Method for determining threat scenario

Abstract

To provide a method for determining a threat scenario using a generative AI.SOLUTION: A method includes: selecting a plurality of target API events from user's API event information obtained in a cloud environment, according to a predetermined condition; mapping each of the target API events to threat behaviors classified by type; determining at least one threat behavior set including at least one of the threat behaviors; determining at least one candidate scenario out of a plurality of reference scenarios stored in advance in a database, on the basis of the threat behavior set; calculating security index information by comparing the candidate scenario with the threat behavior set; determining an expected threat scenario out of the candidate scenarios on the basis of the security index information; and providing solution information to a user terminal on the basis of the expected threat scenario.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a method for determining threat scenarios using generative AI, and more specifically, to a method for generating a number of suspected threat scenarios based on the pattern recognition and learning capabilities of AI, precisely evaluating the generated threat scenarios, and then providing a solution generated based on the results of the evaluation, thereby providing a preemptive solution to users prior to a cyber attack. [Background technology]

[0002] Generally, measures to defend and respond to cyber attacks are implemented as network device and application level solutions, and system logs are kept for audit purposes and in the event of an intrusion, for incident analysis and response.

[0003] Defense against cyber attacks using network devices includes network devices such as routers and switches, general-purpose network security devices such as intrusion detection systems (IDS) and firewalls, and application-level network security devices such as web application firewalls (WAF) and anti-DDoS equipment.

[0004] Application level solutions to defend against cyber attacks include Digital Rights Management (DRM) and Anti Virus (AV).

[0005] Recently, cyber attacks have become more frequent and sophisticated. Examples of such cyber attacks include Advanced Persistent Threat (APT), which targets specific organizations for long periods of time and sustains attacks to achieve a goal such as data theft, and Denial of Service (DoS) attacks / Distributed Denial of Service attacks.

[0006] Therefore, methods for defending against and responding to cyber attacks have evolved to analyze and respond to information collected from various security solutions and system logs. Examples include an enterprise security management system (ESM) and a security information and event system (SIEM).

[0007] In addition, technologies are being developed to integrate and manage various logs in a manner similar to company-wide security management systems and security information event systems, to search and query logs, understand system status, and detect and respond to various cyber attacks.

[0008] However, current cyber attack defense measures are limited in that they do not allow for accurate recognition of the situation in cyberspace, making it difficult to effectively defend against and respond to cyber attacks.

[0009] In particular, today's cyber attacks are no longer limited to one-time attacks, but tend to involve attackers using various attack methods in sequence over a long period of time to achieve their goals. Therefore, in order to effectively defend against and respond to such cyber attacks, it is becoming more important to accurately recognize the current cyberspace situation and implement preemptive responses to cyber attacks.

[0010] Therefore, the need to effectively defend against scenario-based cyber attacks, provide solutions, and implement preemptive responses to attacks has been emphasized, as scenario-based multi-stage attack analyses have recently been emerging. [Prior art documents] [Patent documents]

[0011] [Patent Document 1] Republic of Korea Patent Publication No. 10-2015-0008158 (2015.01.21) Summary of the Invention [Problem to be solved by the invention]

[0012] The purpose of the present invention is to determine solutions regarding dangerous scenarios of attackers based on generative AI and provide them to users. [Means for solving the problem]

[0013] The method for determining a threat scenario of the present invention includes the steps of determining a plurality of target API events according to predetermined conditions from among API event information of a user acquired in a cloud environment (wherein the predetermined conditions are associated with at least one of an event frequency, a temporal distribution, an occurrence location, an associated user, and an API event type); mapping each of the plurality of target API events to a threat act classified by type; determining at least one threat act set including at least one threat act from among the plurality of threat acts; determining at least one candidate scenario from among a plurality of reference scenarios pre-stored in a database based on the threat act set; calculating security indicator information for the candidate scenarios by comparing the threat act set; determining a predicted threat scenario from among the candidate scenarios based on the security indicator information; and providing solution information to a user terminal based on the predicted threat scenario.

[0014] In one embodiment of the present invention, the type of detailed classification of the threat behavior may include tactical group information, technique information, and detailed technique information (wherein the tactical group is a higher-level concept including at least one of the techniques, and the technique is a higher-level concept including at least one of the detailed techniques).

[0015] In an embodiment of the present invention, the security index information may include consistency information and risk information.

[0016] In one embodiment of the present invention, the similarity information may be calculated based on the relevance of types of threat behaviors included in the candidate scenarios.

[0017] In one embodiment of the present invention, the type of detailed classification of the threat behavior includes tactical group information, technique information, and detailed technique information (wherein the tactical group is a higher-level concept including at least one of the techniques, and the technique is a higher-level concept including at least one of the detailed techniques), and the relevance of the type can be calculated by calculating an index corresponding to the relevance of the type based on whether or not there is a match between the tactical group information, technique information, and detailed technique information included in the type of detailed classification of the threat behavior included in the candidate scenario.

[0018] In one embodiment of the present invention, the security indicator information includes risk information, and the multiple reference scenarios pre-stored in the database each include a corresponding risk indicator, and the risk information can be calculated based on progress information generated by comparing the risk indicators, the set of threat behaviors, and the threat behaviors included in the candidate scenarios.

[0019] In one embodiment of the present invention, the multiple reference scenarios pre-stored in the database may be scenarios consisting of at least some threat behaviors selected from the multiple techniques included in a threat behavior analysis matrix (wherein the threat behavior analysis matrix is ​​composed of multiple tactical groups and at least one technique included in the tactical group).

[0020] In one embodiment of the present invention, the step of determining the candidate scenarios determines the candidate scenarios further based on a type of cyber attack step, the type of cyber attack step including a pre-step, an attack step, and a subsequent step based on a Cyber ​​Kill Chain model, the order of each being determined by the order of chronological occurrence or causal relationship, and the threatening act may correspond to at least one of the types of cyber attack steps.

[0021] In one embodiment of the present invention, the solution information may be determined based on a type of the cyber attack step corresponding to the most recently occurred threat action among the predicted threat scenarios.

[0022] In one embodiment of the present invention, if the cyber attack step type corresponds to the pre-step, a warning against an initial infiltration attempt and a defense plan can be provided to the user; if the cyber attack step type corresponds to the attack step, detailed information about an ongoing attack and a response plan can be provided to the user; if the cyber attack step type corresponds to the subsequent step, threats that may occur after the attack, preventive measures, and recovery plans can be provided to the user.

[0023] In one embodiment of the present invention, at least one of the predetermined conditions may be determined according to a type of the cyber-attack step.

[0024] In one embodiment of the present invention, the step of determining the set of threat activities further includes a step of classifying the threat activities according to classification conditions associated with at least one of the frequency of occurrence of the threat activities, their temporal distribution, the location of occurrence, and associated users, and the set of threat activities may be composed of threat activities determined according to the same classification conditions.

[0025] In one embodiment of the present invention, the method may include the steps of acquiring weight information corresponding to the classification conditions from the user terminal, and changing threshold information that determines the range of the classification conditions based on the weight information.

[0026] In one embodiment of the present invention, the set of threat behaviors may be determined based on an artificial intelligence-based classification algorithm, and the classification algorithm may include at least one of machine learning, deep learning, and reinforcement learning.

[0027] In one embodiment of the present invention, the database stores relationship information regarding the time intervals and causal relationships between threat acts included in each of the reference scenarios, and the step of determining the set of threat acts can be determined based on the relationship information. Effect of the Invention

[0028] The method of judging threat scenarios using generative AI of the present invention has the advantage of effectively defending against scenario-based cyber attacks, providing solutions, and implementing preemptive responses to attacks by performing scenario-based multi-stage attack analysis based on generative AI. [Brief description of the drawings]

[0029] [Figure 1] 1 illustrates an example of a network environment according to an embodiment of the present invention. [Diagram 2] 1 is a flowchart illustrating a method for determining a threat scenario according to an embodiment of the present invention. [Diagram 3]1 is a table illustrating threatening behaviors classified by type according to an embodiment of the present invention. [Figure 4] 1 is a table illustrating threatening behaviors classified by type according to an embodiment of the present invention. [Diagram 5] 1 is a diagram illustrating an example of a threat behavior analysis matrix according to an embodiment of the present invention. [Figure 6] 1 is a table illustrating a number of pre-stored reference scenarios according to an embodiment of the present invention. [Figure 7] 1 is a diagram illustrating a method for determining a threat scenario according to an embodiment of the present invention. [Figure 8] 1 is a diagram illustrating a method for determining a threat scenario according to an embodiment of the present invention. [Figure 9] 11 is a flowchart illustrating a method for determining a threat scenario according to another embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0030] Hereinafter, the embodiments disclosed herein will be described in detail with reference to the accompanying drawings, and the same and / or similar components will be given the same reference numerals regardless of the drawing numbers, and redundant description thereof will be omitted. In addition, in describing the embodiments disclosed herein, if a detailed description of related known technology is determined to make the gist of the embodiments disclosed herein unclear, the detailed description thereof will be omitted.

[0031] Terms including ordinal numbers such as first, second, etc. may be used to describe various components, but the components are not limited by the terms. The terms are used only to distinguish one component from another.

[0032] A singular expression includes a plural expression unless the context clearly dictates otherwise.

[0033] In this application, the steps described may be performed in any order relative to the order listed, unless a specific causal relationship dictates that the steps be performed in the order listed.

[0034] In this application, the terms "comprise" or "have" and the like are intended to specify the presence of features, numerals, steps, operations, components, parts, or combinations thereof set forth in the specification, but should be understood as not precluding the presence or additional possibility of one or more other features, numerals, steps, operations, components, parts, or combinations thereof.

[0035] The present invention will now be described with reference to the accompanying drawings.

[0036] FIG. 1 illustrates an example of a network environment according to an embodiment of the present invention.

[0037] The network environment according to one embodiment shown in FIG. 1 may include a cloud server 10, a database 20, a user terminal 30, an AI engine 40, and a main server 50.

[0038] In this case, the cloud server 10, the database 20, the user terminal 30, the AI ​​engine 40, and the main server 50 can be connected to each other through communication, i.e., a network. Here, the network is not limited in terms of communication method, and can include not only communication methods that utilize communication networks (e.g., mobile communication networks, wired Internet, wireless Internet, and broadcasting networks) that the network can include, and electrical signals (analog signals, digital signals, serial signals, and Pulse Width Modulation), but also short-range wireless communication.

[0039] The cloud server 10 refers to a server for cloud services, which are services that are outsourced to an external party without having to place servers and storage devices within a company. Here, the cloud server 10 can include public data centers (Amazon AWS, Microsoft Azure) for public (open) clouds and in-house data centers for private (closed) clouds.

[0040] The cloud server 10 may be implemented as a computer device or multiple computer devices that provide instructions, codes, files, contents, services, etc. The cloud server 10 may communicate with other servers and terminals that configure the system and transmit and receive information through a network.

[0041] Such a cloud server 10 can store all data and infrastructure of users using the server, and in this case, a particular user or user group can use only one cloud server 10, but can also use multiple cloud servers 10.

[0042] In this case, preferably, when multiple cloud servers 10 are used, a separate integrated control center for managing data distributed and stored in the multiple cloud servers 10 can be provided, and more preferably, the main server 50 described below can act as the integrated control center.

[0043] The user terminal 30 is an entity that connects to data of a specific company or organization and reads and writes data stored in the cloud server 10. In this case, the user terminal 30 that is permitted to connect to the corresponding cloud server 10 may generally be a member of the company, organization, or group, and when a user who is not permitted to connect connects to the cloud server 10 of the corresponding company, organization, or group, this is called a cyber threat or attack, i.e., hacking.

[0044] The user terminal 30 may be implemented as a computer device or multiple computer devices that provide instructions, codes, files, contents, services, etc. The cloud server 10 may communicate with other servers that configure the system and transmit and receive information through the terminal and network.

[0045] The database 20 serves as a storage medium for storing data, and preferably, in the present invention, the database 20 can store a plurality of reference scenarios, which are cyber threats, i.e., hacking scenarios.

[0046] Such database 20 may be embodied as a computer device or multiple computer devices that provide instructions, codes, files, contents, services, etc. Also, database 20 may communicate with other servers and terminals that constitute the system through a network to transmit and receive information.

[0047] Additionally, it may store actions (defensive measures) that cyber threat defenders (administrators) can take to prevent and detect attacks, and / or information on publicly named hacking groups and analysis of attack techniques.

[0048] Here, a reference scenario is a process that outlines the steps that an attacker would take to carry out a cyber-attack, and lists in chronological order the actions that the attacker would take at each step.

[0049] Therefore, the database 20 can basically store reference scenarios for past hacking, i.e., threat attacks, and preferably, the reference scenarios can be a sequence of various tactics, techniques, and procedures (TTPs) included in the threat behavior analysis matrix stored in MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) based on attack patterns actually used by cyber attackers.

[0050] MITRE ATT&CK is a cybersecurity knowledge base created by the MITRE Corporation, and can be composed of tactics that include categories for cyber attacker goals and each step, and techniques, which are specific methods for each tactic.

[0051] Thus, a threat action is included in at least one Tactic group and corresponds to at least one Technique included in the Tactic group.

[0052] In addition, the reference scenarios pre-stored in the database 20 are data that are classified and listed by analyzing the adversary behaviors used by attackers from the perspective of tactics and techniques after observing actual cyber attack cases, and classifying and listing information on the attack techniques of various attack groups.

[0053] Specifically, a threat scenario includes at least one technique, which is each step in a method for an attacker to achieve at least one tactic group, which is an attack goal.

[0054] For example, types of threat behaviors that correspond to a Technique could include Spearphishing via Email, Drive-by Compromise, Credential Dumping, Man-in-the-Middle (MitM), and Command and Control over alternative protocol.

[0055] The AI ​​engine 40 refers to a conventional artificial intelligence (AI) engine and may refer to various AI engines 40 provided in the past, but preferably, in the present invention, the AI ​​engine refers to a generative AI, and artificial intelligence described below will be understood to have the same meaning as the AI ​​engine 40.

[0056] The AI ​​engine 40 may be embodied as a computer device or multiple computer devices that provide instructions, codes, files, contents, services, etc. Alternatively, the AI ​​engine 40 may communicate with other servers and terminals that constitute a system and transmit and receive information through a network.

[0057] As described above, the main server 50 performs integrated control functions for multiple cloud servers 10, while also detecting and analyzing cyber threats and providing various prompts to authorized user terminals 30, i.e., the user terminals 30 of defenders (administrators).

[0058] The main server 50 may be implemented as a computer device and / or multiple computer devices that provide instructions, codes, files, contents, services, etc. The main server 50 may communicate with other servers and terminals that configure the system and transmit and receive information through a network.

[0059] FIG. 2 is a flowchart illustrating a method for determining a threat scenario according to an embodiment of the present invention.

[0060] In step S110, the main server 50 determines a plurality of target API events according to a predetermined condition from among the API event information of the user acquired in the cloud environment.

[0061] Here, the API event information may be an API interaction such as a user's API call and / or a response thereto, For example, the API event information may include an endpoint (URL) used in the API call, an HTTP method, a request, a response payload, and an event occurrence time.

[0062] The main server 50 determines a plurality of target API events according to predetermined conditions from among the API event information acquired from the cloud server 10 .

[0063] Here, the predefined conditions may be associated with at least one of the frequency of the event, its time distribution, the location of the event, the associated user, and the type of the API event.

[0064] For example, when it is determined based on the frequency of an event, the frequency of an API event may be calculated, the amount of the event occurring for a certain period of time may be estimated, and the period during which the frequency is higher than a certain threshold may be set as the condition.

[0065] For example, in the case of being determined based on a time distribution, the occurrence time of API events can be tracked, patterns can be confirmed, and a characteristic time period during which events occur intensively can be set as a condition.

[0066] For example, if determined by location of occurrence and associated user, the condition may be that the API event in question occurred in a particular region and the event occurred in the associated user account.

[0067] For example, in the case of being determined based on the type of API event, event types such as a login request, data modification, and data deletion can be identified, and a specific event type can be set as a condition.

[0068] In step S120, the main server 50 maps each of the target API events to a threat behavior classified according to its type. Here, mapping refers to a process or result of associating an element of one set with an element of another set. Specifically, it may be a process of determining whether to link the target API event with a threat behavior.

[0069] The database 20 classifies and stores each piece of API event information according to its type into MITRE ATT&CK TTPs, and the main server 50 can map the target API event to which threat activity it corresponds using the classification system stored in the database.

[0070] For example, API event information including "login failure" can be mapped to attack types such as "password cracking" and "brute force attack."

[0071] For example, an API event that includes "data deletion" can be mapped to an attack type such as "data destruction" and / or "insertion / corruption."

[0072] In step S130, the main server 50 determines at least one threat behavior set including at least one threat behavior among the plurality of threat behaviors.

[0073] A plurality of threat actions may be determined as a threat action set according to a specific threat action pattern or scenario. In addition, the threat action set may be configured differently depending on the situation. Specifically, if ransomware attacks and DDoS attacks occur frequently during a specific period of time, the threat action set may be configured according to the patterns of ransomware attacks and DDoS attacks. In addition, when the cloud server 10 performs a system update, the threat action set may be configured according to cyber attacks that occur frequently during the update.

[0074] The main server 50 may determine the set of threat behaviors through the AI ​​engine 40. Specifically, the set of threat behaviors may be determined based on an artificial intelligence-based classification algorithm including at least one of machine learning, deep learning, and reinforcement learning.

[0075] In step S140, the main server 50 determines at least one candidate scenario from among a plurality of reference scenarios pre-stored in the database 20 based on the threat behavior set.

[0076] Here, the reference scenario is a sequence of various tactics, techniques, and procedures (TTPs) included in the threat behavior analysis matrix stored in MITRE ATT&CK based on the attack patterns actually used by cyber attackers. For example, it can be created based on actual security incident cases, patterns derived from security research, or the experience of security experts.

[0077] The main server 50 may determine a reference scenario including the threat behavior set as a candidate scenario from among the reference scenarios. Specifically, the types, sequences, patterns, etc. of threat behaviors included in the reference scenario and each of the threat behavior sets may be taken into consideration.

[0078] In addition, in step S140, the main server 50 may determine candidate scenarios further based on the type of steps of the cyber attack.

[0079] Here, the type of cyber attack steps is a series of steps that an attacker follows to reach a goal in a cyber attack, and may include a pre-step, an attack step, and a subsequent step based on the Cyber ​​Kill Chain model, which is a conceptual model of the steps of a cyber attack. The order of each step is determined by the chronological order or causal relationship, and a threat act may correspond to at least one of the types of cyber attack steps.

[0080] Specifically, the pre-step may include threat actions such as collecting information, analyzing a target, and developing an attack tool when a cyber attack has not yet started and / or in the initial step of preparing an attack. The attack step may include threat actions such as transmitting an attack tool to a target when a cyber attack has already been started and / or executing an attack tool by exploiting a vulnerability in the system and / or installing a malicious code when a cyber attack has already been started and / or in the state where the attacker has already infiltrated the system and is taking action to achieve a goal, and the post-step may include threat actions such as the attacker controlling the malicious code to execute additional commands and / or deleting traces of information theft.

[0081] In step S150, the main server 50 calculates a security index by comparing the set of threat actions against the candidate scenario.

[0082] Here, the security index information includes multiple security indexes, and can include coincidence information and risk information. Also, the security index information can be expressed by a numerical value, but in this case, there is no particular limitation on the range of the numerical value.

[0083] Here, the consistency information means the degree of consistency between a plurality of reference scenarios pre-stored in the database 20 and a set of threat acts. In one example, the consistency information is calculated based on the relevance of the type to the threat acts contained in the candidate scenario, and the type relevance can be calculated as an index corresponding to the type relevance by differentiating between the tactical group information, technique information, and detailed technique information contained in the type of the detailed classification of the threat acts contained in the candidate scenario and whether they match each other.

[0084] For example, if the "B threat behavior" discovered in the "A candidate scenario" uses the technique "Phishing," this technique belongs to the tactical group "Initial Access" and can include sub-techniques such as "Spearphishing Link" and "Spearphishing Attachment." If the threat behavior discovered in the "A candidate scenario" uses "Spearphishing Link" or "Spearphishing Attachment" as sub-techniques, the actual correlation between the "Phishing" technique and the type of "B threat behavior" can be calculated to be high.

[0085] Here, the risk information can be calculated based on the reference scenarios pre-stored in the database 20 and the risk of threat actions, i.e., techniques, included in each of the threat action sets.

[0086] Each of the multiple reference scenarios includes a corresponding risk indicator, and risk level information can be calculated based on progress information generated by comparing the risk indicator with the threat behavior set and the threat behaviors included in the candidate scenario.

[0087] For example, if the set of threat behaviors corresponds to "ransomware attack" among the candidate scenarios, when the currently detected threat behavior is compared to "ransomware attack," if the progress information is in the initial step, the risk information can be calculated to be relatively low.

[0088] In step S160, the main server 50 determines a predicted threat scenario from among the candidate scenarios based on the security indicator information.

[0089] The main server 50 considers the security indicator information and determines, among the candidate scenarios, the candidate scenario that is most likely, has actually occurred, and / or has the highest probability of occurring as the predicted threat scenario.

[0090] For example, if there are candidate scenarios A and B, and both scenarios have high matching information when compared with a set of threat behaviors, the main server 50 can compare the risk information of both scenarios and determine candidate scenario A, which has the higher risk information of the two, as the predicted threat scenario.

[0091] In step S170, the main server 50 provides solution information to the user terminal based on the predicted threat scenario.

[0092] Here, the solution information may be a countermeasure against the determined predicted threat scenario. Specifically, the solution information may include the severity, type, and attack vector of the predicted threat scenario. In addition, the solution information may be individually customized in consideration of the user's situation.

[0093] For example, if the anticipated threat scenario corresponds to a "social engineering attack," solution information can include response measures such as user education, awareness campaigns, and improving email security.

[0094] For example, if the predicted threat scenario is 'DDoS', the solution information can include response plans such as traffic monitoring and restriction, introduction of DDoS defense solutions, and strengthening backup and recovery strategies.

[0095] In addition, solution information can be determined based on the type of cyber attack step that corresponds to the most recent threat action among the predicted threat scenarios.

[0096] Specifically, if the cyber attack step type corresponds to a pre-step, the user can be provided with a warning about an initial infiltration attempt and a defense plan. If the cyber attack step type corresponds to an attack step, the user can be provided with detailed information about an ongoing attack and a response plan. If the cyber attack step type corresponds to a subsequent step, the user can be provided with threats that may occur after the attack, preventive measures, and recovery plans.

[0097] 3 and 4 are tables for explaining threatening behaviors classified by type according to an embodiment of the present invention.

[0098] 3, the ID, name, and description of each of the 14 tactic groups are shown. Each tactic group can include at least one technique.

[0099] Referring to Figure 4, the techniques and detailed techniques corresponding to "TA001 Initial Access" in the tactic group in Figure 3 are illustrated. The technique "T1566 Phishing" can include detailed techniques such as "T1566.001", "T1566.002", and "T1566.003". In addition, there may be techniques that do not include detailed techniques, such as the technique "T1200 Hardware Additions".

[0100] FIG. 5 is a diagram illustrating an example of a threat behavior analysis matrix according to an embodiment of the present invention.

[0101] In the description with reference to FIG. 5, reference should also be made to FIGS.

[0102] Referring to FIG. 5, four tactical groups 510, TA001's techniques 520 and procedures 530 are illustrated.

[0103] 5, the techniques corresponding to each of the four tactic groups 510 are illustrated, and the techniques corresponding to "TA0001 Initial Access" in the tactic group of FIG. 3 are listed as TA001 techniques 520. When "Phishing" corresponding to the technique "T1566 Phishing" in FIG. 4 is selected from among the TA001 techniques 520, the corresponding procedure 530 can be confirmed.

[0104] FIG. 6 is a table illustrating a number of pre-stored reference scenarios according to an embodiment of the present invention.

[0105] In describing FIG. 6, reference will be made to FIGS. 2 through 5. FIG.

[0106] Referring to Figure 6, the cyber attack scenarios "Axiom," "GOLD SOUTHFIELD," "Hikit," and "Royal" corresponding to "Phishing" in Figure 5 are illustrated, and the techniques and detailed techniques corresponding to "GOLD SOUTHFIELD" are illustrated.

[0107] Referring to FIG. 6, the illustrated cyber attack scenarios “Axiom”, “GOLD SOUTHFIELD”, “Hikit”, and “Royal” may be part of a plurality of reference scenarios pre-stored in step S140.

[0108] For example, if the "AI threat action set" among the threat action sets determined in step S130 includes the techniques and detailed techniques "T1190", "T1133", and "T1195.002", then "GOLD SOUTHFIELD" can be determined as a candidate scenario in step S140 based on the "A1 threat action set". If the candidate scenario "GOLD SOUTHFIELD" is determined as a predicted threat scenario in step S160, the solution information provided in step S170 can suggest a method of blocking an ongoing attack and isolating the system for the techniques included in the "AI threat action set" among the techniques of the predicted threat scenario "GOLD SOUTHFIELD". For techniques not included in the "A1 threat action set", it can notify the possibility of an attack and / or suggest a direction to strengthen the security of the system.

[0109] 7 and 8 are diagrams illustrating a method for determining a threat scenario according to an embodiment of the present invention.

[0110] Figures 7 and 8 are illustrative diagrams showing the process that the main server 50 follows by performing the steps of Figure 2. Therefore, in the description of Figures 7 and 8, the description will be given with reference to Figure 2.

[0111] 7, in step S110, the main server 50 acquires API event information 715 from a cloud environment 710, and acquires a plurality of target API events 730 from the acquired API event information 715 according to a predetermined condition 720. In step S120, the main server 50 maps each of the plurality of target API events 730 to a threat behavior classified by type.

[0112] 8, in step S130, a threat behavior set 810 including at least one threat behavior among the mapped target API events 750 is determined. In step S140, at least one candidate scenario is determined among a plurality of reference scenarios 820 pre-stored in a database based on the threat behavior set 810.

[0113] The database stores relationship information regarding time intervals and causal relationships between threat actions included in each reference scenario, and step S130 of determining the set of threat actions can be determined based on the relationship information.

[0114] For example, in an attack scenario in which a cyber attacker gains initial access through a phishing attack and then performs a series of operations to gain additional privileges within a system, the time interval and causal relationship between the initial access event using the "Phishing" technique and the event that gains additional privileges can be analyzed, and a set of threat actions can be determined by taking into account similar time intervals and causal relationships among multiple threat actions.

[0115] FIG. 9 is a flowchart illustrating a method for determining a threat scenario according to another embodiment of the present invention.

[0116] In step S210, the main server 50 classifies the threatening behaviors according to classification criteria associated with at least one of the frequency of occurrence of the threatening behaviors, their time distribution, their location, and the associated user.

[0117] For example, if threat behaviors mainly occur from a specific user and / or are concentrated at a specific time, the threat behaviors can be classified into threat behaviors that occur from a specific user and threat behaviors that occur at a specific time according to classification conditions. In addition, a threat behavior set can be determined from among threat behaviors bound to the same classification.

[0118] In step S220, the main server obtains weight information corresponding to the classification conditions from the user terminal.

[0119] For example, if the user terminal assigns an additional weighting to the "location of occurrence," threat behaviors that occur at that location can be included in the threat behavior set without fail.

[0120] In step S230, the main server 50 modifies the threshold information that determines the range of the classification conditions based on the weight information.

[0121] For example, by changing the threshold value of "occurrence frequency," only threat acts occurring at or above a certain frequency can be classified into a threat act set.

[0122] The technical features disclosed in each embodiment of the present invention are not limited to the corresponding embodiment, and as long as they are not mutually incompatible, the technical features disclosed in each embodiment may be combined and applied to different embodiments.

[0123] Therefore, although each embodiment will be described focusing on its respective technical features, as long as the technical features are not mutually exclusive, they can be combined and applied.

[0124] The present invention is not limited to the above-described embodiments and the accompanying drawings, and various modifications and variations are possible from the viewpoint of those having ordinary skill in the art to which the present invention pertains. Therefore, the scope of the present invention should be determined not only by the claims of this specification, but also by equivalents to the claims. [Explanation of symbols]

[0125] 10: Cloud Server 20: Database 30: User terminal 40: AI engine 50: Main server

Claims

1. 1. A method for determining a threat scenario, comprising: determining a plurality of target API events according to a predetermined condition from among the API event information of the user acquired in the cloud environment (wherein the predetermined condition is associated with at least one of the frequency of the event, the time distribution, the occurrence location, the associated user, and the type of the API event); Mapping each of the plurality of target API events to a threat behavior categorized by type; determining at least one threat behavior set including at least one threat behavior of the plurality of threat behaviors; determining at least one candidate scenario from a plurality of reference scenarios pre-stored in a database based on the set of threat behaviors; calculating security indicator information for the candidate scenario by comparing it with the set of threat actions; determining a predicted threat scenario from among the candidate scenarios based on the security indicator information; providing solution information to a user terminal based on the predicted threat scenario; How to determine the threat scenario.

2. 10. The method of claim 1 , The detailed classification type of the threat behavior includes information on a tactical group, information on a technique, and information on a detailed technique (wherein the tactical group is a higher-level concept including at least one of the techniques, and the technique is a higher-level concept including at least one of the detailed techniques). How to determine the threat scenario.

3. 10. The method of claim 1 , The security index information includes matching degree information and risk degree information. How to determine the threat scenario.

4. 4. The method of claim 3, the coincidence information is calculated based on the relevance of types of threat behaviors included in the candidate scenarios; How to determine the threat scenario.

5. 5. The method of claim 4, The detailed classification type of the threat behavior includes information on a tactical group, information on a technique, and information on a detailed technique (wherein the tactical group is a higher-level concept including at least one of the techniques, and the technique is a higher-level concept including at least one of the detailed techniques), The relevance of the type is calculated by calculating an index corresponding to the relevance of the type, based on whether or not the information on the tactical group, the information on the technique, and the information on the detailed technique included in the type of the detailed classification of the threat behavior included in the candidate scenario match each other. How to determine the threat scenario.

6. 10. The method of claim 1 , The security index information includes risk level information, The plurality of reference scenarios pre-stored in the database, including the corresponding risk indicators, the risk level information is calculated based on progress information generated by comparing the risk indicator, the set of threat behaviors, and the threat behaviors included in the candidate scenario; How to determine the threat scenario.

7. 10. The method of claim 1 , The multiple reference scenarios stored in advance in the database are scenarios that are composed of at least some of the threat actions selected from the multiple techniques included in the threat action analysis matrix (wherein the threat action analysis matrix is ​​composed of multiple tactical groups and at least one technique included in the tactical groups). How to determine the threat scenario.

8. 10. The method of claim 1 , The step of determining candidate scenarios includes: determining the candidate scenarios further based on a typology of cyber attack steps; The type of cyber attack steps includes a pre-step, an attack step, and a follow-up step based on the Cyber ​​Kill Chain model, and the order of each step is determined by the order of chronological occurrence or causal relationship; The threat action corresponds to at least one of the types of cyber attack steps; How to determine the threat scenario.

9. 9. The method of claim 8, The solution information is determined according to a type of the cyber attack step corresponding to the most recently occurred threat action in the predicted threat scenario. How to determine the threat scenario.

10. 10. The method of claim 9, If the type of cyber attack step corresponds to the pre-step, provide the user with a warning and a defense plan against the initial infiltration attempt; If the type of cyber attack step corresponds to the attack step, provide the user with detailed information on the ongoing attack and a response plan thereto; If the type of the cyber attack step corresponds to the subsequent step, provide the user with threats that may occur after the attack, preventive measures, and recovery plans; How to determine the threat scenario.

11. 10. The method of claim 9, determining at least one of the predetermined conditions according to a type of the cyber-attack step; How to determine the threat scenario.

12. 10. The method of claim 1 , The step of determining a set of threat behaviors includes: classifying the threat behavior according to classification criteria associated with at least one of a frequency of occurrence, a temporal distribution, a location of occurrence, and an associated user of the threat behavior; The threat behavior set is composed of threat behaviors determined according to the same classification criteria; How to determine the threat scenario.

13. 13. The method of claim 12, obtaining weight information corresponding to classification conditions from the user terminal; changing threshold information that determines a range of the classification condition based on the weight information; How to determine the threat scenario.

14. 10. The method of claim 1 , The threat behavior set is determined based on an artificial intelligence-based classification algorithm, The classification algorithm includes at least one of machine learning, deep learning, and reinforcement learning. How to determine the threat scenario.

15. 10. The method of claim 1 , The database stores relationship information regarding time intervals and causal relationships between threat actions included in each of the reference scenarios; The step of determining a set of threat behaviors comprises: determined based on the relationship information, How to determine the threat scenario.

Images