KR20230011700A - Apparatus and method for analyzing combat effectiveness by virtual training - Google Patents

Abstract

According to the present invention, disclosed are an apparatus and method for analyzing combat effectiveness by virtual training, which comprise: generating an analysis indicator scenario including a combat effectiveness detection rule and an indicator calculation formula based on a plurality of pre-stored analysis indicators and map information of a virtual reality network, to transmit the generated analysis indicator scenario to a plurality of hosts of the virtual reality network; and analyzing combat effectiveness by virtual training by using training information stored in the host and the detection rule and indicator calculation formula transmitted to the host.

Description

Apparatus and method for analyzing combat effectiveness by virtual training {APPARATUS AND METHOD FOR ANALYZING COMBAT EFFECTIVENESS BY VIRTUAL TRAINING}

The present invention relates to an apparatus and method for analyzing combat effectiveness by virtual training.

The importance of cyberspace, where information is shared and distributed, is increasing day by day in the digital era. When a threat occurs in cyberspace, rapid and clear identification and sharing of the situation must be prioritised in order to protect system availability, integrity, and confidentiality. In order to improve this ability, a practical training method applying various cyber threat attempts is required, but in order to perform this targeting a system in actual operation, real cyber threats for training must be conducted, so many risks are involved. Therefore, as a method for performing such training, a virtual environment for training similar to the actual construction system is constructed to perform cyber training and verify the system's ability to respond to attacks.

Cyber training is performed by trainees assigned to each virtual machine in the training virtual environment described above and performing actions suitable for the created environment and purpose. In order to quantify the effect of training, it is necessary to analyze and quantify how the virtual battlefield for training is affected by the trainee's actions by performing the action in addition to confirming whether the trainee has performed the action for the purpose. However, system impact analysis used in existing cyber training systems is limited to using commercial system information collection tools to identify system usage and network connection situations, and there is no tool for analyzing combat effects suitable for training purposes.

In contrast, an object of the present invention is to construct a system that automatically calculates indicators by processing system logs that are generally collected so that the effects of actions performed by a trainer on the system can be quantitatively analyzed.

An object to be solved according to an embodiment of the present invention includes automatically calculating indicators by processing system logs that are generally collected so that the effect of actions performed by a trainee on the system can be quantitatively analyzed.

Other objects not specified in this specification may be additionally considered within the scope that can be easily inferred from the following detailed description and effects thereof.

In order to solve the above problems, an apparatus for analyzing combat effectiveness by virtual training through a virtual reality network according to an aspect of the present invention is based on a plurality of pre-stored analysis indicators and the virtual reality network map information. A scenario generating unit generating analysis indicator scenarios including detection rules and index calculation formulas and transmitting them to a plurality of hosts of the virtual reality network, training information stored in the hosts, and the detection rules and index calculation formulas transmitted to the hosts. and a result analysis unit that analyzes the combat effectiveness of the virtual training by using the virtual training.

In addition, it may further include an analysis indicator generation unit that generates in advance the plurality of analysis indicators for analyzing results according to each virtual training.

Here, the analysis index generation unit comprises a unit variable template database providing a database schema for unit variables usable for operation, and an analysis index construction unit constructing formulas for the plurality of analysis indexes using the unit variables. and an analysis indicator database that stores and manages the plurality of analysis indicators.

Here, the unit variable may include at least one of a host information unit log, a host parameter, and a host identifier.

Here, the analysis indicator configuration unit includes a detection rule generation unit for generating a detection rule for detecting a specific point in time to calculate the analysis indicator, a host information unit log, or a host using a value detected by the detection rule as a parameter. It may include a host-by-host analysis calculation formula configuration unit constituting a star analysis calculation formula and an inter-host analysis calculation formula configuration unit constituting an inter-host analysis calculation formula that needs to be calculated by combining detection logs of a plurality of hosts.

Here, the result analysis unit uses the training information stored in the host and the detection rule and the indicator calculation formula transmitted to the host to calculate a primary analysis indicator based on the virtual training, and in each of the hosts An inter-host index calculation unit may be included to calculate a combat effectiveness analysis index associated with each host based on the transmitted detection log and the primary analysis index.

According to another aspect of the present invention, a method for analyzing combat effectiveness by virtual training performed by an apparatus for analyzing combat effectiveness by virtual training of a trainee through a virtual reality network includes a plurality of pre-stored analysis indicators and Generating an analysis indicator scenario including a combat effect detection rule and an indicator calculation formula based on the virtual reality network map information and transmitting the generated analysis indicator scenario to a plurality of hosts of the virtual reality network and transmitting training information stored in the host to the host and analyzing the combat effectiveness of the virtual training by using the detected rule and index calculation formula.

The method may further include generating in advance the plurality of analysis indicators for analyzing results according to each virtual training.

Here, the step of generating a plurality of analysis indicators in advance includes providing a database schema for unit variables that can be used in calculations, constructing formulas for the analysis indicators using the unit variables, and A step of storing and managing analysis indicators may be included.

Here, the step of constructing a formula for the analysis index may include generating a detection rule for detecting a specific point in time to calculate the analysis index, using a host information unit log or a value detected by the detection rule as a parameter. A step of constructing a utilized analysis calculation formula and a step of constructing an analysis index to be calculated by combining detection logs of a plurality of hosts.

Here, the step of analyzing the combat effect by the virtual training is the step of calculating the primary analysis index by the virtual training using training information stored in the host and the detection rule and index calculation formula transmitted to the host. and calculating a combat effectiveness analysis index associated with the host based on the detection log transmitted from each host and the primary analysis index.

As described above, according to the embodiments of the present invention, the training effect can be quantitatively analyzed by calculating in real time information necessary for the combat effectiveness analysis index to be calculated according to the training purpose during cyber training.

In addition, in the existing cyber training system, in a way that had to depend on the training manager's qualitative judgment on how efficiently the trainee achieved the training goal, objective indicators were collected/collected in real time, not by the training manager's subjective judgment. Efficient cyber training is possible by providing a way to analyze and calculate.

Even if the effects are not explicitly mentioned here, the effects described in the following specification expected by the technical features of the present invention and their provisional effects are treated as described in the specification of the present invention.

1 is a block diagram showing an apparatus for analyzing combat effectiveness by virtual training according to an embodiment of the present invention.
2 is a diagram showing an analysis indicator generating unit of an apparatus for analyzing combat effectiveness by virtual training according to an embodiment of the present invention.
3 is a diagram showing a scenario generation unit and a result analysis unit of an apparatus for analyzing combat effectiveness by virtual training according to an embodiment of the present invention.
4 is a flowchart illustrating a method for analyzing combat effectiveness by virtual training according to an embodiment of the present invention.
5 is a diagram for explaining a step of generating a plurality of analysis indicators in advance in a method for analyzing combat effects by virtual training according to an embodiment of the present invention.
6 is a diagram for explaining a step of analyzing combat effectiveness by virtual training in a method for analyzing combat effectiveness by virtual training according to an embodiment of the present invention.

Hereinafter, an apparatus and method for analyzing combat effects by virtual training related to the present invention will be described in more detail with reference to the drawings. However, the present invention may be embodied in many different forms and is not limited to the described embodiments. And, in order to clearly describe the present invention, parts irrelevant to the description are omitted, and the same reference numerals in the drawings indicate the same members.

The suffixes "module" and "unit" for components used in the following description are given or used together in consideration of ease of writing the specification, and do not have meanings or roles that are distinct from each other by themselves.

One embodiment of the present invention relates to an apparatus and method for analyzing combat effectiveness by virtual training.

1 is a block diagram showing an apparatus for analyzing combat effectiveness by virtual training according to an embodiment of the present invention.

Referring to FIG. 1 , an apparatus 10 for analyzing combat effects by virtual training according to an embodiment of the present invention includes an analysis indicator generating unit 100, a scenario generating unit 200, and a result analyzing unit 300. includes

According to an embodiment of the present invention, the device 10 for analyzing the combat effectiveness of virtual training quantitatively measures the effect of the trainer's actions on the system when the trainer performs virtual training through a virtual training environment network. It is a device for automatically calculating indicators by processing system logs that are generally collected for analysis.

The analysis indicator generation unit 100 generates the plurality of analysis indicators in advance to analyze results according to each virtual training.

The analysis indicator generation unit 100 will be described in detail in FIG. 2 below.

The scenario generation unit 200 generates an analysis indicator scenario including a combat effect detection rule and an indicator calculation formula based on a plurality of pre-stored analysis indicators and the virtual reality network map information, and transmits the scenario to a plurality of hosts of the virtual reality network. do.

The result analysis unit 300 analyzes the combat effectiveness of the virtual training by using the training information stored in the host and the detection rule and index calculation formula transmitted to the host.

According to an embodiment of the present invention, the analysis index generator 100 may be provided separately from the scenario generator 200 and the result analyzer 300 .

The scenario generation unit 200 and the result analysis unit 300 will be described in detail in FIG. 3 below.

2 is a diagram showing an analysis indicator generating unit of an apparatus for analyzing combat effectiveness by virtual training according to an embodiment of the present invention.

Referring to FIG. 2 , the analysis indicator generation unit 100 according to an embodiment of the present invention includes a unit variable template database 110, an analysis indicator configuration unit 120, and an analysis indicator database 130.

The analysis indicator generation unit 100 according to an embodiment of the present invention generates the plurality of analysis indicators in advance to analyze results according to each virtual training.

The unit variable template database 110 provides a database schema for unit variables usable in calculations.

The unit variable may include at least one of a host information unit log 111, a host parameter 112, and a host identifier 113 according to characteristics, and may further include other types.

Trainers perform training activities in various OSes according to training purposes, and each OS basically has built-in or provides a tool that provides system logs.

However, these system logs take a method of storing detailed information in a log field with each log format depending on the characteristics of the OS. The host information unit log 111 is a template that identifies and normalizes log fields that can be used to calculate combat effectiveness analysis indicators. The host parameter 112 is not a log by a dynamic system change collected by a tool, but an arbitrary designated variable value, and corresponds to a file path that needs to be constantly monitored in an analysis index, a specific threshold value, and the like. The host identifier 113 is a unit variable for distinguishing logs or indicators generated from different hosts when it is necessary to combine them.

According to an embodiment of the present invention, a normalized unit variable template is provided in the form of a database schema, and the user of the present invention can add content.

The analysis indicator constructing unit 120 constructs formulas for the plurality of analysis indicators using the unit variables.

Specifically, the analysis indicator configuration unit 120 is a tool for configuring formulas for combat effectiveness analysis indicators to be calculated using unit variables stored in the unit variable template database 110, and the types of indicators that can be configured are detection rules (121 ), host-specific calculation formula 122, and host-to-host calculation formula 123 may be provided.

The analysis indicator configuration unit 120 includes a detection rule generation unit, a host-specific analysis calculation formula configuration unit, and an inter-host analysis calculation formula configuration unit.

The detection rule generating unit creates a detection rule 121-n for detecting a specific point in time for calculating the analysis indicator.

Since the host information unit log 111 basically provides only general system detailed logs, detection rules (121 ) to configure a rule to detect a specific point in time.

The analysis calculation formula construction unit for each host configures the calculation formula 122-n for each host, which is an analysis calculation formula using the host information unit log or the value detected by the detection rule as a parameter.

The host-specific calculation formula 122 constitutes a combat effectiveness analysis index formula using a host information unit log or a value detected by a detection rule as a parameter.

The inter-host analysis calculation formula construction unit configures an inter-host calculation formula 123-n to be calculated by combining detection logs of a plurality of hosts.

The host-to-host calculation formula 123 is used to construct a combat effectiveness analysis index that must be calculated by combining detection logs of a plurality of hosts.

Thereafter, the analysis indicator configuration unit 120 writes the detection rule 121, the calculation formula for each host 122, and the calculation formula 123 between hosts, and stores them in the analysis indicator database 130, and the analysis indicator database 130 stores and manages the plurality of analysis indicators.

The analysis indicator database 130 uses the unit variable template database 100 to convert combat effectiveness analysis indicators created through the analysis indicator configuration unit 120 into indicators 130-1, 130-2, ... 130-N. It can be stored and managed as a unit.

3 is a diagram showing a scenario generation unit and a result analysis unit of an apparatus for analyzing combat effectiveness by virtual training according to an embodiment of the present invention.

FIG. 3 shows a scenario generation unit 200 that transmits combat effectiveness analysis indicators created using the components included in FIG. 2 and stored to a virtual battlefield host to be used for cyber training, and combat effectiveness analysis indicators in real time during cyber training. It shows the result analysis unit 300 for calculating.

Referring to FIG. 3 , the scenario generating unit 200 creates an analysis indicator scenario including a combat effect detection rule and an indicator calculation formula based on a plurality of pre-stored analysis indicators and the virtual reality network map information to generate the virtual reality network map scenario. forwarded to multiple hosts.

Specifically, the scenario generating unit 200 designates indicators to be used for training among combat effectiveness analysis indicators stored in the analysis indicator database 130 based on the network map information 10 to be analyzed and delivers them to the target host to calculate them. do what you do

In addition, the result analysis unit 300 according to an embodiment of the present invention, the result analysis unit 300 is an analysis index calculation unit operating in each virtual machine host 10-N of the virtual training environment network 10 It includes a host-to-host indicator calculation unit 320 operating in a separate system from 310 and an analysis indicator calculation result database 330 .

The virtual training environment network 10 according to an embodiment of the present invention is composed of N hosts (10-01, 10-02, ..., 10-N), and each host corresponds to one virtual machine.

Also, the number of hosts and connections between hosts may change according to training content. The virtual training environment network 10 refers to an environment provided by a cyber training system, which is an external system.

The result analysis unit 300 analyzes the combat effectiveness of the virtual training by using the training information stored in the host and the detection rule and index calculation formula transmitted to the host.

The analysis index calculation unit 310 calculates a primary analysis index based on the virtual training using training information stored in the host and the detection rule and index calculation formula transmitted to the host.

Specifically, the analysis index calculation unit 310 logs the system log generated by the system information collector 10-N-01 provided by each virtual machine host 10-N inside the virtual training environment network 10. Through normalization, it is converted into the unit log format held in the unit variable template database 110 to calculate the log corresponding to the detection rule and the combat effectiveness analysis index designated to be calculated in the corresponding host, and the resulting value is converted into the combat effectiveness analysis index calculation result database ( 330).

The host-to-host index calculation unit 320 calculates a combat effectiveness analysis index associated with each host based on the detection log transmitted from each host and the primary analysis index.

Specifically, the host-to-host indicator calculation unit 320 collects the detection log and the primary analysis indicator calculation result transmitted from each virtual machine host 10-N in the combat effectiveness analysis indicator calculation result database 330, and collects a plurality of hosts. Calculate the combat effectiveness analysis index in the form associated with , and store the resulting value in the combat effectiveness analysis index calculation result database 330 .

4 is a flowchart illustrating a method for analyzing combat effectiveness by virtual training according to an embodiment of the present invention.

Referring to FIG. 4 , the method for analyzing the combat effect by virtual training according to an embodiment of the present invention is performed by the apparatus for analyzing the combat effect by the trainee's virtual training through the virtual reality network in step S10. and the plurality of analysis indexes for analyzing results according to each virtual training are generated in advance.

Here, the step of generating a plurality of analysis indicators in advance (S10) includes providing a database schema for unit variables that can be used in calculations, and constructing formulas for the analysis indicators using the unit variables. and storing and managing the analysis index.

In addition, the step of constructing a formula for the analysis index may include generating a detection rule for detecting a specific point in time to calculate the analysis index, using a host information unit log or a value detected by the detection rule as a parameter. A step of constructing an analysis calculation formula, and a step of constructing an analysis index to be calculated by combining detection logs of a plurality of hosts.

Thereafter, in step S20, an analysis indicator scenario including a combat effect detection rule and an indicator calculation formula is generated based on a plurality of pre-stored analysis indicators and the virtual reality network map information, and transmitted to a plurality of hosts of the virtual reality network.

In step S30, the combat effectiveness of the virtual training is analyzed using the training information stored in the host and the detection rule and index calculation formula transmitted to the host.

Here, in the step of analyzing the combat effect by virtual training (S30), the first analysis index by the virtual training is calculated using the training information stored in the host and the detection rule and index calculation formula transmitted to the host. and calculating a combat effectiveness analysis index associated with the host based on a detection log transmitted from each host and the primary analysis index.

5 is a diagram for explaining a step of generating a plurality of analysis indicators in advance in a method for analyzing combat effects by virtual training according to an embodiment of the present invention.

FIG. 5 shows a sequence for writing a rule for calculating a combat effectiveness analysis index using each of the components included in FIG. 2 .

Specifically, the apparatus for analyzing combat effects identifies unit variables included in indicators that can represent the effects to be analyzed in step S110 and databases them in step S120.

The steps S110 and S120 and the work of writing the combat effectiveness analysis index calculation rules using them are performed separately from each other, and the result of normalizing the necessary variables and making a database is used to author the combat effectiveness analysis index. The analysis index configuration unit 120 stores the index calculation rule configured by inputting a formula for calculating a detection rule based on a threshold and a combat effectiveness analysis index in a database.

Specifically, in step S130, indicators for combat effectiveness analysis are designed, and in step S140, variable rules including indicators are input. Thereafter, formulas for calculating indicators are input in step S150, and combat effectiveness analysis indicators are databased in step S160.

6 is a diagram for explaining a step of analyzing combat effectiveness by virtual training in a method for analyzing combat effectiveness by virtual training according to an embodiment of the present invention.

FIG. 6 is for explaining the order in which each component described in FIG. 3 operates. Before the cyber training starts, the information of the virtual battlefield to be analyzed is received in step S210, and the battle effect analysis index required for calculation is connected to the virtual battlefield host in step S220, and the scenario generator 200 determines the battle to be calculated in the training. After specifying the effect analysis index, in step S230, the rule to be detected and the formula for calculating the combat effect analysis index are delivered to the host inside the virtual battlefield.

When the cyber training starts, in step S310, each virtual machine host (10-N) starts collecting system information, and in steps S320 to S360, the analysis index calculation unit 310 simultaneously or sequentially calculates the combat effectiveness analysis index (130-N). The combat effectiveness analysis index calculation value specified to be calculated during training during N) and the log value included in the detection rule are transferred to the combat effectiveness analysis index calculation result database 330 .

Specifically, in step S320, system logs are normalized into unit logs, and virtual machine/user information is added to system information in the form of unit logs in step S330.

Thereafter, logs subject to detection rules are identified in step S340, combat effectiveness analysis indicators are calculated in step S350, and logs to be collected and indicators calculated are transmitted in step S360.

Then, in steps S410 to S450, the combat effectiveness analysis index calculation, which requires information on a plurality of hosts, is calculated using the values transmitted by the inter-host index calculation unit 320 and stored in the combat effectiveness analysis index calculation result database 330. .

Specifically, when the calculation of the combat effectiveness analysis index is started in step S410, the index calculation formula to be used is called and initialized in step S420.

Thereafter, the log is received in step S430, an index is calculated by applying a formula in step S440, and the index calculated in step S450 is stored.

For example, if the combat effectiveness analysis index is designated as the average CPU usage, the collected data can be in the form of CPU_USAGE (double), and the calculation formula is AVG (CPU_USAGE).

And the collected data becomes the update value of CPU_USAGE in a certain unit (Example: 0.7846, 0.3543, 0.4455 is continuously collected every 5 seconds), and the combat effect analysis index can be saved by updating the data value added every 5 seconds.

In addition, as a computer-readable recording medium storing a computer program, the computer program provides a computer-readable recording medium containing instructions for causing a processor to perform a method for analyzing combat effectiveness by virtual training. can

Such computer readable media may include program instructions, data files, data structures, etc. alone or in combination. Program instructions recorded on the recording medium may be specially designed and configured for the present invention or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. - includes hardware devices specially configured to store and execute program instructions, such as magneto-optical media, and ROM, RAM, flash memory, etc. Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, as well as machine language codes such as those produced by a compiler. The hardware devices described above may be configured to act as one or more software modules to perform the operations of the present invention, and vice versa.

The above description is just one embodiment of the present invention, and those skilled in the art can implement it in a modified form without departing from the essential characteristics of the present invention. Therefore, the scope of the present invention should be construed to include various embodiments within the scope equivalent to those described in the claims without being limited to the above-described embodiments.

Claims (11)

In the device for analyzing the combat effect by virtual training through a virtual reality network,
a scenario generating unit generating an analysis indicator scenario including a combat effectiveness detection rule and an indicator calculation formula based on a plurality of pre-stored analysis indicators and the virtual reality network map information, and transmitting the scenario to a plurality of hosts of the virtual reality network;
A device for analyzing combat effectiveness by virtual training including a result analysis unit for analyzing combat effectiveness by virtual training using the training information stored in the host and the detection rule and index calculation formula transmitted to the host. . According to claim 1,
An apparatus for analyzing combat effects by virtual training, further comprising: an analysis index generation unit configured to pre-generate the plurality of analysis indexes for analyzing results according to each virtual training. According to claim 2,
The analysis indicator generating unit,
a unit variable template database providing a database schema for unit variables usable in operations;
an analysis indicator constructing unit that constructs formulas for the plurality of analysis indicators using the unit variables; and
An apparatus for analyzing combat effectiveness by virtual training including an analysis indicator database for storing and managing the plurality of analysis indicators. According to claim 3,
The unit variable is,
An apparatus for analyzing combat effectiveness by virtual training including at least one of a host information unit log, a host parameter, and a host identifier. According to claim 4,
The analysis indicator component,
a detection rule generating unit generating a detection rule for detecting a specific point in time for calculating the analysis index;
a host-specific analysis calculation formula configuration unit that configures a host-specific analysis calculation formula using a host information unit log or a value detected by the detection rule as a parameter;
An apparatus for analyzing combat effectiveness by virtual training comprising: an inter-host analysis calculation formula constructing unit constituting an inter-host analysis calculation formula to be calculated by combining detection logs of a plurality of hosts. According to claim 1,
The result analysis unit,
an analysis index calculator calculating a primary analysis index based on the virtual training using training information stored in the host and the detection rule and index calculation formula transmitted to the host; and
Analyzing combat effectiveness by virtual training including; an inter-host index calculation unit for calculating a combat effectiveness analysis index associated with each host based on the detection log transmitted from each host and the primary analysis index. device for. In the method for analyzing the combat effect by virtual training performed by a device for analyzing the combat effect by virtual training of a trainee through a virtual reality network,
generating an analysis indicator scenario including a combat effect detection rule and an indicator calculation formula based on a plurality of pre-stored analysis indicators and the virtual reality network map information, and transmitting the generated analysis indicator scenario to a plurality of hosts of the virtual reality network; and
Analyzing combat effectiveness by the virtual training using the training information stored in the host and the detection rule and index calculation formula transmitted to the host. According to claim 7,
Generating in advance the plurality of analysis indicators for analyzing results according to each virtual training; method for analyzing combat effectiveness by virtual training, further comprising. According to claim 8,
The step of generating the plurality of analysis indicators in advance,
providing a database schema for unit variables usable in operations;
constructing a formula for the analysis indicator using the unit variables; and
A method for analyzing combat effectiveness by virtual training comprising storing and managing the analysis index. According to claim 9,
The step of constructing a formula for the analysis index,
generating a detection rule for detecting a specific point in time for calculating the analysis index;
constructing an analysis calculation formula using a host information unit log or a value detected by the detection rule as a parameter;
A method for analyzing combat effectiveness by virtual training, comprising: configuring an analysis index to be calculated by combining detection logs of a plurality of hosts. According to claim 7,
The step of analyzing the combat effect by the virtual training,
Calculating a primary analysis index by the virtual training using training information stored in the host and the detection rule and index calculation formula transmitted to the host; and
Calculating a combat effectiveness analysis index in a form associated with the host based on the detection log transmitted from each host and the primary analysis index.

Images