KR20200055563A - Multi-Level Scenario Authoring Method for Threat in Cyber Training Environment - Google Patents

Abstract

According to the present invention, provided is a multi-level based scenario authoring method for threat generation in a cyber training environment. The method comprises: an installation step which is performed by a threat generation simulation device corresponding to a cyber attacker and installs a malicious program on a target system; a command and control step which performs a command and control for remotely operating the target system; and an attack purpose achievement step which is to achieve an attack purpose in accordance with tactics for each attack step for the target system. The scenario authoring method can be varied for each level to assist in constructing a cyber training environment more efficiently.

Description

Multi-level scenario authoring method for threat in cyber training environment

The present invention relates to a multi-level based scenario authoring method and apparatus. More specifically, it relates to a multi-level based scenario authoring method and apparatus for threat generation in a cyber training environment.

Defense training against cyber threats is essential to improve cyber warfare capabilities. To this end, it is necessary to construct various training scenarios for each level, from the low level of the simple problem-solving method, to training to respond to one simple threat, and further, to practice complex scenarios based on real cases.

However, the current training scenario is distributed in the form of a finished product that has already been configured for each specific scenario, not in a form that can be composed and authored in various ways. Therefore, there is a problem that it is very limited in preparing various training scenarios.

In particular, in the case of real-life scenario-based complex scenario training, cyber threats that are actually generated are not composed of a single threat, but are composed of a combination of unit threats with different vulnerabilities. That is, it is a form in which unit attacks of various stages are formed, and these staged attacks are successively succeeded and the targeted final attack is made.

Therefore, the professional level of authors for authoring such complex scenarios may be different. Also, if necessary, you may want to configure the scenario with only simple selection, or you may want to configure it as detailed as possible. However, there is a problem that it is very limited in preparing various training scenarios.

Accordingly, an object of the present invention is to provide a multi-level based scenario authoring method and apparatus for threat generation in a cyber training environment.

Also, an object of the present invention relates to a method for authoring a scenario for threat generation during cyber defense training, and to assist in constructing a cyber training environment more efficiently by varying the scenario writing method for each level.

Provided is a multi-level based scenario authoring method for threat generation in a cyber training environment according to the present invention for solving the above problems. The method is performed by a threat generation simulation device corresponding to a cyber attacker, and an installation step of installing a malicious program in a target system; A command and control step of performing a command and control for remotely operating the target system; And an attack objective achievement step for achieving an attack objective in accordance with the tactics for each attack stage for the target system, and the scenario authoring method may be varied for each level to assist in constructing a cyber training environment more efficiently.

According to one embodiment, in the installation step, the cyber attacker has an activity tactic to maintain a persistent state in the system, an elevation of privilege tactic to have a higher level of access required to perform the cyber attack, detection in the attack process To avoid or to avoid the cyber attack damage, it is possible to perform defense evasion tactics and attack execution tactics for executing code that can be controlled by the attacker locally or remotely.

According to an embodiment, in the command and control step, the attacker has access to a system or a credential tactic for controlling the system, an internal diffusion tactic for the attacker to access and control a remote system in the target network, the Information discovery tactics for acquiring available information about systems and networks using a system intruded by an attacker, information collection tactics used by the attacker to recognize and collect information on the network, and the attacker in the target network Command control tactics that perform communication between the controlling systems can be performed.

According to one embodiment, the attacker may perform an information leakage strategy in which the file or information is finally leaked from the target network, and a service rejection strategy used by the attacker to stop the operation of the target network or terminal.

According to an embodiment, when the multi-level-based scenario for generating the threat is one simple threat, only the attack step including the installation step, the command and control step, and the attack goal achievement step according to level 1 can do.

According to one embodiment, when the multi-level based scenario for generating the threat is one simple threat, the detailed tactics of the installation step, the detailed tactics of the command and control step, and the attack objective achievement step according to level 2 Only detailed tactics can be performed.

According to an embodiment, when the multi-level based scenario for generating the threat is one simple threat, only the detailed technology that is a sub-list of the detailed tactics of the level 2 may be performed according to the level 3.

According to an embodiment, when the multi-level-based scenario for the threat generation is one complex scenario training, the required portion of the attack step of the level 1 is identified and continuously selected, or the detailed tactic of the level 2 The required part is identified and selected continuously, or the required part of the detailed description of the level 3 is selected and selected continuously, or the required parts are mixed by the level 1 to the level 3 to be identified and continuously selected to be combined. It can pose a threat.

According to at least one embodiment of the present invention, there is an advantage of providing a method for authoring a scenario for threat generation during cyber defense training.

In addition, according to at least one embodiment of the present invention, there is an advantage in that it is possible to support the construction of a cyber training environment more efficiently by varying the scenario authoring method for each level.

1 is a structural diagram referred to in the description for authoring a complex scenario according to an embodiment of the present invention.
2 is an explanatory diagram of a multi-level based scenario authoring method according to an embodiment of the present invention.
3 is a flow chart for authoring a multi-level based scenario for threat generation in a cyber training environment according to an embodiment of the present invention.
4 shows a detailed configuration of a threat generation simulation device (or scenario authoring device) corresponding to a cyber attacker according to the present invention.

The above-described features and effects of the present invention will become more apparent through the following detailed description in connection with the accompanying drawings, and accordingly, those skilled in the art to which the present invention pertains can easily implement the technical spirit of the present invention. Will be able to.

The present invention can be applied to various changes and can have various embodiments, and specific embodiments will be illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention.

In describing each drawing, similar reference numerals are used for similar components.

Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from other components.

For example, the first component may be referred to as a second component without departing from the scope of the present invention, and similarly, the second component may be referred to as a first component. The term and / or includes a combination of a plurality of related described items or any one of a plurality of related described items.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person skilled in the art to which the present invention pertains.

Terms such as those defined in a commonly used dictionary should be interpreted as having meanings consistent with meanings in the context of related technologies, and should not be interpreted as ideal or excessively formal meanings unless explicitly defined in the present application. Should not.

The suffix modules, blocks, and parts for components used in the following description are given or mixed in consideration of the ease of writing the specification, and do not have a meaning or a role that is distinguished from each other.

Hereinafter, with reference to the accompanying drawings, preferred embodiments of the present invention will be described so that those skilled in the art can easily carry out. In the following description of embodiments of the present invention, when it is determined that detailed descriptions of related well-known functions or well-known configurations may unnecessarily obscure the subject matter of the present invention, detailed descriptions thereof will be omitted.

Hereinafter, a method and apparatus for constructing data in a cyber training system according to the present invention, that is, a method and apparatus for constructing data for generating Internet background traffic in a cyber training system will be described.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

1 is a structural diagram referred to in the description for authoring a complex scenario according to an embodiment of the present invention. Meanwhile, FIG. 2 is an explanatory diagram of a multi-level based scenario authoring method according to an embodiment of the present invention. In addition, Figure 3 is a flow chart for authoring a multi-level-based scenario for threat generation in a cyber training environment according to an embodiment of the present invention.

To create a scenario for threat generation, authors can use the attack stage, tactics for each attack stage, and a list of available threat technologies for each tactic.

Referring to FIG. 1, the attack stage is defined as level 1 as the highest concept, and is composed of the following. That is, it consists of installing a malicious program on the target system, command and control steps to remotely operate the target system, and achieving a goal to achieve an attack goal. In this regard, in the cyber training environment according to the present invention, a multilevel-based scenario authoring method for threat generation may be performed by a threat generation simulation device (or threat generation authoring device) corresponding to a cyber attacker.

Meanwhile, the method specifically includes an installation step of installing a malicious program in a target system (S100); A command and control step of performing a command and control for remotely operating the target system (S200); And an attack purpose achievement step (S300) for achieving an attack purpose according to the tactics for each attack step for the target system.

Referring to FIG. 1, the tactics for each attack step are defined as level 2 as a next-level concept, and are composed of the following.

First, in the installation step (S100), the cyber tactics activity tactics to maintain a persistent state in the system, the elevating tactics to have a higher level of access required to perform the cyber attack, or evade detection in the attack process or Defense evasion tactics to prevent cyber attack damage from being recognized, and attack execution tactics to execute attacker-controllable code locally or remotely.

On the other hand, in the command and control step (S200), the system the attacker access to the system or credentials tactics to control the system, the attacker is internal to access the remote system in the target network, and controls the diffusion tactic, the attackers penetrated Information discovery tactics to acquire available information about systems and networks using, tactics to collect information used by attackers to recognize and collect information on the network, and attackers communicate between systems controlled by the target network Command control tactics.

On the other hand, in the step of achieving the attack purpose (S300), an attacker may perform an information leakage strategy in which a file or information is finally leaked from a target network, and a service rejection strategy used by an attacker to stop the operation of the target network or terminal. .

Referring to FIG. 1, a list of threat technologies that can be used for each tactic is defined as level 3 as a sub-concept, and is a detailed threat code that can be executed separately.

FIG. 2 is a reference diagram for a process of authoring a complex scenario for generating a threat for cyber defense training according to an embodiment of the present invention, and is an explanatory diagram of a multi-level based scenario authoring method.

Referring to FIG. 2, when a scenario author wants to construct a scenario with a low level of expertise or a simple selection, a scenario can be authored using a higher level.

If the scenario author has expert-level knowledge of threat technology or wants to configure the desired settings in detail, the scenario can be authored using the lower level.

3 is a flow chart for authoring a multi-level based scenario for threat generation in a cyber training environment according to an embodiment of the present invention.

Referring to FIG. 3, the author plans a scenario for generating a threat for cyber defense training.

In the case of training that responds to one simple threat, a single threat is generated by selecting only the level 1 attack stage, only the level 2 tactic, or only the level 3 technique.

Specifically, when the multi-level based scenario for threat generation is one simple threat, it includes the installation step (S100), the command and control step (S200), and the attack purpose achievement step (S300) according to level 1 Can only perform the attack phase.

On the other hand, if the multi-level based scenario for generating the threat is one simple threat, the detailed tactics of the installation step (S100), detailed tactics of the command and control step (S200) and the purpose of the attack are achieved according to the level 2 Only detailed tactics of step S300 may be performed.

On the other hand, if the multi-level-based scenario for generating the threat is one simple threat, only the detailed technology that is a sub-list of the detailed tactics of the level 2 may be performed according to the level 3.

On the other hand, in the case of complex scenario training, necessary parts of the level 1 attack phase are identified and continuously selected, necessary parts of the level 2 tactics are selected and continuously selected, or necessary parts of the level 3 technique are identified and continuously selected, By mixing levels, you identify the parts you need and select them sequentially to generate complex threats. In this way, a complex threat scenario can be generated to generate a complex threat, and the scenario configuration can be ended.

Specifically, when the multi-level-based scenario for generating the threat is one complex scenario training, the necessary parts of the attack step of the level 1 are identified and continuously selected, or the necessary parts of the detailed tactics of the level 2 It can be selected continuously by identifying, or can be continuously selected by identifying the required part of the detailed description of the level 3. Alternatively, the level 1 to the level 3 may be mixed to identify a required portion and continuously selected to generate a complex threat.

On the other hand, in a multi-level scenario authoring method for threat generation in a cyber training environment, it is necessary to specify how the privilege escalation tactics, defense evasion tactics, attack execution tactics, certification tactics, and internal proliferation tactics are performed. have. For example, a higher level of access rights may be simply granting a level for each accessibility feature, application shimming, user account control bypass, new service, or valid account.

These higher-level access rights 1) present parent / child relationships between them, 2) grant permissions such as permission / change rights for each item, or 3) different sets of access rights depending on the authored scenario. Can be granted.

In addition, the same principles are applied to defense evasion tactics, attack execution tactics, credential certification tactics, and internal diffusion tactics. Permissions may be granted, or 3) different sets of access rights may be granted depending on the authored scenario.

Meanwhile, an apparatus for performing a multi-level based scenario authoring method for threat generation in a cyber training environment according to another aspect of the present invention may be provided. As described above, a multi-level based scenario authoring method for threat generation in a cyber training environment may be performed by a threat generation simulation device (or scenario authoring device) corresponding to a cyber attacker.

In this regard, FIG. 4 shows a detailed configuration of a threat generation simulation device (or scenario authoring device) corresponding to a cyber attacker according to the present invention. Referring to FIG. 4, the apparatus includes an installation control unit 110 for installing a malicious program in a target system; A command and control unit 120 for performing command and control to remotely operate the target system; And an objective achievement control unit 130 for achieving an attack objective according to each attack step tactic for the target system.

On the other hand, each module performing detailed tactics and detailed techniques performed in a multi-level based scenario authoring method for threat generation in the cyber training environment includes the installation control unit 110, the command and control unit 120, and the purpose of the attack. It may exist in the corresponding area of the achievement control unit 130 or may be loaded (loaded) as needed.

Meanwhile, detailed operations and algorithms performed in a multi-level based scenario authoring method for threat generation in the cyber training environment are applicable to the scenario authoring apparatus.

In the above, a multilevel-based scenario authoring method and a device for generating a threat in a cyber training environment according to the present invention have been described. On the other hand, in the cyber training environment according to the present invention, the technical effects of the multi-level based scenario authoring method and the device for generating a threat are as follows.

According to at least one embodiment of the present invention, there is an advantage of providing a method for authoring a scenario for threat generation during cyber defense training.

In addition, according to at least one embodiment of the present invention, there is an advantage in that it is possible to support the construction of a cyber training environment more efficiently by varying the scenario authoring method for each level.

According to the software implementation, design and parameter optimization for each component as well as the procedures and functions described herein may be implemented as separate software modules. Software code can be implemented in a software application written in an appropriate programming language. The software code may be stored in a memory and executed by a controller or processor.

Claims (8)

In a multi-level based scenario authoring method for threat generation in a cyber training environment, the method is performed by a threat generation simulation device corresponding to a cyber attacker,
An installation step of installing a malicious program on the target system;
A command and control step of performing a command and control for remotely operating the target system; And
Multi-level scenario writing method for threat generation, comprising the step of achieving an attack objective to achieve an attack objective according to the tactics for each attack stage for the target system. According to claim 1,
In the installation step,
Action tactics for the cyber attacker to maintain a persistent state in the system,
Elevation tactics to have the higher level of access necessary to conduct cyber attacks,
Defense evasion tactics to evade detection during the attack process or to discern cyberattack damage,
Multi-level scenario writing method for threat generation, characterized in that performing an attack execution tactic for executing code controlled by the attacker locally or remotely. According to claim 2,
In the command and control step,
Credential tactics for the attacker to access or control the system,
Internal proliferation tactics for the attacker to access and control remote systems in the network being attacked,
Information discovery tactics for acquiring available information about systems and networks using the system intruded by the attacker,
Information gathering tactics used by the attacker to recognize and collect information on the network,
Multi-level based scenario authoring method for threat generation, characterized in that the attacker performs a command control tactic for performing communication between systems controlled by the target network. According to claim 3,
An information leakage tactic in which the attacker finally leaks a file or information from the target network,
Multi-level scenario writing method for threat generation, characterized in that the attacker performs a service rejection tactic used to stop the operation of the target network or terminal. According to claim 4,
When the multi-level-based scenario for generating the threat is one simple threat, it is characterized in that it performs only the attack step including the installation step, the command and control step, and the attack objective achievement step according to level 1, Multi-level based scenario authoring method for threat generation. The method of claim 5,
If the multi-level-based scenario for generating the threat is one simple threat, only performing detailed tactics of the installation step, detailed tactics of the command and control step, and detailed tactics of the attack objective achievement step according to level 2 Characterized by, multi-level based scenario authoring method for threat generation. The method of claim 6,
If the multi-level based scenario for the threat generation is one simple threat, it is characterized in that only the detailed technology, which is a sub-list of the detailed tactics of the level 2 according to level 3, is performed. How to write a scenario. The method of claim 7,
When the multi-level based scenario for the threat occurrence is a single complex scenario training,
Identify the required part of the attack step of the level 1 and select it continuously, or
The required parts of the detailed tactics of the level 2 are identified and continuously selected,
Identify the required part of the detailed description of the level 3 and select it continuously, or
Multi-level based scenario authoring method for threat generation, characterized in that by combining the level 1 to the level 3, necessary parts are identified and subsequently selected to generate a complex threat.

Images