KR20200059875A - Apparatus and method for generating document to share information using relationship information between device information and location information - Google Patents

Abstract

Provided are an apparatus for generating an information sharing document using relationship information between device information and location information and a method thereof. According to an embodiment of the present invention, the method for generating an information sharing document is performed by a computing device. The method comprises the steps of: collecting device information; generating the observation data object by converting the device information into a preset information sharing format; extracting location information from the device information and converting the location information into the preset information sharing format to generate a location information object; and generating a relationship information object by analyzing a relationship between the observation data object and the location information object and generating an information sharing document including the observation data object, the location information object, and the relationship information object.

Description

Apparatus and method for generating information sharing document using relationship information between device information and location information {APPARATUS AND METHOD FOR GENERATING DOCUMENT TO SHARE INFORMATION USING RELATIONSHIP INFORMATION BETWEEN DEVICE INFORMATION AND LOCATION INFORMATION}

The present invention relates to an apparatus and method for generating an information sharing document using relationship information between device information and location information. More specifically, the present invention relates to an apparatus and method for generating an information sharing document using relationship information between device information and location information to efficiently and consistently share device information and generate an information sharing document in a format suitable for effectively responding to cyber attacks. .

The security vulnerabilities inherent in software can easily be exploited to attack computer systems. Attackers can use Internet scan tools to identify vulnerable Web services and use malicious vulnerabilities to perform malicious actions. Particularly, as the Internet of Things (IoT) devices are widely spread, the number of devices connected to the Internet is rapidly increasing.

Accordingly, security managers need to identify and respond to vulnerabilities that are open to the public, and quickly identify security vulnerabilities of numerous computer systems connected to the Internet and perform vulnerability analysis.

Conventionally, this security is achieved by using cyber threat intelligence (CTI), which is a method to effectively respond to cyber security threats based on related information such as vulnerable factors and past attacks that can threaten an organization's information assets. We solved the vulnerability problem. Cyber threat intelligence is a method of proactively defending attacks such as Advanced Persistent Threat (APT) by collecting, analyzing, and utilizing a lot of threat information experienced by various external organizations as well as inside organizations in the past. Effectively responded to cyber security threats using threat intelligence.

Cyber threat intelligence uses a large amount of device information observed in network equipment and security equipment, etc. Since such device information is updated frequently, and the type or firmware of devices connected to the network can be changed from time to time, vast amount of device information If it is used as it is, there is a problem that it is not possible to perform a quick response to the vulnerability in order to maintain security.

Accordingly, there is a need to provide an information sharing document that can effectively share device information so as to quickly respond to vulnerabilities in order to maintain security in an IoT environment, and automatically analyze it using a standardized format.

The technical problem to be solved by the present invention is to convert device information, which is information observed from various devices, into a format that can be easily shared to effectively share device information and provide an information sharing document that can be easily analyzed. It is to provide an information sharing document generating apparatus and method using relationship information between device information and location information.

Another technical problem to be solved by the present invention is to define a relationship (Relationship Object) between an observation data object (Observed Data Object) generated by converting device information and a location information object (Location Object) generated by converting location information. To provide an information sharing document generating apparatus and method using relationship information between device information and location information that can quickly grasp a large number of observation data.

The technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the following description.

In order to solve the above technical problem, a method for generating an information sharing document according to an embodiment of the present invention includes: collecting device information in a method performed by a computing device, and using the device information in a preset information sharing format Generating an observation data object by converting, extracting location information from the device information, converting the location information into the preset information sharing format, and generating a location information object; and the observation data object and the location information object The analysis may include generating a relationship information object by analyzing the relationship between the relationships, and generating an information sharing document including the observation data object, the location information object, and the relationship information object.

In one embodiment, the preset information sharing format may be a STIX ™ format based on Structured Threat Information Expression (STIX ™), which is a language used to share cyber threat intelligence.

In one embodiment, the step of generating the observation data object comprises: extracting input information including IP information, protocol information, port information, IP observation time information, and current time information from the device information, and the protocol information. Converting the protocol list using the IP information, generating identification information using the IP information, and generating an observation data object including the protocol list, the identification information, the IP observation time information, and the current time information It may include.

In one embodiment, converting the protocol list includes: checking whether the protocol list is empty, if the protocol list is not empty, extracting protocol information included in the protocol list, and the device And converting protocol information extracted from the information.

In one embodiment, the step of generating the observation data object comprises: determining whether an observation data object including the same IP information as the IP information is present in the previously generated observation data object and including the same IP information Generating the identification information of the observation data object, and new observation data including the protocol list, the identification information of the observation data object, the IP observation time information, and the current time information when the observed data object does not exist It may further include the step of creating an object.

In one embodiment, the step of generating the observation data object, if an observation data object including the same IP information exists, check whether the protocol information is changed with respect to the observation data object containing the same IP information And the protocol information is changed, initializes device information included in the observation data object including the IP information, and adds the changed protocol information, the IP observation time information, and the current time information to obtain the IP information. Updating the observation data object to be included, and when the protocol information is not changed, by initializing the IP observation time information included in the observation data object overlapping the IP information and adding the extracted IP observation time information, the And updating the observation data object including the IP information.

In one embodiment, the step of generating the location information object comprises: extracting IP information from the device information, converting the extracted IP information into an integer, and using the converted IP information, the converted IP information range The method may include querying location information of, extracting the queried location information, and generating the location information object by converting the extracted location information into the preset information sharing format.

In one embodiment, converting the extracted location information into the preset information sharing format to generate the location information object comprises: determining whether a location information object corresponding to the extracted location information exists and When the location information object corresponding to the extracted location information does not exist, converting the extracted location information into the preset information sharing format may include generating a new location information object.

In one embodiment, the step of generating the location information object by converting the extracted location information to the preset information sharing format, if a location information object corresponding to the extracted location information exists, the extracted location Determining whether the location information included in the location information object corresponding to the information is changed, and when the location information is changed, the location information of the location information object corresponding to the extracted location information as the extracted location information It may further include the step of updating.

In one embodiment, the step of generating the information sharing document includes: extracting location information from the observation data object, selecting a location information object including the extracted location information, and using the extracted location information Generating relationship information between a data object and the selected location information object, generating the relationship information object by converting the generated relationship information into the preset information sharing format, and the observation data object, the selected location information object, and And generating an information sharing document including the relationship information object.

In one embodiment, generating an information sharing document including the observation data object, the selected location information object, and the relationship information object comprises: setting the observation data object and the location information object as respective nodes, and The method may include generating a graph indicating a relationship between each node set using the relationship information object.

In one embodiment, the relationship information may be a relationship in which a location (located-at) of the observation data object is a location included in the selected location information object.

In one embodiment, the observation data object, the location information object and the relationship information object each include sharing information including type information, identification information, creation date information, and modification date information, and generating the information sharing document The step may include generating an information sharing document including the observation data object, the location information object, and the relationship information object based on the sharing information.

In order to solve the above technical problem, an information sharing document generating apparatus according to another embodiment of the present invention includes a processor, a storage device in which a program is stored, and a memory storing a plurality of operations executed by the processor, The plurality of operations include an operation for collecting device information, an operation for converting the device information into a preset information sharing format to generate an observation data object, extracting location information from the device information, and extracting the location information from the preset information. An operation for generating a location information object by converting to an information sharing format, and generating a relationship information object by analyzing a relationship between the observation data object and the location information object, and generating the observation data object, the location information object, and the relationship information object. It may include an operation for generating an information sharing document to include.

To solve the above technical problem, a computer program according to another embodiment of the present invention is combined with a computing device, collecting device information, converting pre-device information into a preset information sharing format, and observing data objects Generating a location information object by converting location information of the device information to the preset information sharing format, and generating a relationship information object by analyzing a relationship between the observation data object and the location information object, In order to execute the step of generating an information sharing document including the observation data object, the location information object, and the relationship information object, it may be stored in a computer-readable recording medium.

1 is a diagram illustrating an operation in which an information sharing document generating apparatus generates an information sharing document according to an embodiment of the present invention.
2 is a flowchart illustrating a method for generating an information sharing document according to an embodiment of the present invention.
3 is a table showing a form of device information according to an embodiment.
4 is a flowchart illustrating a process of generating an observation data object in a method for generating an information sharing document according to an embodiment of the present invention.
5 is a table showing the configuration of an observation data object according to an embodiment.
6 is a diagram exemplarily showing a shape of an observation data object according to an embodiment.
7 is a flowchart illustrating a process of generating a location information object in a method for generating an information sharing document according to an embodiment of the present invention.
8 is a table showing the configuration of a location information object according to an embodiment.
9 is a diagram exemplarily showing a shape of a location information object according to an embodiment.
10 is a flowchart illustrating a process of generating a relationship information object in a method for generating an information sharing document according to an embodiment of the present invention.
11 is a table showing the configuration of a relationship information object according to an embodiment.
12 is a diagram exemplarily showing a form of a relationship information object according to an embodiment.
13 is a graph showing a relationship between an observation data object and a location information object using a relationship information object in a method for generating an information sharing document according to an embodiment of the present invention.
14 is a hardware configuration diagram of an information sharing document generating apparatus according to another embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Advantages and features of the present invention, and methods for achieving them will be clarified with reference to embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various different forms, and only the embodiments allow the publication of the present invention to be complete, and general knowledge in the technical field to which the present invention pertains. It is provided to fully inform the holder of the scope of the invention, and the invention is only defined by the scope of the claims. The same reference numerals refer to the same components throughout the specification.

Unless otherwise defined, all terms (including technical and scientific terms) used in this specification may be used as meanings commonly understood by those skilled in the art to which the present invention pertains. In addition, terms defined in the commonly used dictionary are not ideally or excessively interpreted unless specifically defined. The terminology used herein is for describing the embodiments and is not intended to limit the present invention. In the present specification, the singular form also includes the plural form unless otherwise specified in the phrase.

Hereinafter, some embodiments of the present invention will be described with reference to the drawings.

1 is a diagram illustrating a structure in which an information sharing document generating apparatus according to an embodiment of the present invention operates.

Referring to FIG. 1, the apparatus 100 for generating an information sharing document according to an embodiment of the present invention may collect device information from network equipment and security equipment. To this end, the information sharing document generating apparatus 100 may be separately provided with a network (not shown) for communicating with network equipment and security equipment.

Here, the device information refers to information observed from devices such as network equipment and security equipment. For example, referring to FIG. 3, device information may be cyber threat intelligence elements such as indicators and malware, and may include IP information, time information, protocol information, and port information. However, the present invention is not limited thereto, and the device information is IP information, time information, protocol information, and port information as basic information, and information representing hardware, operating system, and application version information of the observed device according to a predetermined format. It may further include.

The device information may be information collectively stored in an external server, and may be information transmitted from each of network equipment and security equipment. Accordingly, the information sharing document generating apparatus 100 may collect device information in various formats. For example, as illustrated in FIG. 3, IP information and protocol information in the form of a string and time information in the form of a timestamp may be collected.

The information sharing document generating apparatus 100 may convert the collected device information and the location information extracted from the device information into a preset information sharing format to generate an observation data object and a location information object, and an observation data object and a location information object A relationship information object may be generated by analyzing a relationship between them, and information sharing documents may be generated by integrating them.

Here, the preset information sharing format may be a STIX ™ format based on a structured threat information expression (STIX ™), which is a language used to share cyber threat intelligence.

The STIX ™ format is a serialized, language used to exchange cyber threat intelligence. The STIX ™ format includes Attack Pattern, Campaign, Action of Action, Identity, Indicator, Intrusion Set, Location, Malware, STIX Domain Object (SDO) including Notes, Observed Data, Opinion, Report, Threat Actor, Tool and Vulnerability ) And STIX Relationship Objects (SRO) including Relationships and Sighting objects. Hereinafter, a series of processes in which the information sharing document generating apparatus 100 generates the information sharing document will be described with reference to FIG. 2.

2 is a flowchart illustrating a method for generating an information sharing document according to an embodiment of the present invention.

Referring to FIG. 2, first, the information sharing document generating apparatus 100 may collect device information from observation equipment such as network equipment and security equipment (S110). For example, the information sharing document generating apparatus 100 may collect information on a device connected to the network by performing a service scan on devices connected to the network. However, it is not limited to this, and any method of collecting information from various devices may be applied.

Next, the information sharing document generating apparatus 100 may generate the observation data object by converting the device information collected in step S110 into a preset information sharing format (S120). Hereinafter, a process of generating the observation data object by the information sharing document generating apparatus 100 will be described with reference to FIG. 4.

4 is a flowchart illustrating a process of generating an observation data object in a method for generating an information sharing document according to an embodiment of the present invention.

Referring to FIG. 4, the information sharing document generation apparatus 100 may extract input information from the device information collected in step S110 (S1201). At this time, the input information means information for input to the observation data object. For example, the input information extracted from the device information may include IP information, protocol information, port information, IP observation time information, and current time information.

Next, the information sharing document generating apparatus 100 may check whether the protocol list is empty using the protocol information included in the input information (S1202).

Here, when the protocol list is not empty, the information sharing document generating apparatus 100 may extract protocol information included in the protocol list (S1203).

Next, the information sharing document generation apparatus 100 may convert the protocol list to the STIX ™ format by converting and adding protocol information extracted from the device information in step S1201 (S1204).

Thereafter, in step S1202, if the protocol list is empty, or if the protocol list is converted to the STIX ™ format through steps S1203 and S1204, the information sharing document generating apparatus 100 is a step S1201 of the previously generated observation data objects It can be confirmed whether or not an observation data object including the same IP information as extracted from IP exists (S1205).

If, among the observation data objects previously generated in step S1205, there is no observation data object including the same IP information extracted in step S1201, identification information (ID) for the observation data object may be generated ( S1206). For example, the apparatus 100 for generating an information sharing document is observed in a UUIDv4 format in the form of "type of object-8 hexadecimal digits-4 hexadecimal digits-4 hexadecimal digits-4 hexadecimal digits-12 digits" The identification information of the data object can be generated.

Thereafter, the apparatus 100 for generating an information sharing document may generate a new observation data object including a protocol list, identification information, IP observation time information, and current time information (S1207).

On the other hand, if there is an observation data object that includes the same IP information as the IP information extracted in step S1201 among the observation data objects previously generated in step S1205, the information sharing document generating apparatus 100 does not generate a new observation data object. , You can update the previously created observation data object. More specifically, the information sharing document generating apparatus 100 may check whether the protocol information included in the observation data object including the IP information extracted in step S1201 is changed (S1208).

If the protocol information included in the observation data object including the IP information extracted in step S1201 is changed, the information sharing document generating apparatus 100 is device information included in the observation data object including the IP information extracted in step S1201. Is initialized (S1209), and the observed data object may be updated by adding changed protocol information, IP observation time information, and current time information (S1210). For example, the device information of the observation data object including the IP information extracted in step S1201 is initialized, and the extracted current time information, IP observation time information, protocol information, and port information are added to the observation data object where the device information is initialized. By doing so, the observation data object can be updated.

On the other hand, if the protocol information is not changed, the information sharing document generating apparatus 100 includes the IP information extracted in S1201 by changing only the IP observation time information included in the observation data object including the IP information extracted in S1201. The observed data object to be updated can be updated (S1211).

The observation data object generated through the above steps may be configured to include items included in the table shown in FIG. 5, and the observation data object may be generated as shown in FIG. 6. However, FIGS. 5 and 6 are for describing an embodiment, and are not limited thereto.

Returning to FIG. 2 again, the information sharing document generation apparatus 100 may generate location information objects by extracting location information from the device information and converting the extracted location information into the preset information sharing format (S130). Hereinafter, a series of processes in which the information sharing document generating apparatus 100 generates a location information object will be described with reference to FIG. 7.

7 is a flowchart illustrating a process of generating a location information object in a method for generating an information sharing document according to an embodiment of the present invention.

Referring to FIG. 7, the information sharing document generating apparatus 100 may perform a process of generating a location information object after step S120. However, the present invention is not limited thereto, and the apparatus 100 for generating an information sharing document performs a process of generating a location information object at the same time as a process of generating an observation data object, or generates a location information object before the process of generating an observation data object. You can carry out the process.

First, the information sharing document generation apparatus 100 may extract IP information from the device information collected in step S110 and convert the extracted IP information into an integer type (S1301).

Next, the information sharing document generating apparatus 100 may search and extract location information of a corresponding IP range using the integer IP information converted in step S1301 (S1302). At this time, the information sharing document generating apparatus 100 may be provided with pre-stored location information from the location information database provided on the external server, and the location information of the device information based on the range of the converted IP information among the pre-stored location information. Can be extracted.

Here, the pre-stored location information provided from the location information database may include country, region, and city level information and latitude and longitude information for each IP band. . For example, location information of the device information extracted based on the range of the converted IP information is "IP band-30695936 to 30696191, country-Korea (KR, Korea, Republic of), region-Jeonnam, city-naju (Naju), latitude-35.02833 and longitude-126.717 ".

Thereafter, the information sharing document generating apparatus 100 may determine whether a location information object corresponding to the location information of the device information extracted in step S1302 exists (S1303).

If, in step S1303, the location information object corresponding to the location information of the device information extracted in step S1302 does not exist, the information sharing document generating apparatus 100 sets the location information of the device information extracted in step S1302 A new location information object may be generated by converting to an information sharing format (S1304).

If, in step S1303, there is a location information object corresponding to the location information of the device information extracted in step S1302, the information sharing document generating apparatus 100 is positioned with respect to the location information object corresponding to the location information of the device information It is possible to check whether information is changed (S1305), and when the location information is changed, the information sharing document generation apparatus 100 extracts the location information of the location information object corresponding to the extracted location information by changing the extracted location information to the extracted location information. It is possible to update the location information object corresponding to the location information (S1306). For example, by changing current time information, country information, longitude, latitude, area information, and city information included in the location information of the location information object corresponding to the extracted location information to information included in the extracted location information, extraction is performed. It is possible to update the location information object corresponding to the location information.

If, in step S1305, the location information has not been changed, the information sharing document generating apparatus 100 may use the location information object corresponding to the location information of the device information as it is.

The location information object generated through the above steps may be configured to include items included in the table shown in FIG. 8, and the location information object may be generated as shown in FIG. 9. However, FIGS. 8 and 9 are for describing an embodiment, and are not limited thereto.

Returning to FIG. 2 again, the information sharing document generation device 100 may generate a relationship information object by analyzing the relationship between the observation data object generated in step S120 and the location information object generated in step S130 (S130).

More specifically, the information sharing document generation apparatus 100 may generate a relationship information object by analyzing a relationship between the STIX domain object of the observation data object and the location information included in the location information object. Hereinafter, with reference to FIG. 10, a series of processes in which the information sharing document generating apparatus 100 generates a relationship information object will be described.

10 is a flowchart illustrating a process of generating a relationship information object in a method for generating an information sharing document according to an embodiment of the present invention.

Referring to FIG. 10, the information sharing document generation apparatus 100 may extract location information from the observation data object generated in step S120 (S1401). A location information object including extracted location information may be selected (S1402).

Thereafter, the information sharing document generating apparatus 100 may analyze the relationship between the observation data object and the selected location information object to generate relationship information between the observation data object and the selected location information object (S1403).

Here, the relationship information refers to information indicating the property and direction of the STIX domain object of the observation data object using the location information object. For example, the relationship information uses the type attribute of the relationship information to indicate information indicating that the relationship between the malware object and the action object having action information for the malware is a “mitigates” relationship. It can contain. For example, as shown in FIG. 13, when the position of the observation data object 1 (1-1) is the same as the position indicated by the location information object 1 (2), the relationship information is from the observation data object 1 (1-1). It may be a "locate-at" relationship having directionality in the direction of the location information object 1 (2). However, it is not limited to this.

In one embodiment, the information sharing document generating apparatus 100 extracts relationship information corresponding to an observation data object and a location information object from relationship information stored in a previously stored relationship information data table, and extracts the extracted relationship information with the corresponding observation data object It can be selected as relationship information between location information objects. However, the present invention is not limited thereto, and any method of generating relationship information between an observation data object and a location information object is applicable.

Next, it may be checked whether a relationship information object corresponding to the relationship information generated in step S1403 exists. For example, by checking whether there is a relationship information object including the observation data object and the location information object among the previously generated relationship information objects, whether a relationship information object corresponding to the relationship information generated in step S1403 exists? You can check

Here, when there is no relationship information object corresponding to the relationship information generated in step S1403, the generated relationship information may be converted into a preset information sharing format to generate a new relationship information object (S1405).

If, in step S1404, there is a relationship information object corresponding to the relationship information, it can be checked whether or not to change the relationship information included in the relationship information object corresponding to the relationship information (S1406), when the relationship information is changed , By changing the relationship information of the relationship information object corresponding to the generated relationship information to the generated relationship information, the relationship information object corresponding to the relationship information can be updated.

The relationship information object generated through the above steps may be configured to include items included in the table shown in FIG. 11, and the relationship information object may be generated as shown in FIG. 12. However, FIGS. 11 and 12 are for describing an embodiment, and are not limited thereto.

Finally, the information sharing document generating apparatus 100 may generate an information sharing document including an observation data object and a location information object and a relationship information object between the observation data object and the location information object (S150). For example, the observation data object, the location information object, and the relationship information object may each include shared information including type information, identification information, creation date information, and modification date information. At this time, the information sharing document generating apparatus 100 is based on the shared information included in the observation data object, the location information object, and the relationship information object, respectively, the device information included in the observation data object, the location information included in the location information object, and An information sharing document including all relation information included in the relation information object may be generated. As an example, the information sharing document generating apparatus 100 integrates the form of the observation data object shown in FIG. 6, the form of the position information object shown in FIG. 9, and the form of the relationship information object shown in FIG. You can generate program code to create a shared document. However, it is not limited to this, and any method of generating an information sharing document can be applied.

That is, the information sharing document generating apparatus 100 rapidly responds to vulnerabilities in order to maintain security in the Internet of Things environment by converting a vast amount of device information updated from time to time into a single information sharing document. The advantage is that it can effectively share device information.

In one embodiment, the apparatus 100 for generating an information sharing document may set an observation data object and the location information object as each node, and generate a graph indicating a relationship between each node using the relationship data object. . For example, referring to FIG. 13, observation data object 1 (1-1), observation data object 1-2, and location information object 1 (2) are respectively generated, and observation data object 1 1-1 ) And the relationship between the location information object 1 (2) and the relationship between the observation data object 2 (1-2) and the location information object 1 (2) is a relationship of "located-at", the information sharing document generation device 100 The observation data object 1 (1-1), the observation data object 2 (1-2), and the location information object 1 (2) may be set as nodes, respectively. In addition, the information sharing document generating apparatus 100 connects the observation data object 1 (1-1) and the location information object 1 (2) so as to be directional in the direction of the location information object 1 (2), and the observation data object 2 ( By connecting the 1-2) and the location information object 1 (2) so that they are directional in the direction of the location information object 1 (2), the observation data object 1 (1-1), the observation data object 1-2 and the location information A graph showing the relationship between the objects 1 (2) can be generated. Through this, the user can more easily grasp the relationship between the observation data object and the location information object. Hereinafter, a hardware configuration of the information sharing document generating apparatus according to another embodiment of the present invention will be described with reference to FIG. 14.

14 is a hardware configuration diagram of an information sharing document generating apparatus according to another embodiment of the present invention.

Referring to FIG. 14, the apparatus 100 for generating an information sharing document according to another embodiment of the present invention includes a processor 110 that performs an instruction, a memory 120, and a storage device in which a program including the instruction is stored ( 130), may include a network interface 140 for transmitting and receiving data with an external device. In addition, the information sharing document generating apparatus 100 may further include a system bus 150 that serves as a passage for transferring data between components.

First, the process 110 controls the overall operation of each component of the information sharing document generation device 100. The processor 110 may be a central processing unit (CPU), a microprocessor unit (MPU), a micro controller unit (MCU), or any form well known in the art. It can be configured to include a processor. Further, the processor 110 may perform operations on at least one application or program for executing the method according to embodiments of the present invention.

In one embodiment, the information sharing document generating apparatus 100 may include one or more processors 110.

The memory 120 may store various data, commands, and / or information.

The memory 130 may load a program including a command for generating an information sharing document from the storage device 130 described later in order to execute the method for generating an information sharing document according to embodiments of the present invention. For example, the memory 130 may be RAM, an information sharing document generation program may be loaded through RAM, and a plurality of operations included in the information sharing document generation program may be executed. However, the present invention is not limited thereto, and any component capable of loading a program may be applied.

Here, the plurality of operations are operations for collecting device information, operations for generating device data by converting device information into a preset information sharing format, extracting location information from device information, and converting location information into a preset information sharing format. An operation for generating a location information object by transforming, and analyzing a relationship between an observation data object and a location information object to generate a relationship information object, and generating an observation data object, a location information object, and an information sharing document including the relationship information object It may include the operation. However, the present invention is not limited thereto, and various operations for generating an information sharing document may be additionally included.

The storage device 130 may temporarily store observation data objects, location information objects, and relationship information objects generated from the information sharing document generation device 100, and combine observation data objects, location information objects, and relationship information objects. The created information sharing document can be saved.

The storage device 130 includes a non-volatile memory such as a read only memory (ROM), an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a flash memory, a non-volatile memory, a hard disk, a removable disk, Or it may be configured to include any form of computer-readable recording media well known in the art.

The network interface 140 may support wired and wireless Internet communication of the information sharing document generation device 100. Also, the network interface 140 may support various communication methods other than Internet communication. To this end, the network interface 140 may include a communication module well known in the technical field of the present invention.

The methods according to the embodiments of the present invention described so far can be performed by executing a computer program embodied in computer readable code. The computer program may be transmitted from a first computing device to a second computing device through a network, such as the Internet, and installed in the second computing device, thereby being used in the second computing device. The first computing device and the second computing device include both server devices, physical servers belonging to a server pool for cloud services, and fixed computing devices such as desktop PCs.

The computer program may be stored in a recording medium such as a DVD-ROM or flash memory device.

Although the embodiments of the present invention have been described with reference to the accompanying drawings, a person skilled in the art to which the present invention pertains may be implemented in other specific forms without changing the technical concept or essential features of the present invention. Can understand. Therefore, it should be understood that the above-described embodiments are illustrative in all respects and not restrictive.

Claims (14)

A method performed by a computing device, the method comprising:
Collecting device information;
Generating the observation data object by converting the device information into a preset information sharing format;
Extracting location information from the device information, and converting the location information into the preset information sharing format to generate a location information object; And
Includes; analyzing the relationship between the observation data object and the location information object to generate a relationship information object, and generating an information sharing document including the observation data object, the location information object and the relationship information object;
How to create an information sharing document. According to claim 1,
The preset information sharing format,
STIX ™ format based on the Structured Threat Information Expression (STIX ™), a language used to share Cyber Threat Intelligence (CTI),
How to create an information sharing document. According to claim 1,
Generating the observation data object,
Extracting input information including IP information, protocol information, port information, IP observation time information, and current time information from the device information;
Converting a protocol list using the protocol information;
Generating identification information using the IP information; And
Includes; generating an observation data object including the protocol list, the identification information, the IP observation time information and the current time information;
How to create an information sharing document. According to claim 3,
Step of converting the protocol list,
Checking whether the protocol list is empty;
If the protocol list is not empty, extracting protocol information included in the protocol list; And
Including; converting the protocol information extracted from the device information;
How to create an information sharing document. According to claim 3,
Generating the observation data object,
Checking whether an observation data object including the same IP information as the IP information exists in the previously generated observation data object;
Generating identification information of the observation data object when the observation data object including the same IP information does not exist; And
Further comprising; generating a new observation data object including the protocol list, the identification information of the observation data object, the IP observation time information and the current time information;
How to create an information sharing document. The method of claim 5,
Generating the observation data object,
If there is an observation data object including the same IP information, checking whether the protocol information is changed with respect to the observation data object containing the same IP information; And
When the protocol information is changed, the device information included in the observation data object including the IP information is initialized, and the changed protocol information, the IP observation time information, and the current time information are added to include the same IP information. Updating the observation data object; And
When the protocol information is not changed, the observation data object including the IP information is updated by initializing the IP observation time information included in the observation data object overlapping with the IP information and adding the extracted IP observation time information. Comprising the steps of
How to create an information sharing document. According to claim 1,
Generating the location information object,
Extracting IP information from the device information, and converting the extracted IP information into an integer type;
Querying location information of the converted IP information range using the converted IP information, and extracting the retrieved location information; And
And converting the extracted location information into the preset information sharing format to generate the location information object,
How to create an information sharing document. The method of claim 7,
Generating the location information object by converting the extracted location information to the preset information sharing format,
Checking whether a location information object corresponding to the extracted location information exists; And
Including if the location information object corresponding to the extracted location information does not exist, converting the extracted location information into the preset information sharing format to generate a new location information object;
How to create an information sharing document. The method of claim 8,
Generating the location information object by converting the extracted location information to the preset information sharing format,
If a location information object corresponding to the extracted location information exists, checking whether the location information included in the location information object corresponding to the extracted location information is changed; And
Further comprising, when the location information is changed, updating the location information of the location information object corresponding to the extracted location information with the extracted location information;
How to create an information sharing document. According to claim 1,
The step of generating the information sharing document,
Extracting location information from the observation data object, and selecting a location information object including the extracted location information;
Generating relationship information between the observation data object and the selected location information object using the extracted location information;
Generating a relationship information object by converting the generated relationship information into the preset information sharing format; And
And generating an information sharing document including the observation data object, the selected location information object, and the relationship information object.
How to create an information sharing document. The method of claim 10,
Generating an information sharing document including the observation data object, the selected location information object and the relationship information object,
And setting the observation data object and the location information object as respective nodes, and using the relationship information object to generate a graph representing a relationship between the established nodes.
How to create an information sharing document. The method of claim 10,
The relationship information,
The position of the observation data object is a relationship that is a position included in the selected location information object,
How to create an information sharing document. Processor;
A storage device in which the program is stored; And
It includes a memory for storing a plurality of operations executed by the processor,
The plurality of operations,
Operation to collect device information,
An operation of converting the device information into a preset information sharing format to generate an observation data object,
An operation of extracting location information from the device information, converting the location information to the preset information sharing format, and generating a location information object, and
And generating a relationship information object by analyzing a relationship between the observation data object and the location information object, and generating an information sharing document including the observation data object, the location information object, and the relationship information object
Information sharing document generation device. Combined with computing devices,
Collecting device information;
Generating the observation data object by converting the device information into a preset information sharing format;
Generating location information objects by converting location information of the device information into the preset information sharing format; And
Generating a relationship information object by analyzing a relationship between the observation data object and the location information object, and generating an information sharing document including the observation data object, the location information object and the relationship information object; Stored on a computer-readable recording medium,
Computer program.

Images