Device and method for automatically analyzing malicious event logs

Abstract

A method and device for automatically analyzing malicious event logs, which are endpoint threatening events, by applying an AI-based chatbot engine is disclosed. The endpoint automatic analysis method processes logs by grouping them by process for efficient analysis of the event logs, generates sentences for process actions through a neuro-linguistic programming technique for AI analysis, digitizes actual malicious actions to use them as learning data for AI model learning, embodies a learning system based on a transformer algorithm to learn the learning data, and checks the grouped event logs in real time through an automatic event maliciousness analyzer based on a BERT and LSTM algorithm to analyze actual malicious actions, and detects malicious actions that are above a certain similarity and automatically determines them as threatening events.

Description

[Technical Field]

[0001] The present invention relates to an automatic analysis method for malicious event logs, and more particularly to a method and apparatus for automatically analyzing malicious event logs, which are endpoint threatening events, by applying an artificial intelligence (AI)-based chatbot engine. [Background technology]

[0002] As information and communications infrastructure continues to expand, various forms of security threats using information and communications (IT) infrastructure are rapidly increasing. Recently, these advanced persistent threats (APTs) have frequently led to the leakage of important information within companies through malicious code, as well as to information leaks caused by internal users accessing non-work sites, which reduces their focus on work. Measures to prevent this are urgently needed.

[0003] In order to respond to security threats that are causing continuous damage, it is necessary to analyze a huge amount of malicious code and threat-related data, and in order to effectively analyze related data, it is necessary to develop a malicious code learning and classification module that analyzes images through automatic learning.

[0004] Meanwhile, foreign and domestic APT solution manufacturers related to existing malicious code detection and response technologies are offering various types of response solutions to deal with new or mutated malicious code, but the reality is that it is not easy to respond in real time to security threats that are becoming increasingly large and intelligent.

[0005] For this reason, endpoint detection and response (EDR) solution developers who are researching malicious code detection technology that utilizes machine learning are actively using artificial intelligence (AI) technology to detect some cyber threats that cannot be detected by existing solutions such as signature-based and rule-based solutions.

[0006] Additionally, endpoint breach incident response solutions are being actively introduced to collect information from endpoint devices and automatically detect and respond to signs of cyber attacks in real time through correlation analysis and machine learning.

[0007] Additionally, various threat intelligence tools for distributed remote forensics are being developed as a proactive response technology against malicious activities on business personal computers (PCs). Furthermore, various static application security testing (SAST) tools that can test the security of software applications developed in various languages ​​such as C / C++, Ruby, and Python are also being developed.

[0008] However, in order to effectively analyze and respond to the aforementioned malicious code and threat attacks, it would be most desirable to directly analyze the malicious code within an agent installed on a PC, terminal, server, etc., but no such solution has been proposed to date. Summary of the Invention [Problem to be solved by the invention]

[0009] The object of the present invention is to provide an endpoint security solution that can automatically perform automatic analysis and detection of threatening events at an endpoint by utilizing a chatbot engine.

[0010] Another object of the present invention is to provide an endpoint automatic analysis device and method that can perform malicious event detection in conjunction with endpoint event detection rules, by constructing an ElasticSearch database management system (DBMS), which is a large-capacity database (DB) for constructing event log datasets, constructing a transformer network and LSTM (long short-term memory) network-based learning system for automatic analysis and detection of threat event logs, and providing an automated behavior event analysis function that can effectively classify malicious behavior events using a text classification function based on this.

[0011] Another object of the present invention is to provide an AI-based endpoint detection and response (EDR) solution that applies a chatbot engine.

[0012] Another object of the present invention is to provide an endpoint automatic analysis device and method that can effectively automatically analyze malicious event logs by constructing an AI database that stores AI modules and event logs in an analysis server, installing an agent in a user's PC, analyzing events on the user's PC by performing rule matching using the agent, transmitting the analysis results in conjunction with the AI ​​database of the analysis server, performing grouping using process IDs and session information, generating sentences in the order of process actions in the order they are performed, transmitting the sentences to the AI ​​database, and constructing a data set.

[0013] Another object of the present invention is to provide an endpoint automatic analysis device and method that collects threat event data and event logs through the application of artificial intelligence technology, groups them by process identifier and session identifier, and groups them by process, automatically analyzes the threat process based on artificial intelligence, automatically determines the threat event based on the automatic analysis, and provides the analysis results and process tree of the transformer network to provide detection basis. [Means for solving the problem]

[0014] According to one aspect of the present invention, there is provided an endpoint detection and response (EDR) device for automatically analyzing and detecting events using an artificial intelligence (AI)-based chatbot engine. The device includes a processor and a memory, and the processor processes the event log by grouping it by process for efficient analysis according to at least one instruction stored in the memory, generates sentences for the process actions using a natural language processing (NLP) technique for AI analysis, digitizes actual malicious actions and uses them as learning data for learning an AI model, and implements a learning system based on a transformer algorithm to learn the AI ​​model using the learning data. In order to analyze actual malicious actions, the device checks the grouped event logs in real time using an automatic event maliciousness analyzer based on a bidirectional encoder representations from transformers (BERT) and long short-term memory (LSTM) algorithm, and detects and automatically determines that the malicious action is a threatening event if the target of the malicious action is at least a certain similarity.

[0015] In one embodiment, a deep learning-based chatbot engine for event log classification operates using an action sentence generation and labeling method to train an AI model using threat process actions, is designed with an optimal hierarchy based on performance based on six encoder and decoder layers of the Transformer architecture, is configured to adjust the learning rate according to the learning progress time to optimize the cost required for model training, and may be configured as a model combining a Transformer-based BERT model and a dense layer, and the optimal model may be used based on an F1-score comparison between a traditional recurrent neural network (RNN) model based on LSTM and gated recurrent unit (GRU) and a Transformer-based model.

[0016] In one embodiment, an AI module for event analysis may be linked to an EDR system, where the AI ​​module may be linked to a cloud-based EDR solution to provide an integrated service.

[0017] In one embodiment, the AI ​​modules may be managed by an appliance-type management server located at each site, or may be directly serviced on a cloud-based network.

[0018] Another aspect of the present invention for solving the above technical problems relates to an automatic analysis method for malicious event logs, which comprises constructing an artificial intelligence module and a database for storing event logs in an integrated analysis server, installing an agent at an endpoint, and performing rule matching on the event logs using the agent to analyze the malicious event logs, and includes the steps of: performing grouping on the event logs using a process ID and session information; generating sentences in the order of process actions based on the event logs; and automatically analyzing the malicious event logs at the endpoint based on a dataset included in the sentences generated in the order of actions.

[0019] To solve the above technical problems, a method for automatically analyzing malicious event logs according to another aspect of the present invention includes a step of processing the event logs by grouping them by process for efficient analysis of the event logs; a step of generating sentences for process actions using NLP (Natural Language Processing) techniques for AI analysis; a step of digitizing actual malicious actions and using them as learning data for learning an AI model; a step of creating a learning system based on a Transformer algorithm to train an AI model using the learning data; a step of checking the grouped event logs in real time through an automatic event maliciousness analyzer based on BERT and LSTM algorithms to analyze actual malicious actions; and a step of detecting and automatically determining that the target of malicious actions is a threatening event if it has a certain similarity or higher.

[0020] According to yet another aspect of the present invention for solving the above technical problems, an automatic analysis device for malicious event logs comprises an integrated analysis server configured to construct an artificial intelligence module and a database for storing event logs, an agent installed at an endpoint, and an agent that performs rule matching on the event logs to analyze the malicious event logs. The automatic analysis device comprises a processor and a memory that stores at least one instruction executed by the processor, and the processor is configured to perform the following steps: grouping the event logs using a process ID and session information according to the at least one instruction; generating sentences in order of process actions based on the event logs; and automatically analyzing the malicious event logs at the endpoint based on a dataset included in the sentences generated in order of actions.

[0021] According to yet another aspect of the present invention for solving the above technical problems, the automatic endpoint analyzer for endpoint detection and response (EDR) employs an AI-based chatbot engine, and includes a processor and a memory. The processor is configured to: process the event log by grouping it by process for efficient analysis, generate sentences for the process actions using a natural language processing (NLP) technique for AI analysis, digitize actual malicious actions and use them as learning data for AI model learning, and implement a learning system based on a transformer algorithm to train the AI ​​model using the learning data; and check the grouped event logs in real time using an automatic event maliciousness analyzer based on a bidirectional encoder representations form transformers (BERT) and long short-term memory (LSTM) algorithm to analyze actual malicious actions, and detect and automatically determine that the malicious action is a threatening event if the target of the malicious action is above a certain similarity.

[0022] In one embodiment, the Transformer model for the Transformer algorithm comprises an encoder layer and a decoder layer, and may be configured to generate position information of malicious behavior by calculating the position of a word using the following equation (mathematical formula), which is a cosine function, when the value obtained by adding 1 to the position of the embedding dimension in the embedding vector of each word in the positional encoding of the input layer is odd.

[0023] In one embodiment, the Transformer model for the Transformer algorithm may have an encoder layer and a decoder layer, and may be configured to generate position information of malicious behavior by calculating the position of a word using the following equation (mathematical formula), which is a sine function, when the value obtained by adding 1 to the position of the embedding dimension in the embedding vector of each word in the positional encoding of the input layer is even.

[0024] In one embodiment, the decoder structure including the decoder hierarchy can be trained to predict words at each time point from a sentence matrix, and can be configured to apply a layer that masks future words so that future words cannot be referenced to the earliest stage of the decoder sub-layer. [Effects of the Invention]

[0025] According to the present invention, the device and method for automatically analyzing malicious event logs using an AI-based chatbot engine applies an endpoint detection and response (EDR) solution as a core engine and can be used as an analysis module for solutions that require efficient and rapid classification and analysis of large volumes of logs. It can also be used as a solution that automatically determines whether or not an infringement has occurred when a threatening act occurs using AI, without the need for a professional analyst.

[0026] In addition, the AI-based automatic analysis of the present invention is not limited to endpoint event log analysis, but can be applied to a visualization platform that can test malicious code, greatly increasing the reliability of the analysis results of malicious code and malicious behavior. It has the advantage of being immediately applicable to cloud-based security service products such as SECaaS (security as a service).

[0027] The above-described malicious event log automatic analysis device and method of the present invention can be effectively applied to the following fields: In the APT response field, it can be applied to an on-premise type solution for intelligent persistent threat response; In the EDR solution field, it can be applied to endpoint event behavior analysis, cause analysis, and response solutions; In the SECaaS field, it can be applied to a cloud-based APT and ransomware response solution; and In the security operation field, it can be applied to the visualization field of endpoint threat information for security operation automation. [Brief explanation of the drawings]

[0028] [Figure 1] 1 is a diagram illustrating the main configuration and operating principle of an automatic event analysis and detection system (hereinafter simply referred to as "automatic analysis device") applying an artificial intelligence (AI)-based chatbot engine according to one embodiment of the present invention. [Figure 2] 1 is a diagram illustrating an AI analysis process for threat intrusion that is applied to endpoint detection and response (EDR) that can be adopted in the automatic analysis device of FIG. [Figure 3] 2 is a diagram for explaining an AI-based threatening behavior detection function applied to an EDR that can be adopted in the automatic analysis device of FIG. 1. [Figure 4] 2 is a schematic illustration of an application of an AI analysis module that can be employed in the automatic analysis device of FIG. 1. [Figure 5] FIG. 2 is a schematic diagram illustrating an AI engine for automatic analysis of a chatbot engine-based threat event log that can be employed in the automatic analysis device of FIG. 1. [Figure 6] FIG. 2 is a schematic configuration diagram of an EDR system to which an AI module employing a chatbot engine that can be adopted in the automatic analysis device of FIG. 1 is applied. [Figure 7]1 is a diagram for explaining an EDR solution and an AI module linkage interface that can be adopted in the automatic analyzer of FIG. 1. [Figure 8] 2 is a schematic block diagram of an AI module application configuration for event analysis that can be employed in the automatic analysis device of FIG. 1. [Figure 9] 10 is an exemplary diagram illustrating a process of bundling session IDs and process IDs and grouping them by processor in a method for automatically analyzing a malicious event log (hereinafter simply referred to as an "automatic analysis method") according to another embodiment of the present invention. [Figure 10] FIG. 10 is an exemplary diagram illustrating a malicious event in which normal actions are aggregated to perform ransomware actions in the automatic analysis method of FIG. [Figure 11] 10 is an exemplary diagram illustrating a malicious event in which normal actions are collected and network information is collected or transmitted in the automatic analysis method of FIG. 9. [Figure 12] 10 is an exemplary diagram illustrating a malicious event that does not include "terminated" in the event type in the automatic analysis method of FIG. 9; [Figure 13] FIG. 10 is a block diagram of a Transformer model network architecture that can be employed in the automated analysis method of FIG. [Figure 14] FIG. 14 is an exemplary diagram for explaining the structure of the transformer model of FIG. 13. [Figure 15] FIG. 14 is an exemplary diagram illustrating yet another configuration that can be adopted in the Transformer model of FIG. 13, which is a text classification structure using BERT and a dense layer. [Figure 16] FIG. 16 is an example diagram of text classification using the LSTM of FIG. 15, which can be used in conjunction with or instead of the Transformer model of FIG. 13. [Figure 17] 2 is a block diagram illustrating a form of security service provided by the automatic analysis device of FIG. 1. FIG. [Figure 18] FIG. 2 is a block diagram illustrating a performance evaluation process for AI-based automatic analysis of threatening events in the automatic analysis device of FIG. 1. [Figure 19] FIG. 10 is a block diagram illustrating the main configuration of an automatic analyzer according to yet another embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0029] The present invention can be modified in various ways and can have various embodiments, and specific embodiments will be illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to the specific embodiments, and it should be understood that the present invention includes all modifications, equivalents, and alternatives within the spirit and technical scope of the present invention. In describing the various drawings, like reference numerals are used to refer to like elements.

[0030] Terms such as "first," "second," "A," and "B" may be used to describe various components, but the components should not be limited by these terms. These terms are used only to distinguish one component from another. For example, a first component may be designated as a second component, and similarly, a second component may be designated as a first component, without departing from the scope of the present invention. The term "and / or" includes a combination of multiple associated listed items or any of multiple associated listed items.

[0031] When a component is said to be "coupled" or "connected" to another component, it should be understood that it may be directly coupled or connected to the other component, but that there may be other components in between. Conversely, when a component is said to be "directly coupled" or "directly connected" to another component, it should be understood that there are no other components in between.

[0032] The terms used in this application are merely used to describe specific embodiments and are not intended to limit the present invention. The singular expressions include the plural expressions unless the context clearly dictates otherwise. In this application, the terms "comprise" or "have" are intended to specify the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, and should be understood not to preclude the possibility of the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0033] Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. Terms as defined in commonly used dictionaries should be interpreted to have a meaning consistent with the meaning they have in the context of the relevant art, and should not be interpreted in an idealized or overly formal sense unless expressly defined in this application.

[0034] Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the accompanying drawings. In order to facilitate overall understanding of the present invention, the same reference numerals will be used to refer to the same components in the drawings, and duplicate descriptions of the same components will be omitted.

[0035] FIG. 1 is a diagram illustrating the schematic configuration and operating principle of a device (hereinafter simply referred to as "automatic analyzer") that automatically analyzes event logs of malicious events, which are endpoint threatening events, by applying an artificial intelligence (AI)-based chatbot engine according to one embodiment of the present invention.

[0036] Referring to FIG. 1, the automated analyzer 100 includes a first module 110 for grouping, a second module 120 for storage, a third module 130 for construction, a fourth module 140 for analysis, and a fifth module 150 for automatic judgment.

[0037] The first module 110 groups logs collected from a user's personal computer (PC). The second module 120 quantifies and stores the collected event logs and grouped logs. The third module 130 builds a data set based on the quantified logs. The fourth module 140 performs automatic analysis of the event logs based on a transformer model. The fifth module 150 automatically determines threat events based on the results of the automatic analysis of the event logs.

[0038] The Transformer model for the Transformer algorithm has an encoder layer and a decoder layer, and can be configured to generate position information of malicious behavior by calculating the word position (pos) using the following equation (1), which is a cosine function, when the value obtained by adding 1 to the position of the embedding dimension in the embedding vector of each word in the positional encoding (PE) of the input layer is odd.

number

[0039] In Equation 1, D indicates the number of input dimensions of the event analyzer, and i indicates the order of the input dimensions.

[0040] In addition, the Transformer model for the Transformer algorithm has an encoder layer and a decoder layer, and can be configured to generate position information of malicious behavior by calculating the position of a word using the following equation (2), which is a sine function, when the value obtained by adding 1 to the position of the embedding dimension in the embedding vector of each word in the positional encoding of the input layer is even.

number

[0041] In Equation 2, D indicates the number of input dimensions of the event analyzer, and i indicates the order of the input dimensions.

[0042] The automatic analysis device 100 can be connected to an artificial intelligence (AI) analysis web management system 200 via a network. The AI ​​analysis web management system 200 can be installed in an AI analysis server connected to a user's PC, and can include a module 210 that performs user management for administrators, a module 220 that monitors the collection and analysis status, a module 230 that manages the collection and analysis system, and a module 240 that manages the AI ​​analysis status.

[0043] The aforementioned automatic analysis device 100 is an endpoint detection and response (EDR) device for automatically analyzing and detecting events using an AI-based chatbot engine, and includes a processor and a memory. In accordance with at least one instruction stored in the memory, the processor: processes the event log by grouping it by process for efficient analysis of the event log; generates sentences for process actions using NLP (Natural Language Processing) techniques for AI analysis; digitizes actual malicious actions and uses them as learning data for AI model learning; implements a learning system based on a transformer algorithm to train the AI ​​model using such learning data; and checks the grouped event logs in real time through an automatic event maliciousness analyzer based on BERT (bidirectional encoder representations form transformers) and LSTM (long short-term memory) algorithms to analyze actual malicious actions, and detects and automatically determines that the malicious action is a threatening event if the target of the malicious action is above a certain similarity.

[0044] The deep learning-based chatbot engine for event log classification operates using an action sentence generation and labeling method to allow the chatbot engine to learn threatening process actions. It is designed with an optimal hierarchy based on performance, based on six encoder and decoder layers of the Transformer architecture, and is configured to adjust the learning rate according to the learning progress time to optimize the cost required for model learning. It can be configured as a model that combines a Transformer-based BERT model with a dense layer, and can use the optimal model based on a comparison of the F1-score of traditional RNN (recurrent neural network) models based on LSTM and GRU (gated recurrent unit) and Transformer-based models.

[0045] In addition, the AI ​​module for event analysis can be linked to the EDR system. Here, the AI ​​module can be linked to a cloud-based EDR solution to provide an integrated service. Such AI modules can be managed by an appliance-type management server located on each site, or can be directly serviced on a cloud-based network.

[0046] Figure 2 is a diagram illustrating an AI analysis process for threats to an intrusion that is applied to endpoint detection and response (EDR) that can be employed in the automatic analysis device of Figure 1. Figure 3 is a diagram illustrating an AI-based threat detection function that is applied to EDR that can be employed in the automatic analysis device of Figure 1. And Figure 4 is a schematic example diagram illustrating application of an AI analysis module that can be employed in the automatic analysis device of Figure 1.

[0047] Referring to Figure 2, the AI ​​analysis process for intrusion threats applied to EDR, which can be adopted in an automatic analysis device, can standardize and store event logs by group in the analysis system AI DB in the EDR system or analysis system (S21).

[0048] Next, the analysis logs can be grouped by processor identifier (process ID) and session (S22).

[0049] Next, an action sentence can be generated from the event log (S23).

[0050] Next, the behavioral sentences can be analyzed using an AI platform (S24).

[0051] Next, a threatening event can be automatically determined based on the analyzed behavioral sentence (S25).

[0052] Next, the automatic judgment results can be transmitted to a web server DB, such as an elastic DB, and the analysis and judgment results can be transmitted to a distributed system AI DB, and then transmitted to a display device to visualize the threat event tree and analysis information (S26, S31).

[0053] The event log stored in the analysis system AI DB is transmitted to an agent installed in the user's PC and can be used by the agent to collect information on threats of infringement (S27).

[0054] Next, the agent can automatically detect threatening behavior based on the collected infringement threat information (S28).

[0055] Next, the event log collected through the automatic detection of threatening behavior can be reported to the analysis system AI DB (S30).

[0056] That is, as shown in FIG. 3, the AI-based threatening behavior detection method applied to EDR can be configured to perform an automatic threatening event determination step (S31), followed by an automatic analysis step (S32), a data collection step (S33), a log grouping step (S34), a threat detection step (S35), and a threatening event information visualization step (S36).

[0057] In other words, as shown in FIG. 4, after collecting the event log (S41), the system may be configured to perform the steps of generating an event action statement (S42), extracting features based on AI model learning by applying rules (S43), and transmitting the resulting data to automatically determine whether or not the data is malicious (S44).

[0058] As described above with reference to Figures 2 and 4, the threat event automatic analysis and detection AI module that applies a chatbot engine, which is a type of automatic analysis device, can be linked to an EDR system for endpoint security.

[0059] The AI ​​module can be configured to perform interface migration work to transfer event log data transferred to an existing web database to a newly constructed AI analysis database in order to apply AI to the existing EDR system.

[0060] The AI ​​module can also be equipped with an ElasticSearch DBMS (DB management system) for large-capacity databases (DBs) to build event log datasets.

[0061] In addition, the AI ​​module can be equipped with a transformer algorithm-based learning system for automatic analysis and detection of threatening event logs.

[0062] The AI ​​module may also include a function for automated behavioral event analysis that can classify malicious behavior events using a text classification function, and a component corresponding to such a function.

[0063] Additionally, the AI ​​module can be configured to detect malicious events in conjunction with endpoint event detection rules.

[0064] Due to the above-mentioned configuration, the AI ​​module collects threat event data and event logs, groups them by process ID and session ID, and groups them by process to automatically analyze threat processes based on AI, automatically determine threat events based on the results of the automatic analysis, and visualize and display the automatic analysis and determination results of threat events and the process tree through a web user interface (Web UI).

[0065] In this way, in this embodiment, the event log can be automatically analyzed to automatically determine whether or not an event is malicious, and an automated system for event analysis can be constructed to obtain two advantages: high accuracy and rapid analysis.

[0066] FIG. 5 is a schematic diagram illustrating an AI engine for automatic analysis of chatbot-based threat event logs that can be employed in the automatic analysis device of FIG.

[0067] Referring to Figure 5, the AI ​​engine that can be used in the automatic analysis device is a type of chatbot engine that applies EDR, and performs a primary analysis of events extracted from an endpoint using rules (S51, S52), stores the analysis results in the AI ​​analysis server database (S53, 54), and the AI ​​module can group the stored data into analysis logs by process ID and session identifier. The rules can include indicators of compromise (IOC) and MITRE ATT&CK (adversarial tactics, techniques and common knowledge) attack methods.

[0068] In addition, the AI ​​engine can generate event action sentences that take the order of event groups into consideration, and store the generated action sentences in the AI ​​DB to collect data and build a dataset (S56). Using such a dataset, it is possible to prepare a trained analyzer for use in Transformer-based model or RNN model training.

[0069] According to this configuration, the input event log is automatically analyzed and classification probability is calculated by the learned analyzer, and based on this, automatic judgment of threatening events is carried out. The analysis and judgment results are stored in the web server DB, and the transformer-based automatic analysis and judgment results and the process tree action sequence can be visualized and provided to the user through the web user interface manager (web UI manager).

[0070] In addition, the AI ​​engine groups the action event logs collected through the agent using process IDs and sessions, etc., and creates a dataset by generating threatening action events as action sentences (S57). Using the action event dataset created in this way, it can automatically detect threatening event logs based on the analysis results from a transformer-based analyzer for speed and overall syntactic analysis of long sentences, a text classification technique (S58, S59).

[0071] The automatically detected threat events are stored in a web server DB, for example, an elastic DB, and can be used for automatic threat event determination (S59). The analysis and determination results are stored in the web server DB or elastic DB (S60), and the analysis and determination results can be displayed through a user interface (UI) (S61).

[0072] Fig. 6 is a schematic diagram of an EDR system to which an AI module employing a chatbot engine that can be used in the automatic analyzer of Fig. 1 is applied. Fig. 7 is a diagram for explaining an interface for linking an EDR solution and an AI module that can be used in the automatic analyzer of Fig. 1.

[0073] 6, the AI-based EDR system 100 applying the chatbot engine is a type of automatic analysis device and may include an AI module 160 and an AI database 170 that stores event logs, and may be configured to analyze events of a user PC by performing rule matching using an agent installed in the user PC on a network through the AI ​​module, and to transmit the analysis results to a user PC, analysis server, elastic DB 260, etc. on the network in conjunction with the AI ​​database 170 of the analysis server. A web browser-based user interface 270 is installed in the elastic DB 260, allowing access to a user PC or other user terminal and enabling communication with the user PC.

[0074] The main operating principle of the AI ​​module will be described below with reference to Figure 7. The processes described below can be associated with components that perform the corresponding functions.

[0075] When an event occurs, the AI ​​module collects event logs from the agent (71). The collected logs are saved in a specific folder. Next, the rule module (72) performs rule matching and saves the results in a specific folder. The collected logs and matching results can be provided to the user's PC via the web through the manager (73) or saved in DB (74). Here, the manager (73) can be built on server hardware or in a cloud environment and can be linked to the AI ​​module like a DB server in a virtualized operating system.

[0076] Next, the logs stored in the DB 74 are grouped (75), and the grouped logs can be generated as an action sentence (76). The generated action sentence 76 can be stored in the database 74.

[0077] In addition, machine learning (77) can be performed based on the logs and matching results stored in DB 74, thereby creating a learning model file (78). The previously created action sentences 76 can be used to create the learning model file.

[0078] Next, action sentence analyzed results (79) can be generated using the learning model file. Then, an automatic judgment of threats (81) is made based on the generated action sentence analyzed results (79) and a threshold setting (80). If the judgment result is above or below a predetermined threshold result (82), the result can be configured to be stored in a manager DB (83) (83).

[0079] In other words, the analysis results attempted by the agent are called up and grouped using the processor ID and session information, and sentences are generated in the order of progress and process actions, and then transmitted to an artificial intelligence database (AI DB) to create a data set.

[0080] FIG. 8 is a schematic block diagram of an AI module application configuration (EDR solution) for event analysis that can be employed in the automatic analysis device of FIG.

[0081] 8, an EDR system corresponding to the EDR solution may broadly include an EDR integrated management server 300 and an agent 100. That is, the EDR system of this embodiment may be constructed as an AI-based EDR system that applies an AI module for event analysis.

[0082] The EDR integrated management server (hereinafter simply referred to as "integrated management server") 300 may include a user interface (UI 310), an AI-based event analysis module 320, a database management system (DBMS 330), multiple behavior analysis engines 350, a server-based operating system 360 such as Windows Server 2016R2, a Windows operating system (Windows OS), a platform 370 such as ESXi installed on an HPE ProLiant server, cloud computing services such as Amazon Web Services (AWS) and Microsoft Azure, and cloud infrastructure for public institutions such as NHN Toast, and supporting hardware 380. The hardware 380 may be cloud-based hardware.

[0083] The EDR system can collect event information from an agent (180) of the endpoint 100, transmit it to the integrated management server 300, and store the information in a DB management system 330 in the integrated management server 300. The stored information can be sequentially collected by an AI-based event analysis module 320 to perform AI-based event analysis, and can be configured to apply the analysis results to a detection rule 182 in the endpoint 100.

[0084] The endpoint 100 may include a Windows operating system 102 and PC hardware (H / W) 104, but is not limited to this. The endpoint 100 may include other operating systems, such as the Android operating system, that provide an environment in which an agent 180 can be installed and run.

[0085] The AI-based event analysis module 320 of the integrated management server 300 and the agent 180 of the endpoint 100 according to this embodiment are devices that perform the automatic malicious event log analysis method of this embodiment, and can be configured to perform the following steps: processing logs by grouping them by process for efficient analysis of the event logs; generating sentences for process actions using NLP (Natural Language Processing) techniques for AI analysis; digitizing actual malicious actions and using them as learning data for AI model learning; creating a learning system based on a transformer algorithm to learn the learning data; checking the grouped event logs in real time through an automatic event maliciousness analyzer based on BERT and LSTM algorithms to analyze actual malicious actions; and detecting malicious action targets that have a certain similarity or higher and automatically determining them as threatening events.

[0086] FIG. 9 is an exemplary diagram illustrating a process of bundling session IDs and process IDs and grouping them by processor in an automatic malicious event log analysis method (simply referred to as an automatic analysis method) according to another embodiment of the present invention.

[0087] Referring to FIG. 9, the grouping process for automatic analysis of malicious event logs may include a log collection step (S91) and a grouping step (S92), and may further include a UI display step (S93) for displaying the grouped data on a user interface.

[0088] In the log collection step (S91), an event log is collected and stored for each session ID (SID) and process ID (PID).

[0089] In the grouping step (S92), the collected event logs are grouped by session identifier or process identifier.

[0090] FIG. 10 is an exemplary diagram illustrating a malicious event in which normal actions are aggregated to perform ransomware actions in the automatic analysis method of FIG.

[0091] 10, malicious events that result from a combination of normal actions and ransomware actions can include simultaneous registration of a startup program (S101) for maintaining persistence, changing the desktop screen (S102) for demanding money, and renaming a file to encrypt a file (S103). Such simultaneous events can be considered a type of ransomware behavior and can be determined as malicious actions (S104).

[0092] FIG. 11 is an exemplary diagram illustrating a malicious event that collects or transmits network information by collecting normal actions in the automatic analysis method of FIG.

[0093] 11, a malicious event, which is a combination of normal actions and a network information collection or information transmission action, can include a case where a process execution (S111), a file creation or file writing (S112), and a network communication (S113) are simultaneously performed. Such simultaneous events can be classified as a suspicious malicious event and determined as a suspicious malicious action (S114).

[0094] As described above with reference to Figures 9 to 11, the automatic analysis method can use an event log grouping technique to classify process actions. That is, when analyzing only one event log, the event log may be a threatening action event, but in most cases it is a normal action event, and actions determined to be normal actions gather together to progress threatening actions. Therefore, grouping is performed in chronological order using session IDs such as parent process IDs and current process IDs, and malicious events can be analyzed through this.

[0095] FIG. 12 is an exemplary diagram illustrating a malicious event that does not include "terminated" in the event type in the automatic analysis method of FIG.

[0096] 12, the automatic analysis method can use a process action sentence generation process using event logs for NLP techniques. That is, if there is no action termination (Terminated, S122) in the grouped event logs, it means that the process is not progressing to completion. Therefore, for an event group that contains a Terminated event, a sentence is generated taking into account the event type, changed value, and process execution path, and the order of the actions, and using this, a malicious event log can be automatically analyzed.

[0097] In addition, a dataset can be constructed using action sequence sentences to generate a learning model. In this case, sentences generated by the event action sentence generator can be stored in the database of the AI ​​analysis server, and labeling can be performed on the generated event action sentences to detect threatening events.

[0098] FIG. 13 is a block diagram of a Transformer model network architecture that can be employed in the automated analysis method of FIG.

[0099] Referring to FIG. 13, the automatic analysis device can use a learning system based on a transformer algorithm for AI analysis.

[0100] The Transformer algorithm-based learning system is capable of parallel processing and has excellent performance in understanding the meaning between words, and can be composed of six encoder and decoder layers.

[0101] For example, the automatic analysis device inputs data in which the embedding of an event log is encoded in relation to the location of occurrence (positional encoding) into the first module, and through the first process (S132) of the first module, processes the input data through an encoder self-attention with multi-head self-attention, combines the input data and the results processed by the encoder self-attention and generalizes them (add & norm), performs FFNN using the position criterion, combines the results with the generalized data, and generalizes them for output.

[0102] Next, the automated analyzer can input the processing results of the first process (S132) to the multi-head self-attention of the second process of the second module. The second process (S134) of the second module can further include a masked decoder self-attention with masked multi-head self-attention as a previous stage of the multi-head self-attention. The processing results of the masked decoder self-attention can be generalized by combining them with the input data of the corresponding module and then input to the multi-head self-attention. In this case, the multi-head self-attention can correspond to encoder-decoder attention.

[0103] The output of the second process (S134) can be output through an output terminal such as softmax of a dense neural network.

[0104] The relationship between the two steps (S132, S134) of the first and second modules described above can be applied equally to two adjacent layers of multiple processes performed in multiple layers. In other words, the automatic analysis device can simultaneously perform automatic judgments for each event log group in parallel using the Transformer algorithm.

[0105] In addition, when attention is performed, the number of parallel heads is set to eight, and the loss function can adopt a cross-entropy function to solve multi-class classification problems. In the case of the learning rate for optimizing the loss function, the magnitude of the learning rate can be gradually reduced as the learning progresses, and the value can be tuned to make the loss function more easily convergent.

[0106] FIG. 14 is an exemplary diagram for explaining the structure of the transformer model of FIG.

[0107] Referring to Figure 14, the Transformer model can consist of an encoder layer (S142) and a decoder layer (S144). In the input layer, positional encoding adds positional information to the embedding vector of each word and can be used as model input.

[0108] In addition, the decoder structure can be configured to receive a sentence matrix after undergoing positional encoding, just like the encoder structure. The decoder structure can then be trained to predict words at each point in time from the sentence matrix. In addition, a layer that masks future words so that future words cannot be referenced can be applied to the earliest stage of the decoder sublayer.

[0109] FIG. 15 is an exemplary diagram illustrating a text classification structure using BERT and a dense layer, which can be adopted in the Transformer model of FIG. 13.

[0110] Referring to Figure 15, the automated analyzer can use an automated event analyzer (S136) that uses BERT and LSTM models. This analyzer (S136) can use the BERT model, which has the advantage of fine-tuning to solve the problem of finding and classifying themes in text. In this case, the BERT model can be pre-trained and used with dense layers (S138) that have outputs equal to the number of labels to be trained during final classification.

[0111] In addition, when using an LSTM model, it has better performance in processing long sequence inputs than traditional RNNs, and since the sequential event characteristics of the threat process make it more likely that long sentences will be formed, it is preferable to use an LSTM model rather than a traditional RNN.Furthermore, since it is widely used in various natural language processing applications such as text classification and chatbot systems, it can also be used selectively by comparing its performance with Transformer-based models.

[0112] FIG. 16 is an example diagram of text classification using the LSTM of FIG. 15, which can be used in conjunction with or instead of the Transformer model of FIG. 13.

[0113] Referring to Figure 16, the Transformer-based BERT model and the model using LSTM and GRU are trained as a text classification or question-answer model using the same dataset, and the validation data and test dataset results are compared to selectively use the model with the best f1-score.

[0114] For example, for the text input "I always really hate foot-and-mouth disease," the text is preprocessed through an embedding layer (S161) and multiple LSTMs (S162), trained through a convolution layer (S163), and then output as an automatic analysis result through a max pooling layer (S164) and a fully connected layer (FCL, S165). The automatic analysis result can be set as a malignant event (+), a non-malignant event (-), or a withheld decision (0).

[0115] The computing device for event analysis described above (corresponding to the automatic analysis device) and the AI ​​module that constitutes at least a part of this computing device can be constructed in conjunction with an EDR system.

[0116] It can be implemented as a build-type AI module-linked EDR system that can manage and provide services by placing an appliance-type management server at each site, or as a SECaaS type that manages and provides services on a cloud platform.

[0117] According to this embodiment, the AI ​​module can provide an integrated service in conjunction with a cloud-based EDR solution that already provides certain services. In this case, the setting interface of the AI ​​module and the analyzed result information can be configured to be provided in conjunction with a GUI, which is a management system for the EDR system.

[0118] Additionally, the intelligent EDR analysis system (hereafter simply referred to as the analysis system) can include an endpoint security solution that uses a chatbot engine to automatically analyze and detect threat events. This analysis system is implemented as an agent installed on the user's PC to collect events, and the collected events are stored in an AI database after a primary analysis using Yara rules. The analysis results collected in the AI ​​database are then processed into event groups by process ID and session, after which the processed events are automatically analyzed by an AI analyzer, and the automatic event judgment results based on the automatic analysis results are stored in a web server database.

[0119] In addition, the analysis system can visualize and display the analysis results and judgment results using a web browser-based user interface.

[0120] The analysis system is a type of automatic threat event detection system that can automatically detect threat events through AI-based syntax analysis of event actions. It can then automatically determine threat events based on the results of the automatic detection. It also works in conjunction with a blacklist to block the inflow of new variants of malicious code. After determining threat processes through behavior analysis, the blacklist can be updated through a web user interface. The analysis system can also be configured to detect threat events by using Yara rules to detect events collected on the user's PC.

[0121] In addition, the analysis system collects information on processes, registries, networks, and files generated on endpoints, such as user PCs, and receives attack tactics, techniques, and methods provided by MITRE ATT&CK, and can provide detection functions with a high rate of None, Telemetry, General Behavior, and Tactic detection information.

[0122] In addition, the analysis system can automatically analyze event logs through its AI analysis function to determine whether or not there is malicious activity and whether there is an infringement, and output judgment information. This judgment information includes attack tactics, attack techniques, and attack method information provided by MITRE ATT&CK, and can be increased and stored up to the general behavior and tactical levels.

[0123] FIG. 17 is a block diagram illustrating a form of security service provided by the automatic analysis device of FIG.

[0124] Referring to FIG. 17, the security service form can be embodied in the form of an endpoint threatening behavior detection EDR product that applies a chatbot engine.

[0125] The automatic analysis device for such security services may be configured with an external server 400 for learning data collection, security notification, and backup, and may communicate with other devices via HTTP. The external server 400 may include a short message service server 410, an update server 420, a virus total server 430, a Bitdefender server 440, a mail server 450, a backup server 460, etc.

[0126] Here, the integrated management server 300 for EDR solution management is a type of manager, and can be constructed on server hardware or in a cloud environment, installed on a virtualized operating system, and set up to work in conjunction with a DB server.

[0127] In addition, the AI-based event analysis system using the automatic analyzer can be installed in the endpoint 100 or the integrated management server 300, implemented in a virtual environment of PC hardware or a cloud environment, and operated in an operating system such as Windows Server. Also, an agent (180) for collecting endpoint events and responding to threat events can be configured to operate on a specific endpoint such as Windows 7 or Windows 10.

[0128] In addition, the endpoint threatening behavior detection system using a chatbot engine is a type of AI-based event analysis system that uses an automatic analyzer. It performs rule matching on event logs generated on the user's PC and transmits them to the DBMS as a user's PC event log. The user's PC event logs collected in the DBMS are grouped into a process tree and then stored in the DBMS. The collected event log process tree is used to generate sentences in the order of actions, and the generated sentences can be used as an AI model learning dataset to generate a Transpoker-based or LSTM-based deep learning-based AI model.

[0129] In addition, the above-mentioned system can transmit the event logs generated on the endpoint 100, such as the actual user's PC, to the AI ​​analysis system of the integrated management server 300, perform automatic analysis using the generated AI model, and output the similarity. It can also transmit the results of the automatic threat process judgment analysis and automatic judgment to the DBMS, and visualize and display the process tree and the AI ​​automatic analysis and judgment results through the Web UI.

[0130] In addition, the endpoint threatening behavior detection system using the chatbot engine described above can have the following module configuration: a process tree behavior sequence sentence generation module, a Transformer network and LSTM-based network model learning module using the TensorFlow framework, an automatic analysis and similarity output module using Transformer network-based and LSTM network-based learning models, a library for data set processing, an automatic threatening process detection module based on the automatic analysis results, and a module for visualizing the analysis results and automatic judgment results through a web user interface.

[0131] The libraries may include one or more selected from the Scikit-learn, pandas, and numpy libraries.

[0132] According to this embodiment, behavioral information is collected from endpoints and stored in a central server. The process of automatically analyzing security threat events is then carried out through AI analysis of the stored behavioral information. This enables efficient and rapid classification and analysis of large volumes of logs, and enables AI to automatically determine whether or not a threat has occurred when a threat occurs, even without the need for a professional analyst.

[0133] In addition, AI-based automated analysis can be applied to not only endpoint event log analysis but also to a visualization platform that can test malicious code, greatly increasing the reliability of the analysis results of malicious code and malicious behavior. This has the advantage of being immediately applicable to cloud-based security service products such as SECaaS.

[0134] FIG. 18 is a block diagram illustrating a performance evaluation process for the AI-based automatic analysis of threat events of the automatic analysis device of FIG.

[0135] Referring to FIG. 18, performance evaluation of the AI-based automatic threat event analysis method can be performed as follows.

[0136] First, in the event log collection step (S181), malicious information is collected from five malicious information collection channels known to execute malicious code, such as Virus Total, Virus Sign, and Bitdefender, and 200 malicious files per malicious information collection channel and 1,000 routine files stored by the system can be used as samples for performance evaluation.

[0137] Here, a test bed for evaluating automatic analysis of threatening events can be constructed by utilizing the "Virtualization-Based Malicious Behavior Manual Analysis Visualization Platform," which is a type of automatic analysis device described in this embodiment.

[0138] Next, when an event log is collected due to the execution of malicious code, automatic detection of threatening events is performed through the chatbot engine (S182). The results of automatic detection due to the execution of malicious code at endpoints, etc., can be configured to be visualized on the user interface along with the results of rule analysis (S185) (S186). Through the visualized information, detection performance confirmation and reports can be provided to users, etc.

[0139] Next, the automatic detection result can be transmitted to the visualization system (S184) through the event automatic analysis process (S183).

[0140] Next, the automated event analysis results can be checked through the EDR GUI of the visualization system (S184) linked to the AI ​​module, and the test results can be measured by checking the testbed UI.

[0141] According to the above-described embodiments, it is possible to effectively respond to unknown security threats and new and variant threats that neutralize existing antivirus software. Furthermore, by establishing an automated cyber threat response system through IOC-based forensic analysis, it is possible to significantly reduce human error and time limitations associated with manual analysis. Furthermore, by introducing AI-based event analysis technology, it is possible to efficiently establish an autonomously evolving threat response system by generating and distributing rules through an automated analysis system. Furthermore, by sharing the latest threat information with other organizations and systems, it is possible to generate and distribute reliable information, thereby shortening the response time to malicious threats and contributing to minimizing cyber damage.

[0142] FIG. 19 is a block diagram illustrating the main configuration of an image-based malicious code detection device according to yet another embodiment of the present invention.

[0143] The malicious event log automatic analyzer 1000 (simply referred to as the automatic analyzer) of this embodiment can be installed as at least a part of a server-side EDR system or as at least a part of an endpoint agent.

[0144] 19, an automated analyzer 1000 may include at least one processor 1100, a memory 1200, and a transceiver with a communication interface 1300 that is connected to a network to perform communication. The automated analyzer 1000 may further include an input interface device 1400, an output interface device 1500, and a storage device 1600. Each component included in the automated analyzer 1000 is connected to a bus 1700 to perform communication.

[0145] However, each component included in the automated analyzer 1000 may be connected to the processor 1100 through an individual interface or individual bus, rather than through the common bus 1700. For example, the processor 1100 may be connected to at least one of the memory 1200, the transceiver 1300, the input interface 1400, the output interface 1500, and the storage 1600 through a dedicated interface.

[0146] The processor 1100 can execute program commands stored in at least one of the memory 1200 and the storage device 1600. The processor 1100 may refer to a central processing unit (CPU), a graphics processing unit (GPU), or a dedicated processor on which the method according to the embodiment of the present invention is performed.

[0147] The memory 1200 and the storage device 1600 may each be composed of at least one of a volatile storage medium and a non-volatile storage medium. For example, the memory 1200 may be composed of at least one of a read only memory (ROM) and a random access memory (RAM).

[0148] At least one instruction stored in memory 1200 or storage device 1600 or loaded into processor 1100 and executed may be configured to cause the processor to perform the following steps: processing the event log by grouping it by process for efficient analysis of the event log; generating sentences for process actions using NLP (Natural Language Processing) techniques for AI analysis; digitizing actual malicious actions and using them as learning data for learning an AI model; creating a learning system based on the Transformer algorithm to train an AI model with the learning data; checking the grouped event logs in real time through an automatic event maliciousness analyzer based on BERT and LSTM algorithms to analyze actual malicious actions; and detecting malicious actions that have a certain similarity or higher and automatically determining that they are threatening events.

[0149] Furthermore, the operations of the methods according to the above-described embodiments of the present invention may be embodied as computer-readable programs or codes stored on a computer-readable recording medium. The computer-readable recording medium includes all types of storage devices that store data that can be read by a computer system. Furthermore, the computer-readable recording medium may be distributed among computer systems connected to a network, so that the computer-readable programs or codes may be stored and executed in a distributed manner.

[0150] Additionally, the computer-readable recording medium may include a hardware device specially configured to store and execute program instructions, such as a ROM, RAM, flash memory, etc. The program instructions may include not only machine language code, such as that produced by a compiler, but also high-level language code that can be executed by a computer using an interpreter, etc.

[0151] Although some aspects of the invention have been described in the context of an apparatus, they may also be described in terms of a corresponding method, where a block or apparatus corresponds to a method step or feature of a method step. Similarly, aspects described in the context of a method may also be described in terms of a corresponding block or item or feature of a corresponding apparatus. Some or all of the method steps may be performed by (or using) a hardware device, such as, for example, a microprocessor, a programmable computer, or electronic circuitry. In some embodiments, one or more of the most significant method steps may be performed by such a device.

[0152] In some embodiments, a programmable logic device (e.g., a field programmable gate array) may be used to perform some or all of the functions of the methods described herein. In some embodiments, a field programmable gate array may operate in conjunction with a microprocessor to perform one of the methods described herein. In general, it is preferred that the methods be performed by some hardware device.

Claims

1. A method for analyzing malicious event logs by installing an agent at an endpoint and performing rule matching on event logs with the agent in an integrated analysis server including a processor, The processor: performing grouping of event logs using process IDs and session information; generating a sentence in the order of process actions based on the event log; and An automated endpoint analysis method comprising: analyzing an event log at the endpoint based on a dataset including sentences generated in the order of actions.

2. The generating step is performed based on a Transformer model; The transformer model comprises an encoder layer and a decoder layer, [Equation 1] 2. The method of claim 1, wherein positional encoding (PE) of an input layer of the encoder layer generates positional information of malicious behavior by calculating the position (pos) of the word using the cosine function (Equation 1) when a value obtained by adding 1 to the position of the embedding dimension in the embedding vector of each word is odd.

3. The generating step is performed based on a Transformer model; The transformer model comprises an encoder layer and a decoder layer, [Equation 2] 2. The method of claim 1, wherein positional encoding of an input layer of the encoder layer generates positional information of malicious behavior by calculating the position of a word using Equation 2, which is a sine function, when a value obtained by adding 1 to the position of an embedding dimension in an embedding vector of each word is even.

4. The generating step is performed based on a transformer model, and the transformer model has an encoder layer and a decoder layer; The method for automated endpoint analysis according to claim 1, wherein the decoder structure including the decoder layer is trained to predict words at each time point from a sentence matrix, and a layer that masks future words so that future words cannot be referenced is applied to the earliest stage of the decoder sublayer.

5. The method of claim 1, further comprising providing a transformer network analysis result and a process tree to provide a basis for detecting a malicious event log or a threatening event log obtained in the analyzing step.

6. 1. A method for automated endpoint analysis for endpoint threat detection and response using an analysis device including a processor, comprising: The processor: Processing the event log by grouping it by process for efficient analysis; generating sentences for process actions through NLP (Natural Language Processing) techniques for AI analysis; The stage where actual malicious behavior is digitized and used as training data for AI model training. generating a learning system based on a transformer algorithm to learn the learning data; checking the grouped event logs in real time through an event analyzer that automatically analyzes whether an event is malicious based on BERT and LSTM algorithms in order to analyze actual malicious behavior; and An endpoint automatic analysis method including a step of detecting a malicious activity target having a certain similarity or more and automatically determining it as a threatening event.

7. The transformer model for the transformer algorithm comprises an encoder layer and a decoder layer, [Equation 1] 7. The method of claim 6, wherein the method is configured to generate position information of malicious behavior by calculating the position of a word using the cosine function (Equation 1) when a value obtained by adding 1 to the position of an embedding dimension in an embedding vector of each word is odd in the positional encoding of the input layer of the encoder layer.

8. The transformer model for the transformer algorithm comprises an encoder layer and a decoder layer, [Equation 2] 7. The method of claim 6, wherein the method is configured to generate position information of malicious behavior by calculating the position of a word using Equation 2, which is a sine function, when a value obtained by adding 1 to the position of an embedding dimension in an embedding vector of each word is even in positional encoding of an input layer of the encoder layer.

9. The transformer model for the transformer algorithm comprises an encoder layer and a decoder layer, The method for automated endpoint analysis according to claim 6, wherein the decoder structure including the decoder layer is trained to predict words at each point in time from a sentence matrix, and a layer that masks future words so that future words cannot be referenced is applied to the earliest stage of the decoder sublayer.

10. An automated endpoint analyzer for endpoint detection and response (EDR) that applies an artificial intelligence (AI)-based chatbot engine, The method includes: a processor and a memory; and the processor is configured to: An endpoint automatic analyzer that processes event logs by grouping them by process for efficient analysis, generates sentences for process actions using NLP (Natural Language Processing) techniques for AI analysis, digitizes actual malicious actions to use as learning data for AI model learning, implements a learning system based on a transformer algorithm to learn the learning data, and checks grouped event logs in real time through an automatic event maliciousness analyzer based on BERT (bidirectional encoder representations form transformers) and LSTM (long short-term memory) algorithms to analyze actual malicious actions, and detects malicious actions that are above a certain similarity and automatically determines them as threatening events.

11. The transformer model for the transformer algorithm comprises an encoder layer and a decoder layer, [Equation 1] 11. The endpoint automated analysis device of claim 10, wherein the positional encoding of the input layer of the encoder layer is configured to generate positional information of malicious behavior by calculating the position of the word using the equation (1), which is a cosine function, when a value obtained by adding 1 to the position of the embedding dimension in the embedding vector of each word is odd.

12. The transformer model for the transformer algorithm comprises an encoder layer and a decoder layer, [Equation 2] 11. The endpoint automated analysis device of claim 10, wherein the positional encoding of the input layer of the encoder layer is configured to generate positional information of malicious behavior by calculating the position of a word using Equation 2, which is a sine function, when a value obtained by adding 1 to the position of an embedding dimension in an embedding vector of each word is even.

13. The transformer model for the transformer algorithm comprises an encoder layer and a decoder layer, The endpoint automatic analysis device of claim 10, wherein the decoder structure including the decoder layer is trained to predict words at each time point from a sentence matrix, and a layer that masks future words so that future words cannot be referenced is applied to the earliest stage of the decoder sublayer.

Images