System and method for inquiring ioc information by p2p protocol

Abstract

The method of inquiring and storing IoC information of the present disclosure is performed by at least one user terminal in an environment including a plurality of user terminals and an IoC information providing server. The user terminals are respectively provided with an event processing module, an IoC inquiry agent module, an encryption socket communication module and a P2P socket communication module.The method comprises a first step of determining IoC information to be identification target when an event occurs, which is performed by the event processing module; a second step of requesting the encryption socket communication module and the P2P socket communication module to inquire the IoC information, which is performed by the IoC inquiry agent module; a third step of requesting IoC information to the IoC information providing server, which is performed by the encryption socket communication module; a fourth step of requesting IoC information to a P2P socket communication module of the other user terminal, which is performed by the P2P socket communication module; and a fifth step of storing IoC information receiving first among the IoC information requested at the third and fourth steps.

Description

CROSS REFERENCE TO RELATED APPLICATION[0001]The present application claims priority to Korean Application No. 10-2017-0167993 filed on Dec. 8, 2017, which is incorporated herein by reference.TECHNICAL FIELD[0002]The present disclosure relates to a method of inquiring and storing Indicator of Compromise (IoC) information, and more specifically, to a method of inquiring IoC information, which reduces data communication traffic as well as response time when the IoC information is inquired.BACKGROUND ART[0003]As cyber security threat increases in the online space recently, various methods for promptly sharing information on various kinds of security threats have been developed. A method most frequently used among them is sharing Indicator of Compromise (IoC) information by which many security products promptly identify and block the threat.[0004]The IoC information includes information for performing a security function, such as IP information, hostname information, URL information, has...

AI Technical Summary

Benefits of technology

The present patent aims to solve the issues and disadvantages of conventional techniques for inquiring IoC information. The technical effect of this patent is to provide a method that can efficiently and accurately respond to security threats.

Problems solved by technology

According to the conventional technique like this, the communication span for exchanging the IoC information, i.e., the distance to the security equipment or the security software which performs the security function, is long; the physical resources increase; and transmitting and receiving the IoC information takes long time.

An on-demand method of inquiring information when needed, other than the batch process, is disadvantageous in that a server or a communication circuit which provides the information is heavily loaded since the information that should be identified is received too much from the security equipment or software for performing the security function.

In the connection process like this, if the amount of data to be inquired increases due to the increasing number of users, i.e., if the number of queries increases, the server resources may not manage the load, and the data inquiry may not be performed smoothly, and therefore, too much cost is required to solve the problem since the server resources should be increased.

Further, a great deal of damage may occur if the increasing users and loads are handled inappropriately.

Images