embodiment, the integrated dashboard visualization step further includes visualizing host information, network information, design information performed by the tester, performance information, and organic connection information of each network collected by the tester on the integrated dashboard can do.

According to another aspect of the present invention, there is provided an integrated dashboard apparatus for penetration training of military cyber mockers, comprising: testors for performing a simulated penetration test using a test tool on a network in accordance with role sharing; A user interface for inputting a test type and test information for performing a test; A data collection module for collecting individual information collected by the tester in cooperation with the tester; And a data analysis module for normalizing the collected information according to the contents of the test type and the test information with respect to the collected information.

In one embodiment, the acquisition information collected at the data acquisition module includes project information corresponding to the simulated penetration operation and training identification information; Tester information corresponding to the simulated infiltration operation and training tester information; Network and host information corresponding to connection information of the network and host information present in the target network; Service information corresponding to service information provided by each host; Simulated infiltration design information corresponding to simulated infiltration design and execution information for the network and the host; Occupied host detailed information corresponding to internal information of a host occupied in the network; And vulnerability information for the host obtained through a test on the network.

In one embodiment, a database (DB) configured to store information collected by the tester and processed information; And an information analysis module for analyzing the information stored in the database to extract information to be watched by the commander.

In one embodiment, the information analysis module includes: a network configuration information processing unit for processing subnet-based network configuration information for network information collected by the tester; A simulated penetration design information analysis unit for processing simulated penetration design configuration information for the host in a specific subnet; A node information analyzer for analyzing host information in the subnet and the function of the host; And a filtering information analyzing unit for filtering contents to be displayed in the visualization module.

In one embodiment, the data analysis module collects information input by the tester through a data collection module, identifies the tester that collected the project and information according to the collected information, and assigns a normalization value , An identification eigenvalue is assigned to each of the collected information, and the collected information is normalized for each item of a design type, a vulnerability type, and an attack technique type.

Through the present invention, it is possible to consolidate and monitor the operations and training progress of each tester during the penetration test operation and training of the military cyber mock test on the defense network, so that the commander can conduct the operation and training in an integrated manner.

In addition, through the present invention, it is considered that it is more efficient to perform command and control of the commander in the cyber simulation operation environment of the military for securing and evaluating the safety of the defense network.

FIG. 1 shows a configuration of a core module for configuring an integrated dashboard according to the present invention.
FIG. 2 shows a process flow as to how the information gathered from the testers in the integrated dashboard device proceeds to show the integrated status to the commander.
FIG. 3 illustrates how the military commanders use the integrated dashboard device to perform simulated penetration testing operations.
FIG. 4 shows a visualization technique of integrating the results of each tester on a subnet basis in an integrated dashboard according to the present invention.
FIG. 5 shows a visualization technique of integrating the results of each tester by the host OS distribution in the integrated dashboard of the present invention.
FIG. 6 shows a sequence of a data normalization algorithm according to an embodiment of the present invention.
7 shows a detailed information processing configuration of the information analysis module.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other features and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings, It will be possible. The present invention is capable of various modifications and various forms, and specific embodiments are illustrated in the drawings and described in detail in the text. It is to be understood, however, that the invention is not intended to be limited to the particular forms disclosed, but on the contrary, is intended to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

Like reference numerals are used for similar elements in describing each drawing.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. The term "and / or" includes any combination of a plurality of related listed items or any of a plurality of related listed items.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Should not.

The suffix "module "," block ", and "part" for components used in the following description are given or mixed in consideration of ease of specification only and do not have their own distinct meanings or roles .

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS In the following description of the present invention, detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

Hereinafter, a method and an apparatus for intrusion training of a military cyber simulation in an integrated dashboard apparatus according to the present invention will be described. The present invention relates to an integrated dashboard apparatus and method for controlling and controlling simulation penetration testing and training on a defense network.

In this regard, FIG. 1 shows a configuration of a core module for configuring an integrated dashboard according to the present invention. That is, in order to implement such a technology, the integrated dashboard includes a data collection module 110, a data analysis module 120, a database (DB) storage device 130, an information analysis module 140, a visualization module 150, And an interface 160.

Meanwhile, FIG. 2 shows a process flow as to how the information gathered from the testers in the integrated dashboard apparatus proceeds to show the integrated status to the commander. Meanwhile, FIG. 3 shows how a military commander performs a simulation penetration test operation using an integrated dashboard device. 4 shows a visualization technique of integrating the results of each tester on a subnet basis in an integrated dashboard according to the present invention. FIG. 5 shows a visualization technique of integrating the results of each tester by the host OS distribution in the integrated dashboard of the present invention.

In the above, with reference to FIG. 2, a method for intrusion training of a military cyber simulation in an integrated dashboard apparatus will be described with reference to FIG. 3 to FIG.

(1) Testers perform simulated penetration test using network test tool according to each role sharing. The testers design a method of simulated penetration and perform practical simulated penetration. Designed and collected results for conducting simulation penetration tests are sent to the integrated dashboard. Here, the testers may be configured by software, hardware, or a combination thereof as a module, device or apparatus that performs a test. Thus, the tester may be referred to as a tester module, a tester device, or a tester device.

(2) The data collection module 110 is a part for collecting the individual information collected by the testers in cooperation with the respective testers. Each tester host performs a mock penetration test according to the command of the commander and sends the information to the data collection module 110. The collected data is collected from the tools used by the mock penetration testers and the main collection information is as follows.

Collection Information Explanation Project Information Mock Penetration Operations and Training Identification Information About Testers Mock Penetration Operations and Training Tester Information Network and Host Information Network network connection information and host information in the target network Service Information Service information provided by each host Mock Penetration Design Information Simulation Penetration Design and Implementation Information for Network and Host Occupied Host Details Internal information of the host occupied in the network Vulnerability Information Vulnerability information about the host obtained through testing on the network

Basically, in order to penetrate the mock, information about the network including the target network is collected, and the mock penetration design and performance information performed by the individual tester are collected.

(3) The data analysis module 120 normalizes the collected information according to the type of test and information about the information collected by the data collection module 110, and stores the collected information in the database (DB) 130.

Data normalization identifies and normalizes and stores collected information by project and tester. This should be separated by project and tester for further evaluation and analysis of the test operations performed. The collected information from each tester is subjected to a normalization process to assign unique values and analyze the collected information. Meanwhile, FIG. 6 shows a sequence of a data normalization algorithm according to an embodiment of the present invention.

Collecting information input (S241): The information collected by the plurality of testers is collected through the data collecting module 110. [

Identification of the project / tester (S242): The tester collecting the project and the information according to the collected information is identified and a normalization value is given.

- Assigning eigenvalues for each information (S243): Granting identification eigenvalues (time information, etc.) to each collected information.

- Normalization by collected data (S244): Regularize each item (eg, design type, vulnerability type, attack technique type, etc.) with respect to collected data.

DB storage (S245): stores the normalized information in the database (DB) 130 and receives new information.

(4) The database (DB) 130 stores the information collected by the simulated penetration tester and the processed information. The database (DB) 130 may include time information on the collected information and the processed information so that it can show progress according to the time sequence when analyzing the results of the simulation penetration test in the future.

(5) The information analysis module re-processes the information stored in the database (DB) 130 and extracts the information that the commander wants to see. The commander can obtain information related to the simulated penetration test in the database (DB, 130), for example, target host, network connection, vulnerability information, simulated penetration design content, host occupation information, . In this regard, Fig. 7 shows a detailed information processing configuration of the information analysis module. Referring to FIG. 7, the information analysis module includes a network configuration information processing unit 141, a simulated penetration design information analysis unit 142, a node information analysis unit 143, and a filtering information analysis unit 144.

- Network configuration information processing unit 141: Processes subnet-based network configuration information for network information collected by a plurality of testers. Identifies the host information included in the subnet and processes connection relationship information between the subnets.

- Mock Penetration Design Information Analysis Unit 142: Processes mock Penetration Design Configuration Information for a host on a specific subnet. Consolidate and configure the exploit, payload, target service, and vulnerability information used for mock penetration design.

- Node Information Analysis Unit 143: Analyzes the host information in the subnet and the function of the host (such as routing or simple host). Consolidated connection information is configured for host information collected by a plurality of testers.

Filtering Information Analysis Unit 144: Filtering contents to be displayed in the visualization module. The information is filtered and provided in the format of the visual information requested by the visualization module.

(6) The visualization module 150 is responsible for visual representation of the commander's real-time mock penetration test in real time and can be conducted. In the visualization module 150, host information collected by each tester, network information, design information performed by testers, performance information, organic connection information of each network, and the like are integrally displayed from a commander's viewpoint. In the integrated dashboard, the data collected by each tester is displayed on the subnet-based connected network. Each tester identifies and collects subnets and host data independently collected and testerized, and identifies hosts on the same subnet and provides an environment for integrated analysis. Thus, the commander can unify these individual pieces of information and direct the direction of the mock penetration testing. Fig. 4 shows the network performance for the simulated penetration test. Each network performed by the testers is classified into subnets based on the information (IP, service, etc.) of the hoses present in each subnetwork and the simulated penetration design (black) and performance result (red) have. In FIG. 5, hosts that exist in the network identified by each tester are shown by OS. The commander can direct the direction of the simulation penetration test and the main design method by ensuring the overall OS distribution of the hosts in the network. The information shown in the visualization module 150 includes the following.

- Display subnet based integrated network network

- OS distribution based integration host display

- Distribution of host-provided services

- Display distribution based on vulnerabilities by host

- Mock penetration design and performance progress indication for each tester

The visualization module 150 can display the simulated penetration test results previously performed and display them again. By replaying the previously performed mock penetration test process sequentially, it is possible to conduct post evaluation and analysis of the mock penetration test progress after the operation and training. This allows individual mock penetration testers to verify the progress of other tester operations and to design and plan for subsequent operations.

Through the present invention, it is possible to consolidate and monitor the operations and training progress of each tester during the penetration test operation and training of the military cyber mock test on the defense network, so that the commander can conduct the operation and training in an integrated manner.

In addition, through the present invention, it is considered that it is more efficient to perform command and control of the commander in the cyber simulation operation environment of the military for securing and evaluating the safety of the defense network.

According to a software implementation, not only the procedures and functions described herein, but also each component may be implemented as a separate software module. Software code can be implemented in a software application written in a suitable programming language. The software code is stored in a memory and can be executed by a controller or a processor.

Claims (6)

A method for military cyborg penetration training in an integrated dashboard device,
A mock penetration test step in which a testor performs a mock penetration test using a test tool for a network network according to role sharing;
A test type and an information input step of inputting a test type and test information for performing a test;
A test data collection step of collecting individual information collected by the tester in cooperation with the tester; And
And a collection information normalization step for normalizing the collected information according to the contents of the test type and the test information with respect to the collected information. The method according to claim 1,
The collection information
Project information corresponding to mock penetration and training identification information;
Tester information corresponding to the simulated infiltration operation and training tester information;
Network and host information corresponding to connection information of the network and host information present in the target network;
Service information corresponding to service information provided by each host;
Simulated infiltration design information corresponding to simulated infiltration design and execution information for the network and the host;
Occupied host detailed information corresponding to internal information of a host occupied in the network; And
And vulnerability information on the host obtained through a test on the network. The method according to claim 1,
A DB storing step of storing the information collected by the tester and the processed information in a database (DB); And
Further comprising an information analyzing step of analyzing the information stored in the DB to extract information to be viewed by the commander. The method of claim 3,
The information analysis step includes:
A network configuration information processing step of processing subnet-based network configuration information for the network information collected by the tester;
A mock penetration design information analysis step of processing mock penetration design configuration information for the host in a specific subnet;
Analyzing host information in a subnet and a function of the host; And
And a filtering information analysis step of filtering the contents to be displayed in the visualization module. The method according to claim 1,
Wherein the collecting information normalization step comprises:
A collection information input step of collecting information inputted by the tester through a data collection module;
Identifying a tester collecting the project and information according to the collected information and assigning a normalization value to the tester;
An information-specific eigenvalue assigning step of assigning identification eigenvalues to the collected information; And
Further comprising a normalization step for each collection data for normalizing the collected information for each item of design type, vulnerability type, and attack technique type. The method of claim 3,
Further comprising the step of visualizing the host information collected by the tester, network information, design information performed by the tester, performance information, and organic connection information of each network on the integrated dashboard, Penetration training method.

Images