Method for detecting and analyzing time-series data based on cyber threat framework

Abstract

To provide a method for generating virtual threat scenarios based on data for API events occurring time-sequentially and analyzing and coping with a cyber threat in advance through comparing the virtual threat scenarios with past records.SOLUTION: A method includes: a determination step of determining a target API event in an event set stored in a cloud environment; a mapping step of mapping the target API event to a threat behavior type on the basis of a threat behavior profile; a generation step of generating a threat scenario of the target API event on the basis of the threat behavior type; a calculation step of calculating a degree of matching and a risk for the threat scenario based on a database; a risk grade determination step of determining a risk grade of the threat scenario based on the degree of matching and the risk; a threat behavior determination step of determining a predicted threat behavior corresponding to the threat scenario based on the risk grade; and a solution providing step of generating and providing a prompt based on the threat behavior.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to a method for detecting and analyzing time series data based on a cyber threat framework, and more specifically, to a method for generating hypothetical threat scenarios based on API event data that occurs in a time series, and comparing the scenarios with past records to enable pre-analysis and countermeasures against cyber threats. [Background technology]

[0002] In recent years, cyber security threats, including new and mutated malicious codes, have become increasingly sophisticated and are causing more damage. In particular, attacks that exploit server vulnerabilities are progressing as zero-day attacks, which are a method of easily and quickly penetrating servers through vulnerabilities in web applications.

[0003] In order to reduce such damage as much as possible and respond quickly, we are working in parallel to improve our response technology through the construction of multidimensional patterns and various types of combined analyses, but recently cyber attacks tend to be more of an increasing threat rather than being properly responded to within the scope of control.

[0004] Such cyber attacks go beyond traditional ICT (Information and Communication Technology)-based facilities, posing a threat to finance, transportation, the environment, health, and other areas that directly affect our lives.

[0005] One of the foundational technologies for detecting and responding to most existing cyber security threats is to generate a pattern database for cyber attacks or malicious code in advance and utilize appropriate monitoring technologies where data flow is needed.

[0006] Such cyber security threat detection and response technologies have evolved based on methods of identifying and responding to threats when data streams or code that match monitored patterns are detected.

[0007] However, while such conventional technology has the advantage of being able to detect threats quickly and accurately when they match pre-established patterns, it has the problem that it takes a very long time to analyze new or variant threats where the patterns are not established or which circumvent the threats.

[0008] As a prior art in this regard, Korean Patent Registration No. 10-2419451 discloses an "Artificial Intelligence-Based Threat Analysis Automation System and Method."

[0009] The above prior art relates to an artificial intelligence-based threat analysis automation system and method, and is characterized by the fact that it can create an environment in which security control personnel (controllers) can focus on analyzing and responding to only important security events by automating the tasks of automatically generating and verifying playbooks and strengthening playbooks to suit the characteristics of the security control center, including a playbook automatic generation module that generates a template-based playbook using an AI learning model, a playbook verification and management module that verifies and manages the validity of the playbook generated by the playbook automatic generation module, a playbook DB that stores playbooks verified by the playbook verification and management module, and a playbook execution module that matches and automatically executes playbooks in the playbook DB to respond to detected events.

[0010] However, in the case of such prior art, analysis is only performed on the generated playbook. However, because these systems are designed to handle these threats, they are limited in that they cannot respond to new and ever-changing cybersecurity threats. [Prior art documents] [Patent documents]

[0011] [Patent Document 1] Republic of Korea Patent No. 10-2419451 Summary of the Invention [Problem to be solved by the invention]

[0012] The present invention aims to analyze large amounts of cybersecurity data and provide insight into attack trends, techniques, and threat methods so that responses can be made. [Means for solving the problem]

[0013] The method for detecting and analyzing time series data based on the cyber threat framework of the present invention includes an event determination step of determining at least one target API event according to a predetermined condition from an event set including a plurality of events stored in a cloud environment; a mapping step of mapping the target API event to a threat action type corresponding to at least one technique included in a threat action analysis matrix based on a pre-stored threat action profile - the threat action analysis matrix is ​​composed of a plurality of tactical groups and at least one technique included in the tactical group - a scenario generation step of combining at least one of the target API events based on the threat action type to generate at least one threat scenario; a numerical value calculation step of calculating a degree of agreement and a degree of risk of the threat scenario based on a database; a risk grade determination step of determining a risk grade of the threat scenario based on at least one of the degree of agreement and the risk grade; a threat action determination step of determining a predicted threat action corresponding to the threat scenario based on the risk grade; and a solution provision step of generating and providing a prompt based on the predicted threat action.

[0014] In one embodiment of the present invention, the event determination step may be characterized by filtering the event set according to classification conditions including at least one of a region, a time, an account, and an action type to determine the target API event.

[0015] In one embodiment of the present invention, the mapping step may be characterized by mapping the target API event to a type of threat action and an individual threat action corresponding to the target API event based on the threat action profile.

[0016] In one embodiment of the present invention, the numerical value calculation step may include a degree of similarity calculation step of comparing the threat scenario with past scenarios already stored in the database, and calculating a degree of similarity between the types of threat behavior included in the past scenario and the target API events included in the threat scenario.

[0017] In one embodiment of the present invention, the numerical value calculation step may be characterized by including a risk calculation step in which the main server calculates the risk of the threat scenario according to the type of threat behavior included in the threat scenario.

[0018] In one embodiment of the present invention, the step of determining the risk grade may be characterized by determining the risk grade of the threat scenario based on a total risk value calculated based on the degree of match and the risk level.

[0019] In one embodiment of the present invention, the step of providing the solution may comprise generating and providing a security enhancing solution prompt corresponding to the determined predicted threat behavior.

[0020] In one embodiment of the present invention, the step of providing the solution may be characterized by generating and providing a system recovery prompt corresponding to the determined predicted threatening behavior.

[0021] In one embodiment of the present invention, the solution providing step may be characterized by generating and providing analysis prompts corresponding to the determined predicted threat behaviors and the threat scenarios.

[0022] In one embodiment of the present invention, the providing a solution step may comprise generating and providing educational prompts corresponding to the determined predicted threatening behaviors.

[0023] In one embodiment of the present invention, the step of determining the risk grade may be characterized in that the risk grade of the threat scenario is determined based on a total risk value calculated by reflecting respective weights on the degree of match and the degree of risk.

[0024] In one embodiment of the present invention, The decision stage of the above threat action is as follows: The method may include a selection step of selecting one of the plurality of threat scenarios based on the risk grade, an extraction step of extracting a past scenario having the highest degree of match with the selected threat scenario, and a determination step of determining a predicted threat action by comparing the extracted past scenario with a target API event included in the selected threat scenario. Effect of the Invention

[0025] According to the method for detecting and analyzing time series data based on the cyber threat framework of the present invention,

[0026] It has the advantage of analysing large amounts of cybersecurity data and providing insight into attack trends, techniques and threat methods, enabling it to respond. [Brief description of the drawings]

[0027] [Figure 1] 1 is a conceptual diagram showing a network environment of the present invention; [Diagram 2] 1 is a table showing types of threat behaviors and individual threat behaviors of the present invention. [Diagram 3] 2 is a flow chart illustrating the detection and analysis method of the present invention. [Figure 4] 1 is a table showing the mapping results of the present invention. [Diagram 5]FIG. 2 is a conceptual diagram illustrating an example of generation of a threat scenario according to the present invention. [Figure 6] 3 is a flow chart showing a step of calculating values ​​according to the present invention; [Figure 7] FIG. 2 is a conceptual diagram showing an example of calculation of values ​​and grades according to the present invention. [Figure 8] FIG. 2 is a conceptual diagram illustrating an example of the determination of a threatening behavior of the present invention. [Figure 9] 4 is a flow chart illustrating the threat behavior determination step of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0028] Hereinafter, the embodiments disclosed herein will be described in detail with reference to the accompanying drawings, in which the same or similar components are given the same reference numerals regardless of the drawing reference numerals, and duplicated descriptions thereof will be omitted. In addition, in describing the embodiments disclosed herein, if a detailed description of related publicly known technology is determined to make the gist of the embodiments disclosed herein unclear, the detailed description will be omitted.

[0029] Terms including ordinal numbers such as first, second, etc. may be used to describe various components, but the above components are not limited by the above terms. The above terms are used only to distinguish one component from another component.

[0030] A singular expression includes a plural expression unless the context clearly dictates otherwise.

[0031] In this application, the steps described may be performed in any order except where a specific causal relationship dictates that the steps be performed in the listed order.

[0032] In this application, the terms "comprise" or "have" and the like are intended to specify the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, but should be understood as not precluding the presence or additional possibility of one or more other features or numbers, steps, operations, components, parts, or combinations thereof.

[0033]

[0034] The present invention will now be described with reference to the accompanying drawings.

[0035] FIG. 1 is a conceptual diagram showing a network environment according to the present invention, and FIG. 2 is a table showing types of threat acts and individual threat acts according to the present invention.

[0036] Explained together with FIG. 1 and FIG. 2, a system for detecting and analyzing time series data based on the cyber threat framework of the present invention may include a cloud server 10, a database 20, a user terminal 30, an AI engine 40, and a main server 50.

[0037] In this case, the cloud server 10, the database 20, the user terminal 30, the AI ​​engine 40, and the main server 50 can be connected to each other based on communication, i.e., a network. Here, the network is not limited in communication method, and can include not only communication methods using communication networks (e.g., mobile communication networks, wired Internet, wireless Internet, and broadcasting networks) that the network can include, but also short-range wireless communication, as well as communication methods using electrical signals (analog signals, digital signals, serial signals, and Pulse Width Modulation).

[0038] The cloud server 10 refers to a server for cloud services, which are services that are outsourced to an external party rather than having servers and storage devices installed within a company. Here, the cloud server 10 may include public data centers (Amazon AWS, Microsoft Azure) for public (open) clouds and in-house data centers for private (closed) clouds.

[0039] The cloud server 10 may be embodied as a computer device or multiple computer devices that provide instructions, codes, files, contents, services, etc. The cloud server 10 may communicate with other servers and terminals that constitute a system and transmit and receive information through a network.

[0040] Such a cloud server 10 can store all data and infrastructure of the users using the server, and in this case, a particular user or user group can use only one cloud server 10, or multiple cloud servers 10 can be used.

[0041] In this case, preferably, when multiple cloud servers 10 are used, an integrated control server for managing data distributed and stored in the multiple cloud servers 10 may be provided separately, and more preferably, the main server 50 described below may act as the integrated control server.

[0042] The user terminal 30 is an entity that connects to data of a specific company or organization and reads and writes data stored in the cloud server 10. In this case, the user terminal 30 that is permitted to connect to the corresponding cloud server 10 may generally be a member of the company, organization, or group, and when a user who is not permitted to connect connects to the cloud server 10 of the corresponding company, organization, or group, this is called a cyber threat or attack, i.e., hacking.

[0043] The user terminal 30 may be embodied as a computer device or multiple computers that provide instructions, code, content, services, etc. The cloud server 10 may communicate with other servers and terminals that constitute the system through a network to transmit and receive information.

[0044] The database 20 serves as a storage medium for storing data, and preferably, the database 20 of the present invention can store cyber threats that have occurred in the past, i.e., hacking scenarios.

[0045] Such database 20 may be embodied as a computer device or multiple computer devices that provide instructions, codes, files, contents, services, etc. Also, database 20 may communicate with other servers and terminals that constitute a system through a network to transmit and receive information.

[0046] In addition, it can store data on actions (defensive measures) that defenders (administrators) can take to prevent and detect attacks against the cyber threat in question, as well as information on publicly named hacking groups and analysis of their attack techniques.

[0047] A scenario here is a process that outlines the steps that an attacker would take to carry out a cyber attack, and is a chronological list of the actions that an attacker will take at each stage.

[0048] Therefore, basically, the database 20 can store scenarios that have occurred in the past, i.e., past scenarios, and preferably, the scenarios here can be kill chains stored in MITRE Att&CK (Adversarial Tactics, Techniques, and Common Knowledge). Specifically, MITRE ATT&CK is a cybersecurity-related knowledge base created by the MITRE Corporation, and can be composed of tactics that include categories for the goals and each stage of cyber attackers, and techniques that are specific methods for each tactic.

[0049] Thus, a threat behavior is included in at least one Tactic group and corresponds to at least one Technique included in the Tactic group.

[0050] In addition, the scenarios stored in the database 20 are data that classify and list information on the attack techniques of various attack groups by analyzing the adversary behaviors used by attackers from the perspective of tactics and techniques after observing actual cyber attack cases. In detail, a scenario is a method by which an attacker achieves at least one tactic group, which is the goal of the attack, and includes at least one technique for each stage. For example, types of threat behaviors that correspond to techniques include spearphishing via email, drive-by compromise, and credential dumping.

[0051] Possible attacks include Man-in-the-Middle (MITM) attacks and command and control over alternative protocols.

[0052] The AI ​​engine 40 refers to a conventional artificial intelligence (AI) engine and may refer to various conventionally provided AI engines 40. Such an AI engine 40 may provide functions such as data filtering and mapping.

[0053] The AI ​​engine 40 may be embodied as a computer device or multiple computer devices that provide instructions, codes, files, contents, services, etc. In addition, the AI ​​engine 40 may communicate with other servers and terminals that constitute a system through a network to transmit and receive information.

[0054] As described above, the main server 50 performs the function of integrated control over multiple cloud servers 10, while also detecting and analyzing cyber threats and providing various prompts to authorized user terminals 30, i.e., the user terminals 30 of defenders (administrators).

[0055] The main server 50 can be embodied as a computer device or multiple computer devices that provide instructions, codes, files, contents, services, etc. The main server 50 can communicate with other servers and terminals that constitute the system and transmit and receive information through a network.

[0056] Fig. 3 is a flow chart showing the detection and analysis method of the present invention, Fig. 4 is a table showing the mapping result of the present invention, Fig. 5 is a conceptual diagram showing an example of the generation of a threat scenario of the present invention, Fig. 6 is a flow chart showing the value calculation step of the present invention, Fig. 7 is a conceptual diagram showing an example of the calculation of values ​​and grades of the present invention, Fig. 8 is a conceptual diagram showing an example of the determination of threat behavior of the present invention, Fig. 9 is a flow chart showing the threat behavior determination step of the present invention.

[0057] Referring to Figures 3 to 9, the method for detecting and analyzing time series data based on the cyber threat framework of the present invention may include an event determination step S10, a mapping step S20, a scenario generation step S30, a numerical value calculation step S40, a risk grade determination step S50, a threat behavior determination step S60, and a solution provision step S70.

[0058] In the event determination step S10, the main server 50 can determine at least one target API event according to a predetermined condition in an event set including a plurality of events stored in a cloud environment established through the cloud server 10.

[0059] The cloud server 10 stores all actions (events) that occur on the user terminal 30 in the web pages or applications of the corresponding company, organization, or group in the form of an API, and at this time, an event set is generated based on multiple consecutive events that occur on the user terminal 30.

[0060] Therefore, an event set including a plurality of events can be stored in the cloud environment, and in this case, target API events to be detected and analyzed can be determined according to predetermined conditions from among the events included in the stored event set.

[0061] At this time, it is preferable that filtering is performed on the event set according to a predetermined condition to determine a plurality of target API events.

[0062] In one embodiment, the target API event may be determined by filtering the plurality of event sets according to classification conditions including at least one of a region, a time, an account, and an action type.

[0063] Here, the region can be defined as the region where the API was generated, and the region can be identified based on the IP address that generated the API. Therefore, the saved event set can be filtered by the region of generation, and only events generated in a specific region can be determined as target API events.

[0064] The time can be said to be the time when the API was generated, and the stored event set can be filtered according to the generation time period to determine only the events generated in a specific time period as the target API events.

[0065] The account can be said to be the account where the API was generated, and it is possible to filter only specific accounts among the accounts that connected to the relevant website or application and performed actions, and determine that only events generated by a specific account in the event set are the target API events.

[0066] The action type corresponds to the above-mentioned threat action type, and events including a specific action type can be filtered to determine the target API event. For example, as shown in Figure 2, events including the action type "defense evasion," that is, the action type of defense evasion, can be filtered.

[0067] As a more detailed example, the target API event can be determined by filtering only events that include individual threat actions included in the corresponding threat action type (defense evasion).

[0068] Next, in a mapping step S20, the main server 50 maps the target API event to a type of threat behavior corresponding to at least one technique included in the threat behavior analysis matrix based on the threat behavior profile pre-stored in the database 20. Here, the threat behavior analysis matrix can be called MITRE ATT&CK, a cybersecurity-related knowledge base developed by the MITRE Corporation to deal with cyber threats, and more preferably, a matrix combining tactics and techniques, which are core components of MITRE ATT&CK.

[0069] Here, mapping refers to the process of matching a target API event with a type of threat behavior, or more preferably, the process of finding and linking a target API event with a type of threat behavior that corresponds to the target API event.

[0070] More specifically, based on the threat behavior profile, the target API events can be mapped to corresponding threat behavior types and individual threat behaviors.

[0071] Here, the threat behavior profile includes the threat behavior types stored in the database 20 described above, and individual threat behaviors belonging to the corresponding threat behavior types.

[0072] Therefore, if there is an individual threat behavior that matches a target API event, a threat behavior type that includes the individual threat behavior can be mapped to the target API event.

[0073] In this case, one individual threat act may be included in only one threat act type, but multiple threat act types may include all of the types of a particular threat act, and there may preferably be multiple individual threat acts to which a corresponding target API event can be mapped.

[0074] Therefore, it is preferable to map the types of threat behaviors of the target API event using the above-mentioned AI engine 40, so that all types of threat behaviors that can correspond to the target API event can be mapped.

[0075] Next, in a scenario generation step S30, the main server 50 generates at least one threat scenario by combining at least one of the target API events based on the type of the threat behavior.

[0076] In other words, by combining target API events having different types of threat behavior to generate a threat scenario, the types of threat behavior are combined like the scenarios stored in database 20 described above.

[0077] In this case, all possible threat scenarios can be generated by combining at least one of the specified target API events, and in this case, a threat scenario can be a combination of types of threat behaviors corresponding to at least one target API event.

[0078] Therefore, threat scenarios can desirably be generated using an AI engine 40, which can rapidly generate threat scenarios for all possible combinations.

[0079] In the value calculation step S40, the main server 50 calculates the degree of coincidence and the degree of danger of the above threat scenarios based on the database 20.

[0080] Preferably, the function of calculating the degree of coincidence between the past scenarios stored in the database 20 and the threat scenario is performed, and the degree of danger of the threat scenario is calculated according to the degree of danger of each type of threat behavior stored in the database 20.

[0081] In this case, the risk level of the threat scenario may be the maximum value among the risk levels of each of a plurality of types of threat behavior included in the threat scenario.

[0082] In one embodiment, the value calculation step S40 may include a coincidence calculation step S41 and a risk calculation step S42.

[0083] In the matching calculation step S41, the main server 50 compares the above threat scenario with past scenarios already stored in the database 20, and calculates the matching degree between the type of threat behavior included in the above past scenario and the target API event included in the above threat scenario.

[0084] In other words, the past scenarios stored in database 20 refer to scenarios of attacks, i.e., threat acts, that have been carried out by attackers in the past, or in other words, a chronological list of types of threat acts that attackers have actually carried out in the past and individual threat acts included in those types of threat acts.

[0085] Therefore, the past scenario includes a plurality of types of threat behaviors, and the threat scenario also includes at least one target API event. Therefore, by calculating the degree of match between the past scenario and the threat scenario, it is possible to identify the threat scenario that has the highest degree of match with the past scenario stored in the database 20 among the threat scenarios.

[0086] At this time, the degree of match can be quantified and displayed, and the degree of match between the past scenario and the threat scenario can be calculated as the degree of match.

[0087] Here, it is preferable to calculate the degree of match between all past scenarios stored in the database 20 and the threat scenario, and the maximum value of the calculated degrees of match can be taken as the degree of match of the threat scenario.

[0088] In the risk calculation step S42, the main server 50 can calculate the risk of the threat scenario according to the type of threat behavior included in the threat scenario.

[0089] Here, the risk level of a threat scenario may be the maximum risk level among the types of threat behaviors included in the corresponding threat scenario.

[0090] Therefore, in calculating the risk level, a process of presetting the risk levels of all types of threatening behaviors included in the database 20 may be performed.

[0091] Thereafter, the types of threat acts included in the corresponding threat scenario are compared with the database 20, all the risk levels for the types of threat acts included in the threat scenario are determined, and the maximum value among them can be calculated as the risk level of the corresponding threat scenario.

[0092] As an example, if a threat scenario includes only the types of threat behaviors up to initial access, the risk may be relatively low, but if the threat scenario includes credential access, the risk may be higher than a threat scenario that includes only initial access.

[0093] In a risk grade determining step S50, the main server 50 can determine a risk grade of the threat scenario based on at least one of the degree of match and the risk.

[0094] The risk grade can be determined based on how closely the threat scenario matches past scenarios (degree of similarity) and how dangerous the types of threat acts included in the threat scenario are (degree of danger).

[0095] Here, based on the principle that no additional restrictions are placed on the method of determining the risk grade using the degree of agreement and the degree of risk calculated for the threat scenario, preferably at least one of the degree of agreement and the degree of risk, preferably the higher the degree of agreement and the degree of risk, the higher the risk grade can be set.

[0096] At this time, in the risk grade determination step S50, the risk grade of the threat scenario can be determined based on at least one of the degree of agreement and the degree of risk, but more preferably, the risk grade of the threat scenario can be determined based on the degree of agreement and the degree of risk, in other words, by reflecting both the degree of agreement and the degree of risk.

[0097] As an example, a total risk value may be calculated based on the degree of coincidence and the risk level, and a risk grade of the threat scenario may be determined based on the total risk value.

[0098] In this case, when calculating the overall risk value, the weighting values ​​of the degree of similarity and the degree of risk can be set equally, but as one embodiment, the overall risk value can be calculated by reflecting the respective weighting values ​​of the degree of similarity and the degree of risk.

[0099] In other words, the weights of the degree of match and the degree of danger can be different from each other, and the weights assigned to the degree of match and the degree of danger are values ​​that can be set by the administrator (defender) without any separate restrictions.

[0100] Therefore, a risk grade of each threat scenario can be set based on a total risk value calculated by applying weights to the degree of agreement and the risk.

[0101] In a threat behavior determination step S60, the main server 50 determines a threat behavior corresponding to the above threat scenario based on the above danger grade.

[0102] Here, the threat behavior determination performed in the threat behavior determination step S60 may preferably be to determine a threat behavior (target API event) that belongs to the threat scenario with the highest danger grade and a predicted threat behavior that can be additionally included in the threat scenario.

[0103] In other words, the threat behavior determination step S60 can be a step of determining predicted threat behaviors, which are individual threat behaviors that are not included in the threat scenario but are expected to be included additionally when judged based on past scenarios.

[0104] As an example, the threat behavior determination step S61 may include a selection step S61, an extraction step S62, and a determination step S63.

[0105] In the selection step S61, the main server 50 selects one of the threat scenarios based on the threat grade. Preferably, the threat scenario with the highest threat grade is selected, or only the threat scenarios with the highest threat grades can be selected by sorting the threat grades in descending order.

[0106] In the extraction step S62, the main server 50 extracts the past scenario that has the highest degree of matching with the selected threat scenario. In the above-mentioned degree of matching calculation step S41, all degrees of matching between the threat scenario and the past scenarios are calculated, and the maximum value of the calculated degrees of matching is the degree of matching of the threat scenario. Therefore, the past scenario that is determined to have the highest degree of matching with the corresponding threat scenario is extracted.

[0107] In a determination step S63, the main server 50 compares the types of threat behaviors included in the extracted past scenarios and the selected threat scenario to determine a predicted threat behavior.

[0108] Here, the predicted threat behavior refers to an individual threat behavior included in the type of threat behavior that is not included in the threat scenario among the extracted past scenarios.

[0109] In other words, there may be types of threat acts among the extracted past scenarios that are not included in the threat scenario, and since the types of threat acts include individual threat acts, all individual threat acts that can be predicted to be performed by an attacker according to the corresponding threat scenario are determined as predicted threat acts.

[0110] In a solution providing step S70, the main server 50 can generate a prompt based on the determined predicted threat behavior and provide it to the user terminal 30.

[0111] As an example, in the solution providing step S70, the main server 50 can generate and provide to the user terminal 30 a security enhancement solution prompt corresponding to the determined predicted threat behavior.

[0112] Here, the security strengthening solution prompt may be a prompt related to a solution that corresponds to the determined predicted threat behavior, complements vulnerabilities, and strengthens security settings, which may include security setting guides, patch and update guides, optimal setting methods for security tools, etc.

[0113] Additionally, security enhancement solutions can provide intelligence on how to detect and respond to determined and predicted threat behavior, including improved threat detection algorithms, methods for applying anomaly-based detection, and standard operating procedures (SOPs) for rapid response.

[0114] In one example, in the solution providing step S70, the main server 50 can generate a system recovery prompt corresponding to the determined predicted threat behavior and provide it to the user terminal 30.

[0115] Here, the system recovery prompt may include guidance required for system recovery and best practices for the recovery process, and may further include guidance on how to minimize additional threats that may occur due to the predicted threat actions determined above, and may include guidelines necessary to restore the system to a safe state.

[0116] In one example, in the solution providing step S70, the main server 50 can generate and provide to the user terminal 30 an analysis prompt corresponding to the determined predicted threat behavior and the threat scenario.

[0117] Here, the analysis prompt can provide detailed log information for the individual API events involved in the threat scenario, providing information on which TPS were used, which users and systems were targeted, what data was compromised, and what parts of the system were vulnerable.

[0118] In one example, in the solution providing step S70, the main server 50 can generate and provide to the user terminal 30 an educational prompt corresponding to the determined predicted threatening behavior.

[0119] Here, the educational prompt may be a message or material that educates the user about the determined predicted risky behavior, and the educational prompt may include an explanation, important points, safe usage, etc. regarding the determined predicted risky behavior.

[0120]

[0121] The technical features disclosed in each embodiment of the present invention are not limited to the corresponding embodiment, and as long as they are not mutually incompatible, the technical features disclosed in each embodiment may be combined and applied to different embodiments.

[0122] Therefore, although each embodiment will be described focusing on its respective technical features, as long as the technical features are not mutually exclusive, they can be combined and applied.

[0123] The present invention is not limited to the above-described embodiments and the accompanying drawings, and various modifications and variations are possible in the light of those having ordinary skill in the art to which the present invention pertains. Therefore, the scope of the present invention should be determined not only by the claims of this specification, but also by equivalents to the claims. [Explanation of symbols]

[0124] 10: Cloud Server 20: Database 30: User terminal 40: AI engine 50: Main server

Claims

1. 1. A method for detecting and analyzing time series data based on a cyber threat framework, comprising: an event determination step of determining at least one target API event according to a predetermined condition from an event set including a plurality of events stored in the cloud environment; a mapping step of mapping the target API event to a type of threat behavior corresponding to at least one technique included in a threat behavior analysis matrix based on a pre-stored threat behavior profile, the threat behavior analysis matrix being composed of a plurality of tactical groups and at least one technique included in the tactical group; a scenario generation stage in which at least one of the target API events is combined based on the type of the threat behavior to generate at least one threat scenario; A numerical calculation step of calculating the degree of coincidence and the degree of danger of the above threat scenarios based on the database; a risk grade determining step of determining a risk grade of the threat scenario based on at least one of the match degree and the risk degree; determining a predicted threat action corresponding to the threat scenario based on the risk grade; and a solution providing step of generating and providing a prompt based on the predicted threat behavior.

2. The decision stage of the above events is The method is characterized in that the target API event is determined by filtering the event set according to classification conditions including at least one of a region, a time, an account, and a type of an action. The method of claim 1.

3. The above mapping step: Mapping the target API event to a type of threat behavior and an individual threat behavior corresponding thereto based on the threat behavior profile. The method of claim 1.

4. The calculation stage of the above values ​​is as follows: The method further comprises a step of calculating a degree of coincidence between a type of a threat behavior included in the past scenario and a target API event included in the threat scenario by comparing the past scenario and the threat scenario already stored in the database. The method of claim 1.

5. The calculation stage of the above values ​​is as follows: The method further comprises a step of calculating a risk level of the threat scenario according to a type of a threat action included in the threat scenario, the step including: The method of claim 1.

6. The above risk grade determination steps are as follows: determining a risk grade of the threat scenario based on a total risk value calculated based on the degree of coincidence and the risk level; The method of claim 1.

7. The solution provision stages above are: generating and providing a security enhancement solution prompt corresponding to the determined predicted threat behavior; The method of claim 1.

8. The solution provision stages above are: generating and providing a system recovery prompt corresponding to the determined predicted threat behavior; The method of claim 1.

9. The solution provision stages above are: generating and providing analysis prompts corresponding to said determined predicted threat actions and said threat scenarios. The method of claim 1.

10. The solution provision stages above are: generating and providing educational prompts corresponding to the determined predicted threatening behaviors. The method of claim 1.

11. The above risk grade determination steps are as follows: determining a risk grade of the threat scenario based on a total risk value calculated by applying weights to the degree of coincidence and the degree of risk, The method according to claim 6.

12. The decision stage of the above threat action is as follows: a selection step of selecting one of the plurality of threat scenarios based on the risk grade; An extraction stage, in which historical scenarios that have the highest degree of matching with the selected threat scenarios are extracted; A determination step of determining a predicted threat action by comparing the extracted past scenario with a target API event included in the selected threat scenario. The method of claim 1.

Images