Method and system for analyzing cyber attack flow based on security event correlation

Abstract

A method for analyzing a cyber attack flow according to one embodiment of the technical concept of the present disclosure comprises: collecting threat events from security software; generating a system graph representing the interrelationships between system objects from a system event log; mapping the threat events to nodes of the system graph; and obtaining an attack graph from the system graph to which the threat events are mapped.

Description

Technology Field

[0001] The technical concept of the present disclosure is a method and system for analyzing cyber attack flows based on correlations between security events. Background Technology

[0003] Generally, a single cyber attack is executed by a combination of various individual attack behaviors and attack techniques. Various security software deployed to protect an organization's network and cyber assets detects individual attack behaviors and generates threat events. Therefore, when a cyber attack is carried out, a large number of threat events can be generated through multiple security software programs within the organization. Since these threat events lack correlation with one another, analysts at the security operations center face difficulties in understanding the overall attack situation and responding when a large volume of threat events occurs.

[0004] Existing SIEM (Security Information and Event Management) systems integrate threat events detected by various security devices and software and support some simple correlations. However, since the correlations provided by SIEM connect events based on common attributes shared by threat events, they have a limitation in that they cannot link events that are not directly connected. Furthermore, because security devices and software cannot detect every single attacker action in detail to generate threat events, the range of connectable threat events is very limited; consequently, this limits an analyst's ability to grasp the overall context of an attack.

[0005] Some Endpoint Detection and Response (EDR) systems are security software that detects and responds to threats based on host behavior. They provide the ability to generate a Provenance Graph and map threat events to it, enabling the identification of the behavioral context of individual events. However, existing EDR systems cannot generate an Attack Graph that illustrates the attack process by tracking the flow of attacks between threat events mapped to the Provenance Graph. Consequently, there are still limitations for analysts to grasp the context of the overall attack situation, even through EDR. The problem to be solved

[0007] The problem that the present invention aims to solve is to provide a cyber attack flow analysis method and system that enables an analyst to effectively identify a cyber attack situation by correlating individual threat events generated in security software to reconstruct the overall attack flow.

[0008] The problem that the present invention aims to solve is to provide a method for analyzing the association between threat events even if they do not have common attribute values.

[0009] The problem that the present invention aims to solve is to provide a method for identifying intermediate stages of an attack process that are not detected as threats in security software.

[0010] The problem that the present invention aims to solve is to provide a method for systematically analyzing and visualizing how individual threat events are connected to a single attack scenario.

[0011] The problem that the present invention aims to solve is to provide a method for updating previously identified attack flows in real time when a new threat event occurs. means of solving the problem

[0013] To achieve the above objectives, a method for analyzing a cyber attack flow according to one aspect of the technical concept of the present disclosure comprises: collecting threat events from security software; generating a system graph representing the interrelationships between system objects from a system event log; mapping the threat events to nodes of the system graph; and obtaining an attack graph from the system graph to which the threat events are mapped.

[0014] According to one embodiment, the system graph includes a provenance graph generated based on system call events, and the provenance graph may be configured to include nodes corresponding to system objects including at least one of a process, a file, a network connection, and a registry, and edges corresponding to the system call events.

[0015] According to one embodiment, the step of mapping the threat events to the nodes of the system graph may include mapping the threat events to the nodes corresponding to the objects associated with the threat events in the system graph.

[0016] According to one embodiment, the step of mapping the threat events may further include the step of mapping the threat events to nodes of processes associated with nodes of objects to which the threat events are mapped.

[0017] According to one embodiment, the step of obtaining the attack graph may include the step of generating a process graph by extracting nodes of processes and edges representing relationships between the processes from the system graph, and the step of obtaining the attack graph from the process graph.

[0018] According to one embodiment, each process node of the process graph may include a flag attribute indicating whether the process is malicious and a path_state attribute indicating the possibility of participating in an attack.

[0019] According to one embodiment, the step of obtaining the attack graph may include the step of updating the path_state of each node by performing forward tracing proceeding from the root node toward the leaf node, and the step of obtaining the attack graph by performing backward tracing proceeding from the leaf node toward the root node.

[0020] According to one embodiment, the step of updating the path_state of each node by performing the Forward Tracing may include the step of setting the path_state of the current node to MALICIOUS if the path_state of the parent node is MALICIOUS or the flag of the current node is MALICIOUS.

[0021] According to one embodiment, the step of obtaining the attack graph by performing the Backward Tracing may include the step of connecting the current node and the child node to include them as part of the attack graph when the path_state of the current node is MALICIOUS and the path_state of the child node is MALICIOUS.

[0022] According to one embodiment, the step of acquiring the attack graph may include the step of searching the system graph whenever a new threat event occurs to identify a process associated with the threat event, and the step of acquiring the attack graph based on the identified process.

[0023] According to one embodiment, the step of acquiring the attack graph may include, if the identified process is included in the existing attack graph, updating the attack graph by mapping the threat event to the identified process; and if the identified process is not included in the existing attack graph, searching the system graph to identify a process among the ancestor processes of the identified process to which the threat event is mapped, and updating the attack graph by adding the identified process to the attack graph to which the identified ancestor process belongs.

[0024] According to one embodiment, the step of acquiring the attack graph may include the step of acquiring a new attack graph having the identified process as a root node when the identified process is not included in the existing attack graph and the identified ancestor process does not exist.

[0025] According to one embodiment, the method may further include the step of outputting the acquired attack graph through a display.

[0026] A cyber attack flow analysis system according to one embodiment of the technical concept of the present disclosure comprises at least one processor and a memory, wherein the at least one processor collects threat events from security software according to the execution of instructions stored in the memory, generates a system graph representing the interrelationships between system objects from a system event log, maps the threat events to nodes of the system graph, and obtains an attack graph from the system graph to which the threat events are mapped.

[0027] A computer-readable non-transient storage medium according to one embodiment of the technical concept of the present disclosure stores instructions for performing the cyber attack flow analysis method. Effects of the invention

[0029] According to the technical concept of the present disclosure, a cyber attack flow analysis system can identify threat events related in the attack flow even if they do not share common attribute values ​​by mapping threat events using a system graph such as a provenance graph. This enables the overcoming of the limitations of existing SIEMs, which are based on common attributes and limited correlation analysis.

[0030] In addition, the present disclosure can automatically identify processes determined to be associated with the attack flow and include them in the attack graph, even if those processes are not detected as threats on the system graph. This makes it possible to identify intermediate stages of the attack process that may be missed due to the limitations of threat detection in security software.

[0031] Furthermore, the present disclosure can systematically extract attack graphs through Forward Tracing and Backward Tracing, and can update existing attack graphs in real time when new threat events occur. Through this, analysts can intuitively understand how individual threat events are connected to a single attack scenario.

[0032] Consequently, through the present disclosure, analysts at a security operations center can rapidly identify the overall flow of attacks from a large volume of individual threat events, which enables a more effective security response.

[0033] The effects obtainable through the technical concept of the present disclosure are not limited to those mentioned above, and other unmentioned effects will be clearly understood by those skilled in the art to which the present invention belongs from the description below. Brief explanation of the drawing

[0035] A brief description of each drawing is provided to help to better understand the drawings cited in the present disclosure. FIG. 1 is a block diagram showing the configuration of a cyber attack flow analysis system according to an exemplary embodiment of the present disclosure. FIG. 2 is a flowchart for explaining a method for analyzing cyber attack flows according to an exemplary embodiment of the present disclosure. Figure 3 is an example of a system graph generated by the system graph generation unit of the cyber attack flow analysis system illustrated in Figure 1. FIG. 4 is a diagram illustrating the mapping process of threat events according to an exemplary embodiment of the present disclosure. Figure 5 is an example of a process graph obtained from a system graph in which threat events are mapped. Figure 6 is an example diagram illustrating the Forward Tracing process performed by the offline attack graph acquisition unit of the cyber attack flow analysis system illustrated in Figure 1. Figure 7 is an example diagram illustrating the Backward Tracing process performed by the offline attack graph acquisition unit of the cyber attack flow analysis system illustrated in Figure 1. FIG. 8 is a flowchart for explaining the process of acquiring an online attack graph performed by the online attack graph acquisition unit of the cyber attack flow analysis system illustrated in FIG. 1. FIG. 9 is a diagram illustrating the process of updating an attack graph according to an exemplary embodiment of the present disclosure. FIG. 10 is a schematic hardware configuration block diagram of a computing device constituting a cyber attack flow analysis system according to an exemplary embodiment of the present disclosure. Specific details for implementing the invention

[0036] Exemplary embodiments according to the technical concept of the present disclosure are provided to more fully explain the technical concept of the present disclosure to those skilled in the art, and the following embodiments may be modified in various different forms, and the scope of the technical concept of the present disclosure is not limited to the following embodiments. Rather, these embodiments are provided to make the present disclosure more faithful and complete and to fully convey the technical concept of the present invention to those skilled in the art.

[0037] In this disclosure, terms such as "first," "second," etc. are used to describe various members, regions, layers, parts, and / or components; however, it is obvious that these members, parts, regions, layers, parts, and / or components should not be limited by these terms. These terms do not imply a specific order, hierarchy, or superiority, and are used solely to distinguish one member, region, part, or component from another. Accordingly, the first member, region, part, or component described below may refer to the second member, region, part, or component without departing from the teachings of the technical concept of this disclosure. For example, without departing from the scope of rights of this disclosure, the first component may be named the second component, and similarly, the second component may be named the first component.

[0038] Unless otherwise defined, all terms used herein, including technical and scientific terms, have the same meaning as commonly understood by those skilled in the art to which the concept of this disclosure belongs. Furthermore, commonly used terms, such as those defined in advance, should be interpreted as having a meaning consistent with what they mean in the context of the relevant technology, and should not be interpreted in an overly formal sense unless explicitly defined herein.

[0039] Where an embodiment can be implemented differently, a specific process or sequence of steps may be performed differently from the order described. For example, two processes or steps described in succession may be performed substantially simultaneously or in the reverse order of the order described.

[0040] In addition, terms such as “~part,” “~device,” “~device,” and “~module” described in this specification refer to a unit that processes at least one function or operation, and may be implemented as hardware or software or a combination of hardware and software such as a processor, microprocessor, microcontroller, CPU (Central Processing Unit), AP (Application Processor), GPU (Graphics Processing Unit), NPU (Neural Processing Unit), APU (Accelerate Processor Unit), DSP (Drive Signal Processor), ASIC (Application Specific Integrated Circuit), FPGA (Field Programmable Gate Array), etc., and may also be implemented in a form combined with memory that stores data necessary for processing at least one function or operation.

[0041] Furthermore, it is intended to clarify that the classification of components in this specification is merely based on the primary function each component is responsible for. That is, two or more components described below may be combined into a single component, or a single component may be divided into two or more components based on more subdivided functions. Additionally, each component described below may additionally perform some or all of the functions of other components in addition to its primary function, and it is obvious that some of the primary functions of each component may be exclusively performed by other components.

[0042] The term 'and / or' as used herein includes each of the mentioned members and all combinations of one or more.

[0043] Hereinafter, embodiments according to the technical concept of the present disclosure will be described in detail with reference to the attached drawings.

[0045] FIG. 1 is a block diagram showing the configuration of a cyber attack flow analysis system according to an exemplary embodiment of the present disclosure.

[0046] Referring to FIG. 1, a cyber attack flow analysis system (10) according to one embodiment of the present disclosure detects a cyber attack on a system to be analyzed and analyzes the attack flow from the detected cyber attack situation and provides it to an analyst, etc., thereby enabling the analyst, etc. to quickly identify and respond to the detected cyber attack. The system to be analyzed may include the cyber attack flow analysis system (10) or may correspond to a separate computing system connected to the cyber attack flow analysis system (10) via a network. Such a cyber attack flow analysis system (10) may be composed of at least one computing device including hardware such as a processor and memory.

[0047] A cyber attack flow analysis system (10) according to an embodiment of the present disclosure may include a threat event collection unit (110), a threat event storage unit (120), a system graph generation unit (130), a system graph storage unit (140), a threat event mapping unit (150), an attack graph acquisition unit (170), an attack graph storage unit (180), and an attack graph output unit (190). Each component may be implemented in hardware, software, or a combination thereof.

[0048] The threat event collection unit (110) can collect threat events from security software on a host (system to be analyzed). Here, security software may include various security solutions such as Anti-Virus, EDR (Endpoint Detection and Response), and IDS (Intrusion Detection System). A single cyber attack is executed by a combination of various individual attack behaviors and attack techniques, and these security softwares can generate threat events by detecting individual attack behaviors in their respective ways. For example, Anti-Virus detects malicious files based on signatures, and EDR detects threats based on behavior on the host. Therefore, the execution of a single cyber attack can generate a large number of threat events through various security software within the organization. The threat event collection unit (110) can collect these threat events through streaming services such as Kafka, and for future correlation analysis, standardize and normalize the threat events into a common format and store them in a threat event repository (120).

[0049] The threat event store (120) can store collected threat events. For example, the threat event store (120) may correspond to a conventional relational database, but may also correspond to a NoSQL-based data store such as Elasticsearch that can efficiently store and retrieve a large amount of event data.

[0050] The system graph generation unit (130) can collect system event logs from cyber assets and generate a system graph that represents the interrelationships between system objects based on them. For example, the system event logs may include system call events of cyber assets, and in the case of a Windows operating system, system call events may be collected through the Event Tracing for Windows (ETW) service, and in the case of a Linux operating system, through the Audit service. Based on the collected system event logs, the system graph generation unit (130) can generate a system graph that represents the flow of information and control between system objects such as processes, files, network connections, and registries. For example, the system graph may include a Provenance Graph. The nodes of the Provenance Graph are system objects such as processes, files, network connections, and registries, and the edges may represent the flow of information and control between nodes as system calls. In particular, processes may be defined as Subject nodes as the agents of action, and the remaining objects may be defined as Object nodes as targets of action. The generated system graph may be stored in the system graph storage (140).

[0051] The system graph storage (140) can store the generated system graph in a physical storage so that it can be used for future analysis. For example, the system graph storage (140) may include a conventional relational database, but may also include a graph database such as Neo4j, which is optimized for graph data for future graph exploration.

[0052] The threat event mapping unit (150) can map threat events stored in the threat event storage (120) to nodes of the system graph stored in the system graph storage (140). For example, in the case of a threat event generated by Anti-Virus detecting a malicious file, it can be mapped to the corresponding file node on the system graph, and in the case of a threat event generated by EDR detecting a malicious act, it can be mapped to the process node that performed the act and the target object node. Additionally, the threat event mapping unit (150) can propagate the threat mapped to the object node to the process node associated with the object.

[0053] The attack graph acquisition unit (170) can acquire an attack graph from a system graph in which threat events are mapped. According to one embodiment, the attack graph acquisition unit (170) may include an offline attack graph acquisition unit (172) and an online attack graph acquisition unit (174).

[0054] The offline attack graph acquisition unit (172) can acquire an attack graph by performing Forward Tracing and Backward Tracing on a system graph where threat events are mapped. The online attack graph acquisition unit (174) can acquire an attack graph and gradually update it by traversing the system graph in real time whenever a new threat event occurs. Specific details regarding the offline attack graph acquisition unit (172) and the online attack graph acquisition unit (174) will be explained later through FIGS. 6 to 9.

[0055] The attack graph storage (180) can physically store the acquired attack graphs. The attack graph storage (180) may correspond to a conventional relational database, but depending on the embodiment, it may include a graph database that facilitates the search and management of graph data.

[0056] The attack graph output unit (190) can output an attack graph stored in the attack graph storage (180) through means such as a display. The attack graph shows how individual threat events are connected to a single attack scenario. Therefore, through the output attack graph, a security analyst can intuitively grasp the overall attack flow from a large number of individual threat events. This enables the security analyst to respond more quickly and effectively.

[0058] FIG. 2 is a flowchart for explaining a cyber attack flow analysis method according to an exemplary embodiment of the present disclosure. The cyber attack flow analysis method illustrated in FIG. 2 can be performed by the cyber attack flow analysis system (10) described above in FIG. 1.

[0059] Referring to FIG. 2, the cyber attack flow analysis system (10) can collect threat events from security software, etc. (S110).

[0060] The threat event collection unit (110) of the cyber attack flow analysis system (10) can collect threat events generated from various security software, such as Anti-Virus, EDR, and IDS, running on a host (system to be analyzed), and store the collected threat events in a threat event storage (120). At this time, the threat events can be collected through a streaming service such as Kafka, and can be standardized and normalized into a common format and stored.

[0061] The cyber attack flow analysis system (10) can generate a system graph based on system event logs (S130).

[0062] In this step, which is performed by the system graph generation unit (130), a system graph can be generated based on system event logs (e.g., system call events) collected through cyber assets (e.g., Windows ETW service or Linux Audit service). For example, the system graph may include a probation graph, and the generated probation graph may represent information flow and control flow within the system by having system objects such as processes, files, network connections, and registries as nodes and system calls between them as edges.

[0063] The cyber attack flow analysis system (10) can map collected threat events to a generated system graph (S150).

[0064] In this step, performed by the threat event mapping unit (150), threat events can be mapped to corresponding nodes of the system graph. For example, a malicious file detected by Anti-Virus can be mapped to a file node, and a malicious act detected by EDR can be mapped to a process node that performed the act and a target object node. Additionally, a threat mapped to an object node can be propagated to a process node associated with that object. This is because actual threat acts in the system can only be performed through processes. For example, a malicious file actually becomes a threat when it is executed as a process or loaded by another process.

[0065] The cyber attack flow analysis system (10) can obtain an attack graph based on a system graph in which threat events are mapped (S170).

[0066] In this step, which is performed by the attack graph acquisition unit (170), the process graph is first acquired by removing object nodes excluding processes from the system graph, and the attack graph can be acquired from this process graph. The acquisition of the attack graph can be performed in an offline or online manner; the offline method acquires the attack graph through Forward / Backward Tracing, while the online method can update the attack graph in real time when a new threat event occurs.

[0067] The cyber attack flow analysis system (10) can output an acquired attack graph (S190).

[0068] In this step, which is performed by the attack graph output unit (190), the acquired attack graph can be output through an output means such as a display. Through the output attack graph, the security analyst can identify how individual threat events are connected to a single attack scenario, thereby enabling a more rapid and effective response.

[0070] Figure 3 is an example of a system graph generated by the system graph generation unit of the cyber attack flow analysis system illustrated in Figure 1.

[0071] In FIG. 3, a provenance graph is illustrated as an example of a system graph (300), but the types of system graphs (300) according to the embodiments of the present disclosure are not limited to provenance graphs.

[0072] Referring to FIG. 3, the system graph (300) may include various system objects as nodes, such as process nodes (circles), file nodes (squares), network connection nodes (triangles), and registry nodes (diamonds). In the system graph, a process corresponds to a Subject node as the subject of an action, and a file, network connection, registry, etc. correspond to an Object node as the object of an action.

[0073] In the example of Figure 3, process node A created process node B and process node C through the system call ("Create"). Process node B created process node D and process node E, and process node C created process node F and process node G. Similarly, process node E created process node H and process node I, process node F created process node J and process node K, and process node G created process node L. Process node J created process node M.

[0074] Processes can also interact with various system objects. For example, process node B interacts with registry node R1, and process node C interacts with network connection node N1. Process node D interacts with network connection node N2, and process node H interacts with file node F2. Process node G interacts with file node F1 and registry node R2, process node K interacts with file node F3, and process node M interacts with file node F4 and registry node R3.

[0075] This system graph (300) can visually represent the creation relationships of processes occurring within the system and the interactions between the processes and various system objects. Each edge ("Create") represents a system call, through which the flow of information and control within the system can be identified. The system graph thus constructed can subsequently serve as a basis for threat event mapping and obtaining an attack graph.

[0076] FIG. 4 is a diagram illustrating the mapping process of threat events according to an exemplary embodiment of the present disclosure.

[0077] Referring to the system graph (400) of FIG. 4, it can be seen that some process nodes (C, G, M) and some object nodes (N1, F1, R3) are marked in red in the system graph (300) of FIG. 3, and red dotted arrows are shown between each process node and object node marked in red. Here, the nodes marked in red represent nodes to which threat events are mapped, and the red dotted arrows represent the relationship in which the threat propagates.

[0078] For example, if a malicious network connection is detected at network connection node N1, this threat can spread to process node C, which performed the network connection. Similarly, if a malicious file is detected at file node F1, this threat can spread to process node G, which interacts with that file.

[0079] In the case of process node M, if an abnormal registry modification is detected on registry node R3, this threat can propagate to process node M, which performed the registry manipulation.

[0080] Threats propagate to process nodes because the actual perpetrators of threatening behavior in the system are processes. For example, a malicious file actually becomes a threat when it is executed as a process or loaded by another process.

[0081] The system graph (400) with threat events mapped in this way shows which object the threat was detected in and what the actual acting agent related to the threat is. Through threat propagation from object nodes to process nodes, processes that actually perform malicious acts in the system can be accurately identified, and this can be used as important information in the process of obtaining the attack graph later.

[0083] Figure 5 is an example of a process graph obtained from a system graph in which threat events are mapped.

[0084] Referring to FIG. 5, it can be seen that the process graph (500) is composed of only process nodes and the relationships between them, with object nodes such as file nodes (F1~F4), network connection nodes (N1, N2), and registry nodes (R1~R3) removed from the system graph (400) of FIG. 4.

[0085] Each process node may include a flag attribute and a path_state attribute. The flag attribute indicates whether the process is malicious, and the path_state attribute indicates the possibility of participation in an attack. In Figure 5, these attribute values ​​of the process nodes are displayed next to the nodes.

[0086] Looking specifically at the process graph (500) of FIG. 5, it can be seen that the root node A has node.flag BENIGN and node.path_state BENIGN. The child node B of node A likewise has both attributes BENIGN, but the other child node C has node.flag MALICIOUS and node.path_state BENIGN.

[0087] It can be confirmed that process node G also has node.flag that is MALICIOUS and node.path_state that is BENIGN, and process node M also has node.flag that is MALICIOUS and node.path_state that is BENIGN. This shows that the flag attribute within the process graph of the process nodes (C, G, M) where the threat was mapped in Fig. 4 is set to MALICIOUS. It also shows that the initial state of the path_state of all nodes is set to BENIGN.

[0088] This process graph (500) can serve as a basis for the subsequent process of obtaining the attack graph. In particular, the flag and path_state attributes of the process nodes can be used to identify processes belonging to the same attack during the Forward Tracing and Backward Tracing processes.

[0090] Figure 6 is an example diagram illustrating the Forward Tracing process performed by the offline attack graph acquisition unit of the cyber attack flow analysis system illustrated in Figure 1.

[0091] Referring to FIG. 6, the cyber attack flow analysis system (10) can update the path_state of each process node as it proceeds from root node A toward terminal nodes. The blue arrow indicates the direction of Forward Tracing.

[0092] During the Forward Tracing process, the path_state of a process node can be set to MALICIOUS if the parent node's path_state is MALICIOUS or if the current node's flag is MALICIOUS. For example, since the flag of process node C is MALICIOUS, C's path_state becomes MALICIOUS, and consequently, the path_state of its child node F can also be set to MALICIOUS.

[0093] Similarly, since the flag of process node G is MALICIOUS, G's path_state becomes MALICIOUS, and the path_state of its child node L is also set to MALICIOUS. Furthermore, since the path_state of process node F is MALICIOUS, the path_states of its child nodes J and K are also set to MALICIOUS, and the path_state of J's child node M is also set to MALICIOUS.

[0094] In this way, Forward Tracing identifies potential attack paths by starting from a process with a flag attribute of MALICIOUS and updating the path_state of its associated processes to MALICIOUS. These updated path_state attributes are then used to construct the actual attack graph during the subsequent Backward Tracing process.

[0096] Figure 7 is an example diagram illustrating the Backward Tracing process performed by the offline attack graph acquisition unit of the cyber attack flow analysis system illustrated in Figure 1.

[0097] Referring to FIG. 7, the cyber attack flow analysis system (10) can construct an attack graph by proceeding from a terminal node toward a root node. For example, an edge of the attack graph can be generated when both conditions are satisfied. The first condition is that the path_state of the parent node must be MALICIOUS, and the second condition is that the return value of the gen_attack_edge() function of the current node must be MALICIOUS. Here, the gen_attack_edge() function serves to verify the actual attack correlation between two nodes.

[0098] The gen_attack_edge() function returns MALICIOUS if the flag of a given node is MALICIOUS, or if there is at least one descendant node among its descendants whose path_state is MALICIOUS and whose flag is MALICIOUS; otherwise, it outputs BENIGN. The gen_attack_edge() function operates recursively, performing Forward Tracing starting from the root node toward the leaflets, and performing Backward Tracing by returning from the leaflets toward the root node and moving upwards.

[0099] The gray area in Fig. 7 represents the finally identified attack graph. The blue solid arrows indicate the direction of Backward Tracing, and the blue dotted lines represent the attack graph connecting processes belonging to the same attack. Specifically, since the path_state of process node M is MALICIOUS and it is confirmed through the gen_attack_edge() function that it belongs to the same attack as process node J, an edge of the attack graph is generated between M and J. Similarly, between J and F, F and C, G and C, and L and G, an edge of the attack graph is generated if it is confirmed that they belong to the same attack through path_state verification and validation via the gen_attack_edge() function, respectively. As a result, a single attack graph consisting of process nodes C, F, G, J, L, and M is identified. In this way, Backward Tracing can construct the final attack graph by analyzing and connecting the processes that actually belong to the same attack among the potential attack paths identified in Forward Tracing. The attack graph obtained in this manner allows for the understanding of the overall attack flow by showing the relationships between the processes executing a single cyber attack.

[0101] FIG. 8 is a flowchart for explaining the process of acquiring an online attack graph performed by the online attack graph acquisition unit of the cyber attack flow analysis system illustrated in FIG. 1.

[0102] Referring to FIG. 8, when a new threat event occurs (S810), the cyber attack flow analysis system (10) can map the threat event by identifying the process associated with the threat event (S820). Since step S820 is similar to step S150 of FIG. 2, a redundant description thereof will be omitted.

[0103] The cyber attack flow analysis system (10) can determine whether the identified process is a process included in the existing attack graph (S830).

[0104] If the identified process is a process included in the existing attack graph, the cyber attack flow analysis system (10) can update the existing attack graph.

[0105] On the other hand, if the identified process is a process that is not included in the existing attack graph (NO of S830), the cyber attack flow analysis system (10) can check whether the path_state of the parent process is MALICIOUS to determine whether the process is associated with the existing attack graph (S840).

[0106] If the parent process's path_state is MALICIOUS, it means that the process is likely associated with a known attack flow.

[0107] If the path_state of the parent process is MALICIOUS (YES in S840), the cyber attack flow analysis system (10) identifies the nearest ancestor process to which the threat event is mapped among the ancestor processes of the identified process (S850), and can add the path from the identified ancestor process to the current process to the attack graph to which the ancestor process belongs (S190). This is to gradually expand the attack graph by connecting the newly discovered threat process to the previously identified attack flow.

[0108] On the other hand, if the path_state of the parent process is not MALICIOUS (NO in S840), the process may be the starting point of a new attack that is not associated with any existing attack flow, so a new attack graph with the process as the root node may be created (S870).

[0109] FIG. 9 is a diagram illustrating the process of updating an attack graph according to an exemplary embodiment of the present disclosure.

[0110] Referring to FIG. 9, it can be seen that a new threat event has been mapped to process node N. Since the path_state of process node L, which is the parent process of process node N, is MALICIOUS, the cyber attack flow analysis system (10) can identify the nearest ancestor process node G among the ancestor processes of process node N to which the threat event has been mapped (where the flag value is MALICIOUS). The cyber attack flow analysis system (10) can add the path from the identified ancestor process node G to process node N to the attack graph to which ancestor process node G belongs. As a result, the existing attack graph (gray area) of FIG. 9 can be expanded as the path to process node N is added.

[0111] In this way, the process of acquiring the online attack graph can continuously reflect changes in the attack situation by updating the attack graph in real time whenever a new threat event occurs.

[0113] FIG. 10 is a schematic hardware configuration block diagram of a computing device constituting a cyber attack flow analysis system according to an exemplary embodiment of the present disclosure.

[0114] The hardware configuration of the computing device (1000) illustrated in FIG. 10 may correspond to the hardware configuration of each of at least one computing device constituting the cyber attack flow analysis system (10) illustrated in FIG. 1.

[0115] Referring to FIG. 10, the computing device (1000) may include a communication unit (1010), an input unit (1020), an output unit (1030), a control unit (1040), and a memory (1050). The control configuration shown in FIG. 10 is an example for convenience of explanation, and the computing device (1000) may include more or fewer configurations than the configuration shown in FIG. 10.

[0116] The communication unit (1010) may include one or more communication modules that enable communication with other terminals or servers, etc. by connecting the computing device (1000) to a network. For example, the communication module may include a mobile communication module such as LTE, 5G, etc., a wireless communication module such as Wi-Fi, etc., and / or various other wired or wireless communication modules.

[0117] The input unit (1020) is configured to acquire information such as user input, video, and audio, and may include various input means such as various mechanical / electronic input means, cameras, and microphones. The output unit (1030) is configured to provide information to a user by generating output related to sight, hearing, or touch, and may include a display, speaker, vibration module, etc. For example, the output unit (1030) may include the attack graph output unit (190) described above in FIG. 1.

[0118] The control unit (1040) can control the overall operation of the computing device (1000). The control unit (1040) can process signals, data, information, etc. that are input or output through the components described above, or provide certain information or functions according to various applications or algorithms stored in the memory (1050). For example, the control unit (1040) can control the overall process related to the cyber attack flow analysis method disclosed in this specification. Specifically, the control unit (1040) may correspond to a configuration that substantially processes the operation of each of the threat event collection unit (110), system graph generation unit (130), threat event mapping unit (150), and attack graph acquisition unit (170) described in FIG. 1.

[0119] The control unit (1040) may include at least one processor and / or at least one programmable circuit. For example, the control unit (1040) may be implemented in hardware such as a CPU, an application processor (AP), an MCU, a GPU, an NPU, an integrated circuit, an ASIC, an FPGA, etc.

[0120] The memory (1050) can store programs and data necessary for the operation of the computing device (1000). Additionally, the memory (1050) can store data generated or acquired through the control unit (1040). The memory (1050) may be composed of a storage medium such as ROM, RAM, flash memory, SSD, HDD, or a combination of storage media.

[0121] According to an embodiment, the memory (1050) may include the threat event store (120), system graph store (140), and attack graph store (180) described in FIG. 1.

[0122] The embodiments of the present disclosure described above can be implemented as computer-readable code on a medium on which a program is recorded. Computer-readable media include all types of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable media include HDD (Hard Disk Drive), SSD (Solid State Disk), SSD (Silicon Disk Drive), ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc.

[0123] The description of the above-described embodiments is merely an example provided with reference to the drawings for a more thorough understanding of the present disclosure, and should not be interpreted as limiting the technical scope of the present disclosure.

[0124] Furthermore, it will be apparent to those skilled in the art to which this disclosure pertains that various changes and modifications are possible within the scope of the basic principles of this disclosure.

Claims

Claim 1 A method for analyzing cyber attack flow executed by a processor, comprising: collecting threat events from security software; generating a system graph representing the interrelationships between system objects from a system event log; mapping the threat events to nodes of the system graph; and obtaining an attack graph from the system graph to which the threat events are mapped. Claim 2 A method for analyzing cyber attack flow according to claim 1, wherein the system graph comprises a provenance graph generated based on system call events, and the provenance graph comprises nodes corresponding to system objects including at least one of a process, a file, a network connection, and a registry, and edges corresponding to the system call events. Claim 3 A method for analyzing cyber attack flow according to claim 1, wherein the step of mapping the threat events to nodes of the system graph includes the step of mapping the threat events to nodes corresponding to objects related to the threat events in the system graph. Claim 4 A cyber attack flow analysis method according to claim 3, wherein the step of mapping the threat events further includes the step of mapping the threat events to nodes of processes associated with nodes of objects to which the threat events are mapped. Claim 5 A method for analyzing cyber attack flow according to claim 1, wherein the step of obtaining the attack graph comprises: a step of generating a process graph by extracting edges representing the relationship between the nodes of the processes and the processes from the system graph; and a step of obtaining the attack graph from the process graph. Claim 6 A method for analyzing cyber attack flow according to claim 5, wherein each of the process nodes of the process graph includes a flag attribute indicating whether the process is malicious and a path_state attribute indicating the possibility of participating in an attack. Claim 7 In claim 6, the step of obtaining the attack graph comprises: a step of updating the path_state of each node by performing forward tracing proceeding from the root node toward the leaf node; and a step of obtaining the attack graph by performing backward tracing proceeding from the leaf node toward the root node, a method for analyzing cyber attack flow. Claim 8 A method for analyzing cyber attack flow according to claim 7, wherein the step of updating the path_state of each node by performing the Forward Tracing includes the step of setting the path_state of the current node to MALICIOUS when the path_state of the parent node is MALICIOUS or the flag of the current node is MALICIOUS. Claim 9 A method for analyzing cyber attack flow according to claim 7, wherein the step of obtaining the attack graph by performing the Backward Tracing includes the step of connecting the current node and the child node to include them as part of the attack graph when the path_state of the current node is MALICIOUS and the path_state of the child node is MALICIOUS. Claim 10 A method for analyzing cyber attack flow according to claim 1, wherein the step of acquiring the attack graph comprises: a step of searching the system graph whenever a new threat event occurs to identify a process associated with the threat event; and a step of acquiring the attack graph based on the identified process. Claim 11 A method for analyzing cyber attack flow according to claim 10, wherein the step of acquiring the attack graph comprises: a step of updating the attack graph by mapping the threat event to the identified process when the identified process is included in the existing attack graph; and a step of updating the attack graph by searching the system graph to identify a process among the ancestor processes of the identified process to which the threat event is mapped, and adding the identified process to the attack graph to which the identified ancestor process belongs, when the identified process is not included in the existing attack graph. Claim 12 A method for analyzing cyber attack flow according to claim 11, wherein the step of acquiring the attack graph comprises the step of acquiring a new attack graph having the identified process as a root node when the identified process is not included in the existing attack graph and the identified ancestor process does not exist. Claim 13 A cyber attack flow analysis method according to claim 1, further comprising the step of outputting the acquired attack graph through a display. Claim 14 A cyber attack flow analysis system comprising at least one processor and memory, wherein the at least one processor collects threat events from security software according to the execution of instructions stored in the memory, generates a system graph representing the interrelationships between system objects from a system event log, maps the threat events to nodes of the system graph, and obtains an attack graph from the system graph in which the threat events are mapped. Claim 15 A computer-readable, non-transient storage medium that stores instructions for performing the cyber attack flow analysis method described in paragraph 1.

Images