KR20240055600A - A system for tagging security information and a method thereof - Google Patents

Abstract

The security information tagging system according to embodiments includes a security information analysis unit that analyzes security information and a security information tagging unit that tags security information in response to the decision results of the security information analysis unit, and the security information tagging unit automatically collects security information. It includes an automatic tagging unit that tags and a manual tagging unit that manually tags security information.

Description

Security information tagging system and tagging method {A SYSTEM FOR TAGGING SECURITY INFORMATION AND A METHOD THEREOF}

The following disclosure relates to a security information tagging system and tagging method for consistent security event analysis.

Security log information recorded in a security device is important cybersecurity information that records the permission or blocking of access actions entering a network subject to security management. However, analysis of security log information is an area that requires specialized knowledge such as digital forensics, and security event analysis by control personnel varies greatly from person to person.

Differences in expert knowledge of security events and differences in tagging methods among analysts may affect judgments about security events. For example, different tagging methods may be performed by different analysts for the same security event. Due to differences in tagging methods for each individual, it is difficult to analyze the collected security information, and the reliability of the analysis may be reduced due to the high possibility of human error.

In other words, consistent tagging is required regardless of individual differences in order to analyze security events and improve the reliability of the results. However, there is a problem that it is difficult to derive consistent analysis results as individual differences in expert knowledge and experience are large.

Therefore, technology is needed to reduce individual analysis deviations of security event analysts and facilitate consistent analysis.

The purpose of the embodiments disclosed below is to provide a security information tagging system and tagging method that enables consistent security event analysis, and a storage medium for storing a security information tagging program.

Another purpose of the embodiment disclosed below is to provide a security information tagging system and method that enables consistent tagging among analysts with different expertise in security event analysis, and a storage medium for storing a security information tagging program.

The security information tagging system according to embodiments includes a security information analysis unit that analyzes security information and a security information tagging unit that tags security information in response to the decision results of the security information analysis unit, and the security information tagging unit automatically collects security information. It includes an automatic tagging unit that tags and a manual tagging unit that manually tags security information.

Preferably, the security information analysis unit includes a similarity calculation unit that calculates the similarity of the security information, and an additional unit that determines whether additional information exists in parts other than the similar part of the security information in response to the similarity result calculated by the similarity calculation unit. Information detection department,

It includes an external threat information inspection unit that inspects external threat information in response to the judgment results of the additional information detection unit.

Preferably, the similarity calculation unit vectorizes the security information to calculate cosine similarity, and the additional information detection unit checks whether additional information exists in parts other than the similar part of the security information when the calculated cosine similarity is greater than an arbitrary threshold.

Also, preferably, the external threat information inspection unit checks whether the additional information includes external threat information when the additional information detection unit confirms that additional information exists.

Also, preferably, the automatic tagging unit performs tagging when the additional information detection unit confirms that no additional information exists or the external threat information inspection unit confirms that the additional information contains external threat information, and the manual tagging unit performs the calculation. Tagging is performed when the cosine similarity is below a certain threshold or when it is confirmed that there is no external threat information in the additional information.

Also, preferably, the manual tagging unit generates recommended tag information based on statistical information about security information and displays the color of the tag information based on the characteristics of the tag information. Additionally, statistical information about tag information is visualized.

A security information tagging method according to embodiments, comprising the step of analyzing security information and the step of tagging the security information in response to the determination result of the analysis step, and the step of analyzing the security information includes determining the similarity of the security information. It includes a step of calculating and determining whether there is similarity, a step of determining whether additional information exists in response to the similarity determination result, and a step of examining external threat information in response to the determination result of the presence of additional information.

According to the following embodiment, consistent security event tagging can be performed regardless of differences in individual expert knowledge, and as a result, consistent security event analysis results can be derived.

According to the following embodiment, data on security events can be accumulated based on consistent tagging data, and security events can be analyzed based on the accumulated data.

According to the following embodiment, tagging a security event is easy and the time and effort required for the task can be reduced. In other words, the efficiency of the control personnel's tagging work can be improved.

1 is a diagram showing an embodiment of a security information tagging system.
Figure 2 is a diagram illustrating an embodiment of a security information tagging method.
Figure 3 is a diagram illustrating a security information analysis method according to an embodiment.
Figure 4 is a diagram illustrating an additional SYNTAX confirmation method according to an embodiment.
Figure 5 is a diagram illustrating an additional SYNTAX confirmation method according to an embodiment.
Figure 6 is a diagram illustrating a method for confirming external threat information according to embodiments.
Figure 7 is a diagram illustrating UI/UX provided by a manual tagging unit according to embodiments.
Figure 8 is a diagram illustrating UI/UX provided by a manual tagging unit according to embodiments.
Figure 9 is a diagram illustrating UI/UX provided by a manual tagging unit according to embodiments.

Hereinafter, with reference to the attached drawings, embodiments of the present invention will be described in detail so that those skilled in the art can easily implement the present invention. However, the present invention may be implemented in many different forms and is not limited to the embodiments described herein. In order to clearly explain the present invention in the drawings, parts unrelated to the description are omitted, and similar parts are given similar reference numerals throughout the specification.

Throughout the specification, when a part is said to “include” a certain element, this means that it may further include other elements rather than excluding other elements, unless specifically stated to the contrary.

Figure 1 is a diagram showing an embodiment of a security information tagging system 100 (hereinafter referred to as “tagging system”). Figure 2 is a diagram showing an embodiment of a security information tagging method (hereinafter referred to as “tagging method”). The tagging method of FIG. 2 may be performed by the tagging system 100 of FIG. 1.

The tagging system 100 or tagging method according to embodiments can consistently analyze security events despite differences in individual characteristics of security control personnel. Therefore, tag recommendation and automation are possible by generating standardized security event analysis data. In addition, the tagging system 100 or method can improve the threat analysis ability and threat detection performance of the security system by managing and utilizing the generated analysis data as a basis for detection of true positives, false positives, or false positives.

Referring to Figure 1, the security information tagging system 100 includes a security information collection unit 130, a security information analysis unit 110, a security information tagging unit 120, an external threat information collection and analysis unit 140, and/ Alternatively, it may include a database 150.

The database 150 stores analysis results or tagging history for security information, and can generate, transmit, and receive related information to assist tagging operations.

The security information collection unit 130 collects security information (or security events) from the security control system. Security information collected in the security information collection unit 130 may be transmitted to the security information analysis unit 110 and used for security information analysis.

The security information analysis unit 110 analyzes the security information collected by the security information collection unit 130. The security information analysis unit 110 may include a similarity calculation unit 112, an additional information detection unit 114, and/or an external threat information inspection unit 116.

The similarity calculation unit 112 calculates the similarity between security information (or, it may be referred to as payload) with security information that already has a tagging history, and determines whether it is similar. Security information with tagging history can be retrieved from the database 150.

Step S122 in FIG. 2 represents the similarity judgment performed by the similarity calculation unit 112. In the tagging method according to embodiments, if the answer is YES in step S122, step S124 is performed, and if the answer is NO, security information can be manually tagged in step S130.

Figure 3 illustrates the security information analysis process of the similarity calculation unit 112 according to embodiments. Referring to Figure 3, the similarity calculation unit 112 already has a tag history and other security information A', A' (302), B, C, D, E, ... (303). ) Determine the similarity of .

When determining similarity, security information (or payload) is vectorized based on TF-IDF (Term Frequency - Inverse Document Frequency). Vectorization may include one-hot encoding method and word embedding method. The similarity calculation unit 112 vectorizes the security information and determines the similarity by calculating Jaccard Similarity, Cosine Similarity, Euclidean Similarity (L2 Distance), or Manhattan Similarity (L1 Distance). You can. Preferably, the similarity calculation unit 112 vectorizes the security information based on TF-IDF and then determines similarity by calculating cosine similarity.

When determining similarity in the similarity calculation unit 112, the similarity may be compared with an arbitrary threshold value. The similarity calculation unit 112 may determine similarity if the calculated similarity value is greater than a certain threshold, and dissimilarity if the calculated similarity value is less than or equal to a certain threshold.

Figure 3 is an example of a similar judgment process in which 90% is set as an arbitrary threshold.

Referring to FIG. 3, security information A (301) with tag history and other security information (or payload) A', A` (302), B, C, D, E, ... (303) As a result of judging the similarity, A' and A` (302) are judged to be similar because they have a similarity of over 90% with A, and the remaining security information B, C, D, E, ... (303) have a similarity of 90% with A. Since it is less than %, it can be judged as dissimilar.

The next process (S124 in FIG. 2) described later is performed for A' and A` that are judged to be similar to A, and manual tagging is performed for B, C, D, E, ... that are judged to be dissimilar to A. It can be (S130 in FIG. 2). Next, a similarity determination can be made between security information B (305), for which tag history has occurred through manual tagging, and other security information C (306), D, E, ... (307). For example, after manual tagging of security information B (305), a similarity judgment is performed between B (305) with tag history and other security information C (306), D, E, ... (307), Automatic tagging or manual tagging may be performed in response to the similarity determination result.

The additional information detection unit 114 determines whether there is additional syntax (SYNTAX) in parts other than the similar parts with respect to the security information determined to be similar in the similarity calculation unit 112. That is, the additional information detection unit 114 determines whether there is other logic in parts other than similar parts. This may correspond to step S124 in FIG. 2. If the existence of another syntax (SYNTAX) is not confirmed in step S124 (NO), the security information tagging unit 120 automatically tags the corresponding security information (S130 in FIG. 2). If the existence of another syntax is confirmed in step S124 (YES), step S126 may be performed.

If other logic exists in the security information other than the part similar to the security information that already has a tag history, it is checked because it indicates that other malicious actions may occur due to the logic. The additional information detection unit 114 can check the syntax of various grammars such as php, phython, .NET, NodeJS, java, ruby, swift, and go.

Figure 4 is a diagram illustrating a method for checking additional syntax (SYNTAX) according to an embodiment.

Referring to FIG. 4, (a) represents security information (401, A) that already has a tag history, and (b) represents security information (402, A') that has additional syntax (SYNTAX) in addition to similar parts. . In (b) of FIG. 4, area 403 may be determined to have additional syntax in addition to the similar portion. If the additional information detection unit 114 determines that additional syntax exists (YES), step S126 of FIG. 2 is performed.

Figure 5 is a diagram illustrating a method for checking additional syntax (SYNTAX) according to an embodiment.

Referring to FIG. 5, it may be determined that the security information 501 (A′) does not have additional syntax (SYNTAX) in the portion 502 other than the similar portion. If no additional syntax is present, it can be considered custom encoding, brute force, or encryption. If the additional information detection unit 114 determines that no additional syntax exists (NO), security information may be automatically tagged in step S130 of FIG. 2.

The above-described method of verifying additional information (or additional syntax) can verify syntax by segmenting the payload based on square brackets, braces, and parentheses. In other words, it can be determined whether there is additional information or syntax for the segmented payload. Among segmented payloads (or strings included in the payload), payloads containing content similar to previously tagged content are excluded. If there is a change in the dissimilar payload portion compared to the previously tagged content, but no syntax or logic exists, the content corresponds to a variable/argument value (brute force or shell code transmission) or is detected at the network end. It may be considered an evasion activity (encryption, custom payload) and automatically tagged.

Meanwhile, the external threat information inspection unit 116 determines whether data related to external threat information exists with respect to the security information for which the additional information detection unit 114 determines that additional syntax exists.

External threat information refers to information about cyber threats collected from outside the system through CTI (Cyber threat intelligence), etc. External threat information may include payload_bin of an artifact in the STIX format or characteristic infection signals detected when analyzing a secured malicious file. External threat information can be collected and analyzed by the external threat information collection and analysis unit 140. The external threat information collection and analysis unit 140 collects and analyzes external threat information and provides external threat information that can be analyzed or judged by the security information analysis unit 110.

The external threat information inspection unit 116 may perform step S126 of FIG. 2. If there is additional syntax in parts other than the similar part of the security information, the external threat information inspection unit 116 checks whether there is external threat information in the additional syntax. If there is no external threat information, the security information is manually tagged as in step S130 of FIG. 2, and if there is external threat information, the security information is automatically tagged as in step S130 of FIG. 2.

Figure 6 is a diagram illustrating a method for confirming external threat information according to embodiments.

Referring to FIG. 6, it is shown that external threat information 602 is present in the additional syntax portion of the security information 601 (A'). The external threat information collection and analysis unit 140 can store a list 603 of the collected external threat information, and the external threat information inspection unit 116 checks whether external threat information is included in the security information based on the list 603. You can judge whether or not.

When explaining the security information analysis unit 110 according to the above-mentioned contents in FIGS. 1 to 6, the security information analysis unit 110 includes a similarity calculation unit 112, an additional information detection unit 114, and/or an external threat information inspection unit. It may include (116). As shown in Figure 2, the security information analysis unit 110 performs the step of analyzing security information (S120). Here, the step of analyzing the security information (S120) is step S122 of calculating the similarity of the security information to determine whether it is similar, step S124 of determining whether additional syntax exists in addition to the similar part, and/or determining the presence of external threat information. Includes step S126. The similarity calculation unit 112 may perform step S122, the additional information detection unit 114 may perform step S124, and the external threat information inspection unit 116 may perform step S126.

The security information tagging unit 120 tags security information in response to the analysis results performed by the security information analysis unit 110. The security information tagging unit 120 includes an automatic tagging unit 122 and a manual tagging unit 124, and the manual tagging unit 124 may include a tagging auxiliary unit 1241.

Tagging refers to displaying security information (or payload) in a specific way. More specifically, for a specific string included in security information, the string can be displayed in a specific way according to the meaning of the string. Tag display can be distinguished in various ways, such as color, keyword, and font.

The automatic tagging unit 122 automatically tags security information. Referring to Figure 2, if the security information is similar to security information that already has a tag history and there is no additional syntax in parts other than the similar part, automatic tagging is performed. Additionally, if the security information is similar to security information that already has a tag history, additional syntax exists in parts other than the similar part, and there is external threat information in the additional syntax, automatic tagging is performed.

The manual tagging unit 124 manually tags security information. In other words, tagging of security information can be performed by the user. The manual tagging unit 124 provides UI/UX components or functions for users to perform tagging. The manual tagging unit 124 includes a tagging auxiliary unit 1241, and the tagging auxiliary unit 1241 can generate and provide UI/UX components and functions that can assist manual tagging, and related information.

Referring to Figure 2, if the security information is not similar to security information that already has a tag history, manual tagging is performed. Additionally, if the security information is similar to security information that already has a tag history and there is additional syntax in parts other than the similar part, but there is no external threat information in the additional syntax, manual tagging is performed.

Figure 7 is a diagram illustrating UI/UX provided by the manual tagging unit 124 according to embodiments.

The manual tagging unit 124 can perform tagging on the basis of true/false positives of security information. The manual tagging unit 124 may provide a UI/UX screen 701 or functions for the user to perform tagging tasks. The manual tagging unit 124 provides a function to display colors (or visual expressions such as saturation and brightness) differently depending on the type of tag, allowing users to easily distinguish tagged content. The manual tagging unit 124 provides a function for the user to tag a string of security information by clicking and dragging (703). Additionally, the manual tagging unit 124 displays recommended tag information for a string clicked or dragged by the user (704), and can generate and visualize statistical information about the string. Additionally, the manual tagging unit 124 may provide a separate input window where the user can input the basis for tagging.

Figure 8 is a diagram illustrating UI/UX provided by the manual tagging unit 124 according to embodiments.

The manual tagging unit 124 may provide an interface as shown in FIG. 8 when the user performs tagging. At this time, the tagging auxiliary unit 1241 supports manual tagging of security information. The manual tagging unit 124 can generate recommended tag information and display visual expressions differently depending on the characteristics of the tag information. The manual tagging unit 124 can display a detailed information screen as shown in FIG. 8 when the user moves the mouse cursor to a string with a tagging history. The detailed information screen visualizes statistical information, tag history, and related external information about the string.

The manual tagging unit 124 may analyze tag history information and display statistical information about the string clicked or dragged by the user. For example, the manual tagging unit 124 may display a graph 801 showing the tagging frequency for the corresponding string during a specific period. Additionally, the manual tagging unit 124 may display a graph 802 showing the ratio of the number of tags for the corresponding string to the total number of tags. The manual tagging unit 124 can display recommended tag information for the string that the user clicks or places the cursor on (803). Recommended tag information may be displayed along with tagging history and related external information. For example, information such as “wordpress, php, CVE-2021-26609, tagged 242 times in the last month, previous detection basis: waypoint abuse..” may be displayed along with recommended tag information.

Statistical information according to embodiments may include statistical information indicating the tagging frequency by security event, period, and institution. The manual tagging unit 124 can recommend tag information based on statistical information. The manual tagging unit 124 may recommend tag information by analyzing tag history information using clustering or NLP (Natural Language Processing). Tag information may be tag characters to which a specific color, brightness, or saturation has been applied.

Statistical information for each security event indicates the frequency of tags for specific events, such as specific vulnerabilities and specific IPs. Therefore, there is an advantage in tagging security events that occur due to attacks performed by a specific group.

Statistical information by period indicates the frequency of tags that occurred during a specific period. Period-specific statistical information has the advantage of tagging security events that occurred in a short period of time.

Statistical information by organization indicates the tag frequency of security events that occurred in a specific organization. Agency-specific statistical information has the advantage of tagging security events that occurred over a long period of time.

Figure 9 is a diagram illustrating UI/UX provided by the manual tagging unit 124 according to embodiments.

When the user drags a specific string of security information, the manual tagging unit 124 generates a HEX value (or binary number, octal number, decimal number, etc.) corresponding to the string and a decoded string (e.g., A function can be provided to highlight and display ASCII code strings. For example, in FIG. 9 , when the user drags the string 901 called “convenient” with the mouse, the HEX value 902 corresponding to “convenient” may also be highlighted. The user can perform tagging by dragging the string 901 to a specific area 903 and selecting one of the recommended tagging information (tag1, tag2, tag3) for the string 901.

As another embodiment, when the user drags the string 901 called “convenient” with the mouse, the HEX value 902 corresponding to “convenient” is highlighted, and at the same time, recommended tagging information for the string 901 (tag1, tag2, tag3) 905 may be displayed in pop-up format. The user can select any one of the displayed recommended tagging information, and the selected string and the corresponding HEX value and tag can be automatically entered into the screen input window.

The tagging auxiliary unit 1241 can support the manual tagging unit 124 in providing UI/UX configuration, functions, and statistical information for the user to perform tagging. For example, the tagging auxiliary unit 1241 may perform an operation to generate information displayed by the manual tagging unit 124 or provide a function.

Referring to FIG. 1, the tagging system 100 is expressed conceptually or logically. However, the components of the tagging system 100 may not be physically separated, and may be a device that performs a tagging method using one or more processors, one or more memories, and instructions stored in the memory.

The tagging method according to embodiments may be written as a software program and stored in a computer-readable recording medium. The operation of the invention according to the embodiments includes code that can be implemented, implemented, or executed by a “computer” (a comprehensive concept including a system on chip (SoC) or microprocessor, etc.), or storing or storing the code. It may also be provided as an application, computer-readable storage medium, or computer program product.

A detailed description of preferred embodiments of the invention is provided to enable any person skilled in the art to make or practice the invention. Although the present invention has been described above with reference to preferred embodiments, those skilled in the art may make various modifications and changes to the present invention without departing from the scope of the present invention. For example, a person skilled in the art may use each configuration described in the above-described embodiments by combining them with each other.

Accordingly, the present invention is not limited to the embodiments shown herein, but should be understood in its broadest technical spirit, including the principles and novel features disclosed herein.

Claims (16)

As a security information tagging system,
Security Information Analysis Department, which analyzes security information; and
It includes a security information tagging unit that tags the security information in response to the decision result of the security information analysis unit,
The security information tagging unit,
Comprising an automatic tagging unit that automatically tags the security information and a manual tagging unit that manually tags the security information,
Security information tagging system. According to clause 1,
The security information analysis department,
A similarity calculation unit that calculates the similarity of the security information,
an additional information detection unit that determines whether additional information exists in parts other than the similar part of the security information in response to the similarity result calculated by the similarity calculation unit;
Comprising an external threat information inspection unit that inspects external threat information in response to the judgment result of the additional information detection unit,
Security information tagging system. According to clause 2,
The similarity calculation unit,
The security information is vectorized to calculate cosine similarity,
The additional information detection unit,
When the calculated cosine similarity is greater than an arbitrary threshold, it is checked whether additional information exists in parts other than the similar part of the security information.
Security information tagging system. According to clause 3,
The external threat information inspection department,
When the additional information detection unit confirms that the additional information exists, it checks whether the additional information contains external threat information.
Security information tagging system. According to clause 4,
The automatic tagging unit,
Tagging is performed when the additional information detection unit confirms that the additional information does not exist or when the external threat information inspection unit confirms that the additional information contains external threat information,
The manual tagging unit,
Tagging is performed when the calculated cosine similarity is below a certain threshold or when it is confirmed that there is no external threat information in the additional information.
Security information tagging system. According to clause 5,
The manual tagging unit,
Generate recommended tag information based on statistical information about the security information,
Displaying the color of the tag information based on the characteristics of the tag information,
Security information tagging system. According to clause 6,
The manual tagging unit,
Visualizing statistical information about the tag information,
Security information tagging system. According to clause 7,
The above statistical information is,
Including the frequency of the tag information occurring during a certain period of time,
Security information tagging system. According to clause 8,
The manual tagging unit,
In response to the user's drag or click input, displaying the HEX value and the decoded string for the dragged or clicked string together, and displaying the recommended tag information for the dragged or clicked string,
Security information tagging system. In the security information tagging method,
Analyzing security information,
A step of tagging security information in response to the determination result of the analysis step,
The step of analyzing the security information is,
Calculating the similarity of the security information and determining whether it is similar;
A step of determining whether additional information exists in response to the similarity determination result;
Including the step of examining external threat information in response to the result of determining whether additional information exists,
How to tag security information. In claim 10,
The step of determining whether the similarity is
The security information is vectorized based on TF-IDF and cosine similarity is calculated to determine similarity.
How to tag security information. In claim 11,
The step of determining whether the additional information exists is,
When the calculated cosine similarity is greater than a certain threshold, checking whether additional information exists in parts other than the similar part of the security information,
How to tag security information. In claim 12,
The step of examining the external threat information is,
If the additional information exists, check whether the additional information contains external threat information,
How to tag security information. In claim 13,
The tagging step is,
If the additional information does not exist and the external threat information exists, tagging is automatically performed,
Manually performing tagging when the calculated cosine similarity is below the arbitrary threshold or when the external threat information does not exist,
How to tag security information. In claim 14,
The tagging step is,
When manually tagging, generate recommended tag information for the security information and visualize statistical information about the tag information.
How to tag security information. 1) Calculating the degree of similarity for security information and determining whether it is similar;
2) confirming additional information in response to the calculated similarity determination result;
3) checking the presence or absence of external threat information in response to the presence or absence of the additional information; and
4) Performing the step of automatically or manually tagging the security information in response to the determination results of steps 1), 2), and 3),
A recording medium in which the security information tagging program is stored.