Method for training cyber attack detection models and system thereof

Abstract

A method for training a cyber attack detection model and a system to which the method is applied are disclosed. A method for training a cyber attack detection model according to one embodiment of the present disclosure may include the steps of: inputting a training dataset and an attack detection evasion policy into a first artificial intelligence model and obtaining a new attack scenario based on the output of the first artificial intelligence model; inputting the new attack scenario into a second artificial intelligence model and obtaining a detection result for the new attack scenario based on the output of the second artificial intelligence model; and inputting the detection result for the new attack scenario into the second artificial intelligence model and obtaining a new detection strategy corresponding to the new attack scenario based on the output of the second artificial intelligence model. Here, the second artificial intelligence model may be an artificial intelligence model trained based on a plurality of attack scenarios.

Description

Technology Field

[0001] A method for training a cyber attack detection model and a system to which the method is applied are disclosed. More specifically, the present disclosure relates to a method for training a plurality of cyber attack detection models and a system to which the method is applied. Background Technology

[0002] Recently, with the increasing sophistication and diversification of cyber attacks, the establishment of defense strategies to counter them is actively underway. In particular, as a means to enhance cyber attack detection and defense systems, research is being conducted on methods such as artificially generating various attack scenarios using generative models like VAE-GAN, or inducing malfunctions in attackers by utilizing GAN-based models.

[0003] However, the aforementioned approach generally suffers from the problem that the model generating attack scenarios and the model learning defense policies are configured as separate, independent processes. Consequently, generated attack scenarios cannot be reflected in the defense model's training in real time, making it technically very difficult to implement a learning structure that adapts to and evolves within a dynamic threat environment.

[0004] Therefore, there is a growing need for an integrated learning structure capable of effectively simulating real-world cyber threat environments and progressively enhancing defense systems based on this; however, existing frameworks face limitations in implementing this due to their static configurations where generation and defense are separated. The problem to be solved

[0005] The technical problem to be achieved through some embodiments of the present disclosure is to provide a method for training a model that generates attack scenarios and a model that generates detection strategies as an integrated process.

[0006] Another technical problem to be achieved through some embodiments of the present disclosure is to provide a method for evaluating the quality of an attack scenario generated by a model that generates attack scenarios.

[0007] Another technical objective to be achieved through some embodiments of the present disclosure is to provide a method for identifying the cause of failure to detect adversarial use scenarios using an artificial intelligence model.

[0008] The technical problems of the present disclosure are not limited to those mentioned above, and other unmentioned technical problems will be clearly understood by those skilled in the art from the description below. means of solving the problem

[0009] A method for training a cyber attack detection model according to an embodiment of the present disclosure for solving the above technical problem may include the steps of: inputting a training dataset and an attack detection evasion policy into a first artificial intelligence model and obtaining a new attack scenario based on the output of the first artificial intelligence model; inputting the new attack scenario into a second artificial intelligence model and obtaining a detection result for the new attack scenario based on the output of the second artificial intelligence model; and inputting the detection result for the new attack scenario into the second artificial intelligence model and obtaining a new detection strategy corresponding to the new attack scenario based on the output of the second artificial intelligence model. Here, the second artificial intelligence model may be an artificial intelligence model trained based on a plurality of attack scenarios.

[0010] In some embodiments, the above method may further include, prior to the step of acquiring the new attack scenario, the step of inputting the training dataset into the first artificial intelligence model to train the first artificial intelligence model so that the first artificial intelligence model generates the attack detection bypass policy.

[0011] In some embodiments, the above method may further include the step of storing the new detection strategy in a detection strategy storage, and the attack scenario may be time-series data including a plurality of attack techniques.

[0012] In some embodiments, the above method may further include the step of constructing a potential space of the first artificial intelligence model, and the step of constructing the potential space may include the step of obtaining a plurality of attack scenarios, obtaining a vector for each of the plurality of attack scenarios, and mapping the vector for each of the plurality of attack scenarios to the potential space of the first artificial intelligence model.

[0013] In some embodiments, the training dataset may include a plurality of attack scenarios, information on the target environment, and information on the target network structure.

[0014] In some embodiments, the step of acquiring the new attack scenario may include: inputting the training dataset and the attack detection evasion policy into the first artificial intelligence model and generating a prototype based on the output of the first artificial intelligence model; inputting the prototype into the first artificial intelligence model and evaluating whether the prototype is an attack scenario that already exists in the potential space of the first artificial intelligence model based on the output of the first artificial intelligence model; inputting the prototype into the first artificial intelligence model in response to a judgment that the prototype is an attack scenario that does not exist in the potential space and evaluating the validity of the prototype based on the output of the first artificial intelligence model; and determining the prototype as the new attack scenario based on a judgment that the prototype is valid.

[0015] In some embodiments, the first artificial intelligence model may evaluate the validity of the prototype based on the position of the vector of the prototype in the potential space.

[0016] In some embodiments, the above method may further include the step of inputting the attack scenario into the second artificial intelligence model to further train the second artificial intelligence model in response to a determination that a new detection strategy cannot be generated based on the output of the second artificial intelligence model.

[0017] In some embodiments, the first artificial intelligence model may be a VAE-GAN (Variational AutoEncoder-Generative Adversarial Network) model, and the second artificial intelligence model may be a GAN model.

[0018] In some embodiments, the second artificial intelligence model may include vectors of the plurality of attack scenarios in a latent space, evaluate the reproducibility of the new attack scenario based on similarity between the plurality of attack scenarios and a part of the new attack scenario, and output attack disruption data based on the result of the evaluation.

[0019] In some embodiments, the above method may further include the step of inputting the detection result for the attack scenario output by the second AI model into the first AI model in response to the detection that the attack scenario is a hostile scenario, thereby further training the first AI model to generate an attack detection bypass policy for the detection result for the attack scenario.

[0020] In some embodiments, the step of obtaining a detection result for the new attack scenario may include: inputting the new attack scenario into the second artificial intelligence model and obtaining attack disruption data based on the output of the second artificial intelligence model; inputting a first attack technique included in the new attack scenario into the second artificial intelligence model and obtaining a prediction result for a second attack technique having the next sequence of the first attack technique based on the output of the second artificial intelligence model; comparing the second attack technique included in the new attack scenario with the prediction result for the second attack technique; and evaluating whether the new attack scenario is detectable based on the result of the comparison.

[0021] In some embodiments, the step of obtaining a new detection strategy corresponding to the new attack scenario based on the output of the second artificial intelligence model may include the step of inputting the new attack scenario and the detection failure log into the second artificial intelligence model in response to the failure of detection for the new attack scenario, and generating detection failure cause data based on the output of the second artificial intelligence model, and the step of inputting the detection failure cause data into the second artificial intelligence model to further train the second artificial intelligence model so that the second artificial intelligence model generates the new detection strategy.

[0022] In some embodiments, the step of inputting the new attack scenario and the detection failure log into a second artificial intelligence model in response to the failure to detect the new attack scenario and generating detection failure cause data based on the output of the second artificial intelligence model may include the step of inputting the new attack scenario and the detection failure log into the second artificial intelligence model and, based on the output of the second artificial intelligence model, obtaining data related to the difference between the coverage of the first detection strategy and the coverage of the detection strategy used to detect the new attack scenario, and the step of inputting data related to the difference between the coverage of the first detection strategy and the coverage of the detection strategy used to detect the new attack scenario into the second artificial intelligence model and generating detection failure cause data based on the output of the second artificial intelligence model. Here, the first detection strategy may be a detection strategy corresponding to the first attack scenario having a similarity of greater than or equal to a threshold value with respect to the new attack scenario.

[0023] A cyber attack detection system according to another embodiment of the present disclosure for solving the above-mentioned technical problem may include one or more processors and a memory that stores a computer program executed by the one or more processors. Herein, the computer program may include instructions that cause the processor to perform the steps of: inputting a learning dataset and an attack detection evasion policy into a first artificial intelligence model and obtaining a new attack scenario based on the output of the first artificial intelligence model; inputting the new attack scenario into a second artificial intelligence model and obtaining a detection result for the new attack scenario based on the output of the second artificial intelligence model; and inputting the detection result for the new attack scenario into the second artificial intelligence model and obtaining a new detection strategy corresponding to the new attack scenario based on the output of the second artificial intelligence model. Additionally, the second artificial intelligence model may be an artificial intelligence model trained based on a plurality of attack scenarios.

[0024] In some embodiments, the computer program may further include instructions that cause the processor to perform the step of constructing the latent space of the first artificial intelligence model.

[0025] A computer-readable recording medium according to another embodiment of the present disclosure for solving the above-mentioned technical problem may be a computer-readable recording medium storing instructions. The instructions may include instructions configured to perform the steps of: inputting a training dataset and an attack detection evasion policy into a first artificial intelligence model and obtaining a new attack scenario based on the output of the first artificial intelligence model; inputting the new attack scenario into a second artificial intelligence model and obtaining a detection result for the new attack scenario based on the output of the second artificial intelligence model; and inputting the detection result for the new attack scenario into the second artificial intelligence model and obtaining a new detection strategy corresponding to the new attack scenario based on the output of the second artificial intelligence model. Additionally, the second artificial intelligence model may be an artificial intelligence model trained based on a plurality of attack scenarios. Brief explanation of the drawing

[0026] FIG. 1 illustrates an exemplary environment in which a cyber attack detection system according to one embodiment of the present disclosure may be applied. FIG. 2 is a flowchart of a learning method for a cyber attack detection model according to another embodiment of the present disclosure. Figure 3 is a flowchart for explaining in detail some of the steps described with reference to Figure 2. FIG. 4 is a diagram illustrating, by way of example, the step of pre-training a first artificial intelligence model that can be performed in some embodiments of the present disclosure. FIG. 5 is a drawing for exemplarily illustrating a first artificial intelligence model according to some embodiments of the present disclosure. Figure 6 is a flowchart for explaining in detail some of the steps described with reference to Figure 2. FIG. 7 is a drawing for exemplarily illustrating a first artificial intelligence model according to some embodiments of the present disclosure. FIG. 8 is a diagram illustrating, by way of example, the steps for generating a novel attack scenario that can be performed in some embodiments of the present disclosure. FIG. 9 is an exemplary table showing the results of performing the step of evaluating the validity of a prototype that can be performed in some embodiments of the present disclosure. Figure 10 is a flowchart for explaining in detail some of the steps described with reference to Figure 2. FIG. 11 is a drawing for exemplarily illustrating a second artificial intelligence model according to some embodiments of the present disclosure. FIG. 12 is a drawing for exemplarily illustrating a step of acquiring attack disruption data that can be performed in some embodiments of the present disclosure. FIG. 13 is a drawing for exemplarily illustrating a step of predicting a second attack technique that may be performed in some embodiments of the present disclosure. FIG. 14 is a diagram illustrating, by way of example, a step for evaluating the possibility of detection and defense for a novel attack scenario that can be performed in some embodiments of the present disclosure. FIG. 15 is a drawing for illustratively explaining a computing system according to another embodiment of the present disclosure. Specific details for implementing the invention

[0027] Hereinafter, preferred embodiments of the present disclosure will be described in detail with reference to the attached drawings. The advantages and features of the present invention and the methods for achieving them will become clear by referring to the embodiments described below in detail together with the attached drawings. However, the technical concept of the present invention is not limited to the following embodiments but can be implemented in various different forms. The following embodiments are provided merely to complete the technical concept of the present invention and to fully inform those skilled in the art of the scope of the present invention, and the technical concept of the present invention is defined only by the scope of the claims.

[0028] In describing the present disclosure, if it is determined that a detailed description of related known configurations or functions could obscure the essence of the invention, such detailed description is omitted.

[0029] Unless otherwise defined, terms used in the following embodiments (including technical and scientific terms) may be used in a meaning commonly understood by those skilled in the art to which this disclosure pertains, but this may vary depending on the intent of those skilled in the art, case law, the emergence of new technology, etc. The terms used in this disclosure are for describing the embodiments and are not intended to limit the scope of this disclosure.

[0030] In the following embodiments, singular expressions include plural concepts unless the context clearly specifies them as singular. Additionally, plural expressions include singular concepts unless the context clearly specifies them as plural.

[0031] In addition, terms such as first, second, A, B, (a), (b), etc. used in the following embodiments are used merely to distinguish one component from another, and the essence, order, or sequence of the said component is not limited by such terms.

[0032] Hereinafter, prior to describing some embodiments of the present disclosure, the meaning of terms that may appear in describing some embodiments of the present disclosure will be clarified.

[0033] In the following embodiments, 'attack detection bypass policies (bypass techniques)' may be attack conditions or techniques included in an attack scenario so that a specific attack scenario is not detected as hostile by a defense module of the target system.

[0034] Attack detection bypass policies according to some embodiments of the present disclosure may be exemplified by Table 1, and it will be obvious to those skilled in the art that there are attack detection bypass policies not disclosed in Table 1. That is, it should be understood as obvious to those skilled in the art that attack detection bypass policies not exemplified in the present disclosure may be applied by the embodiments according to the present disclosure.

[0035] Policy Classification Attack detection bypass policy Disguising the process Parent Spoofing, DLL Injection, Thread Hijacking File disguise Polyglot, Packing, Fileless Bypassing communication Domain Fronting, DNS Tunneling, HTTP over TLS Log avoidance ETW bypass, Event log deletion, Command obfuscation etc Living Off the Land (LOLBins)

[0036] In the following embodiments, 'attack target environment information' may be information including OS (Operating System) information, network configuration information, security solution information, asset characteristic information, and vulnerability information of the attack target system. For example, any one of the input data of an artificial intelligence model according to some embodiments of the present disclosure is first attack target environment information, and the artificial intelligence model may generate an attack scenario based on the first attack target environment information.

[0037] The information that may be included in each of the OS information, network configuration information, security solution information, asset characteristic information, and vulnerability information according to some embodiments of the present disclosure can be clearly understood by referring to Table 2. However, it is obvious to those skilled in the art that attack target environment information not disclosed in Table 2 may be configured, and attack target environment information not exemplified in the present disclosure may be modified by those skilled in the art and applied to the embodiments of the present disclosure.

[0038] category Environmental Information Example OS / Platform Information Windows 10, Ubuntu Server, Android, IoT Network configuration DMZ presence, VPN connection, Air-gapped, Firewall Rules Security Solution Information EDR installation, SIEM detection rules, MS Defender activation Asset characteristics SCADA system, AD server, web server, container environment Vulnerability Information CVE-2023-XXXX present, SMB port open, RDP allowed

[0039] In some embodiments of the present disclosure, attack target environment information may be a condition for an artificial intelligence model to generate an attack scenario. For example, the artificial intelligence model may generate an attack scenario in which the types of available attack techniques are limited, depending on OS information included in the attack target environment information.

[0040] In the following embodiments, 'attack scenario' may mean each of the predefined attack techniques and a set of behavior patterns or execution flows in which each sequence of attack techniques is predefined.

[0041] For example, an attack scenario may be in the form of [T1566.001, T1059.005, T1547.001, T1068]. Here, the attack scenario may include the T1566.001 (initial access) attack technique, the T1059.005 (execution) attack technique, the T1547.001 (persistence) attack technique, and the T1068 (privilege escalation) attack technique.

[0042] In addition, the attack scenario may include sequence information for each of the attack techniques, such that attack technique T1566.001 is the first behavioral pattern, attack technique T1059.005 is the second behavioral pattern, attack technique T1547.001 is the third behavioral pattern, and attack technique T1068 is the fourth behavioral pattern. Furthermore, it is obvious to a person skilled in the art that each of the above attack techniques consists of multiple behaviors.

[0043] In the following embodiments, 'target network structure' may refer to network configuration information of the target system. For example, the information of the target network structure may include information such as the existence of a DMZ (De-Miliarized Zone) of the target network, firewall configuration information, and the existence of a VLAN (Virtual-LAN). Through the examples described above, a person skilled in the art will readily understand that information not exemplified by this disclosure may be included in the information of the target network structure.

[0044] In the following embodiments, 'detection tactics' may refer to countermeasures required of a defense system based on data regarding the causes of detection failure for attack scenarios. For example, detection tactics may include 'adding behavior-based detection logic,' 'inducing sandbox response,' or 'strengthening memory surveillance.' The aforementioned detection tactics may be used interchangeably with terms such as 'active defense policy' in the relevant technical field.

[0045] Additionally, a detection strategy according to some embodiments of the present disclosure may include improvements or patches required for a defense system corresponding to analyzed detection failure cause data. Here, the improvements required for a defense system may be improvements for enhancing detection capabilities, but may also be improvements for enhancing defense capabilities that reduce the probability of attack success in an attack scenario.

[0046] In the following embodiments, 'attack disruption data' may refer to data generated by a defense module of a specific computing system for the purpose of disrupting the actions of said attack scenario when an attacker performs actions included in said attack scenario.

[0047] For example, a defense module of a specific computing system may provide a false response to an attack technique's command or return virtual data based on attack disruption data. That is, attack disruption data may be data containing instructions that the defense module must perform to respond to specific actions included in an attack scenario.

[0048] Hereinafter, some embodiments of the present disclosure will be described with reference to the drawings.

[0049] FIG. 1 is a drawing illustrating an exemplary environment in which a cyber attack detection system according to one embodiment of the present disclosure can be applied.

[0050] Each component illustrated in FIG. 1 may refer to software or hardware, such as a Field Programmable Gate Array (FPGA) or an Application-Specific Integrated Circuit (ASIC). However, the components are not limited to software or hardware and may be configured to reside in an addressable storage medium or configured to execute one or more processors. Functions provided within the components may be implemented by more subdivided components, or multiple components may be combined to form a single component that performs a specific function.

[0051] In some embodiments, the cyber attack detection system (100) illustrated in FIG. 1 may communicate with other components through a network. The network may be implemented as any type of wired or wireless network, such as a Local Area Network (LAN), a Wide Area Network (WAN), a mobile radio communication network, or Wibro (Wireless Broadband Internet).

[0052] The cyber attack detection system (100) and the attack scenario database (200) may be understood to operate according to a server-client model. However, in some embodiments, the system may be configured in a client-standalone manner without the need for a server. In this case, the operation performed by the attack scenario database (200) may be understood to be performed by the cyber attack detection system (100).

[0053] Hereinafter, with reference to FIG. 1, the operations that each component illustrated in FIG. 1 can perform will be described.

[0054] A cyber attack detection system (100) according to one embodiment of the present disclosure inputs a training dataset to a first artificial intelligence model and can train the first artificial intelligence model to generate an attack detection bypass policy.

[0055] In some embodiments of the present disclosure, the training dataset may include a plurality of attack scenarios, information on the target environment, and information on the target network structure. Additionally, the plurality of attack scenarios may be received from an attack scenario database (200).

[0056] In some other embodiments of the present disclosure, the training dataset may include information on a first attack detection bypass policy corresponding to a dataset including a first attack scenario, first attack target environment information, and a first attack target network structure.

[0057] A cyber attack detection system (100) according to another embodiment of the present disclosure inputs a training dataset and a generated attack detection bypass policy into a first artificial intelligence model and can obtain a new attack scenario based on the output of the first artificial intelligence model, but this will be described in detail later.

[0058] In some embodiments of the present disclosure, the format of the output data of the first artificial intelligence model may be changed differently based on a prompt input to the first artificial intelligence model. For example, if a prompt is input to the first artificial intelligence model to generate an attack detection bypass policy, the first artificial intelligence model may output an attack detection bypass policy based on a training dataset.

[0059] The above-mentioned attack detection bypass policy may be an attack detection bypass policy corresponding to a first test environment that includes information about a first attack target environment as a test condition. Here, it goes without saying that information about the first test environment may be input into a first artificial intelligence model.

[0060] In some other embodiments of the present disclosure, the first artificial intelligence model may be a Variational AutoEncoder-Generative Adversarial Network (VAE-GAN); however, the first artificial intelligence model of the present disclosure is not limited to the VAE-GAN model, and models of different architectures may be used by those skilled in the art. It will be obvious to those skilled in the art that the technical concept of the present disclosure is not altered even if a model different from the VAE-GAN model is used.

[0061] A cyber attack detection system (100) according to another embodiment of the present disclosure inputs a new attack scenario into a second artificial intelligence model and can obtain a detection result for the new attack scenario based on the output of the second artificial intelligence model.

[0062] In some embodiments of the present disclosure, the detection result may include information on whether the detection was successful and information on the attack scenario obtained from the detection result.

[0063] A cyber attack detection system (100) according to another embodiment of the present disclosure inputs the detection result for a new attack scenario into a second artificial intelligence model and can obtain a new detection strategy corresponding to the new attack scenario based on the output of the second artificial intelligence model.

[0064] In some embodiments of the present disclosure, the cyber attack detection system (100) may input a new attack scenario, a prompt, and a detection result to a second artificial intelligence model in response to a determination that detection of a new attack scenario is impossible, and obtain a new detection strategy corresponding to the new attack scenario based on the output of the second artificial intelligence model. Here, the prompt may include text requesting the generation of a detection strategy by referring to the new attack scenario and the detection result.

[0065] A cyber attack detection system (100) according to another embodiment of the present disclosure may store a newly generated detection strategy in a detection strategy storage. Here, the detection strategy storage may refer to a storage (110) provided in the cyber attack detection system as illustrated in FIG. 1.

[0066] A storage (110) according to one embodiment of the present disclosure may be a storage that stores a plurality of attack scenarios, a plurality of attack target environment information, and a plurality of attack target network structure information included in training data for training an artificial intelligence model.

[0067] A storage (110) according to another embodiment of the present disclosure may be a storage in which a new attack scenario, a new detection strategy, and a detection result for each of the new attack scenarios generated by a cyber attack detection system (100) are stored.

[0068] In addition, regarding the configuration of the cyber attack detection system (100) and attack scenario database (200) described above, the hardware configuration of FIG. 15, which will be described later, may be referenced. That is, the cyber attack detection system (100) and attack scenario database (200) may have the hardware configuration described with reference to FIG. 15. Furthermore, technical concepts that can be understood through some embodiments of the present disclosure described below may be incorporated into the cyber attack detection system described above without separate description.

[0069] Next, with reference to FIG. 2, a method for learning a cyber attack detection model according to another embodiment of the present disclosure will be described. The method for learning a cyber attack detection model according to the present embodiment may be performed by one or more computing systems. Additionally, the method for learning a cyber attack detection model according to the present embodiment may have some operations performed by a first computing device and the remaining operations performed by a second computing device. For example, some operations of the method for learning a cyber attack detection model according to the present embodiment may be performed by an on-premise physical server and the remaining operations may be performed by a cloud compute instance. Additionally, for example, some operations of the method for learning a cyber attack detection model according to the present embodiment may be performed by a cyber attack detection system and the remaining operations may be performed by a buyer terminal. Hereinafter, if the entity performing each operation is omitted, it may be understood that the entity performing the operation is the computing system.

[0070] In step S100 illustrated in FIG. 2, the cyber attack detection system (100) can pre-train a first artificial intelligence model.

[0071] In some embodiments related to step S100, the operation of pre-training the first artificial intelligence model may mean the operation of constructing the latent space of the first artificial intelligence model. Hereinafter, some embodiments related to step S100 will be described with reference to FIGS. 3 and 4.

[0072] In step S110, the cyber attack detection system (100) may acquire multiple attack scenarios. The multiple attack scenarios may be stored in storage (110) or an attack scenario database (200) built into the cyber attack detection system (100).

[0073] In some embodiments related to step S110, the attack scenario may be time-series data including a plurality of attack techniques. For example, referring to FIG. 4, the attack scenario (41) may be information including a first attack technique (41-1), a second attack technique (41-2), and a third attack technique (41-3), and including action sequence information for each of the attack techniques.

[0074] In some other embodiments related to step S110, the attack scenario may be data based on the MITRE ATT&CK framework.

[0075] In step S120, the cyber attack detection system (100) can obtain a vector for each of the multiple attack scenarios.

[0076] In some embodiments related to step S120, the cyber attack detection system (100) inputs each of a plurality of attack scenarios into a sequence embedding model and converts each of the plurality of attack scenarios into a vector based on the output of the sequence embedding model. Additionally, the format of the vector converted in step S120 may be a format that can be input into a first artificial intelligence model or a second artificial intelligence model.

[0077] In some other embodiments related to step S120, the sequence embedding model may be exemplified as a Gated Recurrent Unit (GRU), Long Short-Term Memory (LSTM), VAE encoder, or Recurrent Neural Network (RNN).

[0078] For example, referring to FIG. 4, the cyber attack detection system (100) can input an attack scenario (41) into a sequence embedding model (42) and obtain a vector (43) of the attack scenario (41) based on the output of the sequence embedding model (42).

[0079] In step S130, the cyber attack detection system (100) can map each vector of a plurality of attack scenarios into the potential space of the first artificial intelligence model.

[0080] For example, referring to FIG. 4, the cyber attack detection system (100) can map the vector (43) of the attack scenario to the potential space (44) of the first artificial intelligence model by converting the attack scenario (41) into a dimension that can be mapped to the potential space (44) of the first artificial intelligence model and generating the vector (43) of the attack scenario.

[0081] In some embodiments related to step S130, a plurality of attack scenarios may be clustered within a predefined range of the potential space of the first artificial intelligence model.

[0082] The attack scenarios input to an artificial intelligence model to train the artificial intelligence model according to some embodiments of the present disclosure are attack scenarios included in the MITRE ATT&CK framework, and thus may be a set of reliable and reproducible attack scenarios in the art. Accordingly, since the plurality of attack scenarios have a similarity of greater than a threshold value in a specific dimension, they may each exist in similar positions in the potential space of the artificial intelligence model.

[0083] For example, referring to FIG. 4, multiple attack scenarios based on the MITRE ATK framework input to train the first artificial intelligence model may all be located within the first range (44-1). Therefore, attack scenarios located at the first position (45) and the second position (46) can be understood as attack scenarios that do not have sufficient reliability.

[0084] Before describing step S200, a first artificial intelligence model according to some embodiments of the present disclosure is briefly described with reference to FIG. 5.

[0085] A first artificial intelligence model (52) according to one embodiment of the present disclosure may be an artificial intelligence model trained to output a plurality of attack detection bypass policies (52-1, 53-2, 53-n) in response to receiving a training dataset (51-1) and a prompt (51-3). Here, the training dataset (51-1) may be a dataset including a plurality of attack scenarios, information on the attack target environment, and information (51-2) on the attack target network structure. Additionally, the prompt (51-3) may include text requesting the output of an attack detection bypass policy (52-1, 53-2, 53-n) by referring to the training dataset (51-1).

[0086] According to some embodiments of the present disclosure, the first artificial intelligence model may be supervised, semi-supervised, or unsupervised based on a plurality of training data (i.e., a training set). For example, a training data set including a plurality of positive prompts, a plurality of negative prompts, and a plurality of correct data may be applied to the first artificial intelligence model so that the first artificial intelligence model may be supervised to such that an attack detection bypass policy (or feature data) output from the first artificial intelligence model based on positive prompts / negative prompts becomes similar / identical to an attack detection bypass policy (or feature data) included in the correct data. When the first artificial intelligence model is trained iteratively, the weights of each node included in the first artificial intelligence model may converge to an optimal value.

[0087] The following explanation continues with reference to Fig. 2.

[0088] In step S200 illustrated in FIG. 2, the cyber attack detection system (100) inputs a training dataset into the first artificial intelligence model and can obtain an attack detection bypass policy from the first artificial intelligence model.

[0089] In some embodiments related to step S200, the training dataset may further include information on the cause of detection failure for a specific attack scenario. That is, the first artificial intelligence model may generate a policy to bypass a new detection technique based on the information on the cause of detection failure.

[0090] In step S300, the cyber attack detection system (100) inputs the training dataset and the attack detection bypass policy generated in step S200 into the first artificial intelligence model, and can obtain a new attack scenario based on the output of the first artificial intelligence model.

[0091] Hereinafter, some embodiments related to step S300 will be described with reference to FIGS. 6 to 9.

[0092] In step S310 illustrated in FIG. 6, the cyber attack detection system (100) can convert attack scenarios included in the training data into vectors.

[0093] Before describing step S320, a first artificial intelligence model according to some embodiments of the present disclosure is briefly described with reference to FIG. 5.

[0094] A first artificial intelligence model (72) according to another embodiment of the present disclosure may be an artificial intelligence model trained to output a plurality of new attack scenarios (73+1, 73-2, 73-n) in response to receiving a training dataset (71-1) and a prompt (71-3).

[0095] According to some embodiments of the present disclosure, a first artificial intelligence model may be supervised, semi-supervised, or unsupervised based on a plurality of training data (i.e., a training set). For example, a training data set including a plurality of positive prompts, a plurality of negative prompts, and a plurality of correct answer data may be applied to the first artificial intelligence model, so that the first artificial intelligence model may be supervised to such that a new attack scenario (or feature data) output from the first artificial intelligence model based on positive prompts / negative prompts becomes similar / identical to the attack scenario (or feature data) included in the correct answer data. When the first artificial intelligence model is trained iteratively, the weights of each node included in the first artificial intelligence model may converge to an optimal value.

[0096] In step S320, the cyber attack detection system (100) inputs a training dataset, an attack detection bypass policy, and a prompt into a first artificial intelligence model, and can generate a prototype based on the output of the first artificial intelligence model.

[0097] In the following embodiments, the prototype is an attack scenario based on the output of the first artificial intelligence model, and it can be understood as an attack scenario for which an evaluation of whether it is an attack scenario suitable for actual use has not yet been performed. That is, if the prototype is evaluated as an attack scenario suitable for actual use, the prototype may be determined as a new attack scenario.

[0098] For example, referring to FIG. 8, the cyber attack detection system (100) inputs a training dataset (81) and a prompt (not shown) related to generating an attack scenario into a first artificial intelligence model (72), and can generate a prototype (83) based on the output of the first artificial intelligence model (72).

[0099] In step S330, the cyber attack detection system (100) inputs the prototype into a sequence embedding model and can embed the prototype into the latent space of the first artificial intelligence model based on the output of the sequence embedding model.

[0100] For example, referring to FIG. 8, the cyber attack detection system (100) can input a prototype (83) into a sequence embedding model (82) and generate a vector (84) of the prototype converted into a dimension corresponding to the latent space (85) of the first artificial intelligence model (72) based on the output of the sequence embedding model (82).

[0101] In step S340, the cyber attack detection system (100) inputs a prototype into a first artificial intelligence model and evaluates whether the prototype is an attack scenario that already exists in the potential space based on the output of the first artificial intelligence model.

[0102] For example, referring to FIG. 8, the cyber attack detection system (100) can evaluate whether there is a vector identical to the prototype vector (84) among the vectors already existing in the potential space (85) of the first artificial intelligence model (72). If a vector identical to the prototype vector (84) exists in the potential space (85) of the first artificial intelligence model (72), as shown in FIG. 6, the cyber attack detection system (100) can generate a new prototype in step S320 in response to determining that the prototype vector (84) is an already existing attack scenario.

[0103] In step S350, the cyber attack detection system (100) can evaluate the validity of the prototype in response to the determination that the prototype is not an attack scenario that already exists in the potential space of the first artificial intelligence model.

[0104] In some embodiments related to step S350, the cyber attack detection system (100) inputs a prototype into a first artificial intelligence model and evaluates the sequence consistency of the prototype based on the output of the first artificial intelligence model. Here, sequence consistency may mean whether the sequence of attack techniques included in the prototype is normal.

[0105] In some other embodiments related to step S350, the operation of evaluating the consistency of the sequence may be performed by the discriminator of the first artificial intelligence model.

[0106] In some other embodiments related to step S350, the cyber attack detection system (100) may perform the operation of step S320 again in response to a determination that the sequence consistency of the prototype is abnormal.

[0107] For example, a cyber attack detection system (100) inputs the first prototype [T1486, T1087.002, T1555, T1547.001] into the first artificial intelligence model and, based on the output of the first artificial intelligence model, can determine that the sequence of the first prototype is abnormal. Since T1486 is an attack technique that encrypts files and T1087 is an attack technique that searches for system files, the prototype in which T1486 and T1087 are performed prior to authorization and access can be evaluated as an abnormal attack scenario.

[0108] In some other embodiments related to step S350, the cyber attack detection system (100) inputs a prototype into a first artificial intelligence model and evaluates the feasibility of the prototype based on the output of the first artificial intelligence model. Here, the feasibility of the prototype may mean whether the prototype is an attack scenario that can actually be utilized.

[0109] In some other embodiments related to step S350, the first artificial intelligence model may output data related to the reality of the prototype based on the position of the prototype in the potential space of the first artificial intelligence model.

[0110] For example, referring to FIG. 8, the first artificial intelligence model (72) can output data related to the unreality of the prototype (83) if the vector (84) of the prototype is located at a first position (86) in the potential space (85) and the first position (86) does not exist within a predefined range (85-1) of the potential space (85) of the first artificial intelligence model (72).

[0111] In some other embodiments related to step S350, the first artificial intelligence model may be an artificial intelligence model trained to output data related to the realism of the prototype based on input attack target environment information and attack technique information included in the prototype.

[0112] For example, if the attack target environment information input into the first artificial intelligence model is an Android environment and any of the attack techniques included in the prototype includes PowerShell operations, the first artificial intelligence model may output data related to the unrealistic nature of the prototype.

[0113] In the embodiments described above, the first artificial intelligence model is exemplified as outputting a Boolean value regarding the realism of the prototype, but in another example, referring to the table shown in FIG. 9, the first artificial intelligence model outputs a realism score (93) for each prototype scenario (91) based on information regarding the attack target environment conditions (92) and the prototype scenario (91), and the cyber attack detection system (100) can generate a realism determination result (94) for each prototype scenario (91).

[0114] In step S360, the cyber attack detection system (100) may determine the prototype as a new attack scenario in response to a determination that the prototype is a valid attack scenario.

[0115] In some embodiments related to step S360, the prototype determined as a new attack scenario can be input into the second artificial intelligence model to be described later.

[0116] The following is explained again with reference to Fig. 2.

[0117] In step S400, the cyber attack detection system (100) inputs the new attack scenario generated in step S300 into the second artificial intelligence model and obtains a detection result for the new attack scenario based on the output of the second artificial intelligence model.

[0118] In some embodiments related to step S400, the second artificial intelligence model may be a model trained using a plurality of attack scenarios.

[0119] Hereinafter, several embodiments related to step S400 will be described in detail with reference to FIGS. 10 to 14.

[0120] Before describing some embodiments related to step S400, a second artificial intelligence model according to some embodiments of the present disclosure is briefly described with reference to FIG. 11.

[0121] A second artificial intelligence model (112) according to one embodiment of the present disclosure may be an artificial intelligence model trained to output a probability of detection for a new attack scenario (113-1), data on the cause of failure of detection for a new attack scenario (113-2), a defense policy (113-3) corresponding to the new attack scenario, and a new detection strategy (113-4) in response to receiving a new attack scenario (111-1) and a prompt (111-2).

[0122] According to some embodiments of the present disclosure, the second artificial intelligence model may be supervised, semi-supervised, or unsupervised based on a plurality of training data (i.e., training sets). For example, a training data set including a plurality of positive prompts, a plurality of negative prompts, and a plurality of ground truth data may be applied to the second artificial intelligence model so that the detectability probability, detection failure cause data, defense policy, or new detection strategy (or feature data) output from the second artificial intelligence model based on the positive prompts / negative prompts become similar / identical to the detectability probability, detection failure cause data, defense policy, or new detection strategy (or feature data) included in the ground truth data. When the training of the second artificial intelligence model is repeated, the weights of each node included in the second artificial intelligence model may converge to an optimal value.

[0123] In step S410 illustrated in FIG. 10, the cyber attack detection system (100) can analyze a new attack scenario.

[0124] In some embodiments related to step S410, the cyber attack detection system (100) can model a new attack scenario in the form of a graph and compare it with each of the previously stored attack scenario graphs.

[0125] In some other embodiments related to step S410, the cyber attack detection system (100) inputs a new attack scenario into a second artificial intelligence model and can calculate the similarity between an existing attack scenario and a new attack scenario based on the output of the second artificial intelligence model.

[0126] For example, referring to FIG. 12, the second artificial intelligence model can output a similarity between an existing attack scenario and a new attack scenario based on the locations of a plurality of attack scenario vectors stored in the potential space (121) of the second artificial intelligence model and the locations of vectors of a new attack scenario (122). The existing attack scenarios may be extracted by random sampling within a predefined range (121-1) of the potential space (121).

[0127] In step S420, the cyber attack detection system (100) inputs a new attack scenario into a second artificial intelligence model and can obtain attack disruption data corresponding to the new attack scenario based on the output of the second artificial intelligence model.

[0128] For example, referring to FIG. 12, if a new attack scenario (122) exists at a first location (123) and the new attack scenario (122) exists within a predefined range (121-1) of a potential space (121), the second artificial intelligence model may output data related to a disturbance behavior corresponding to the attack scenario most similar to the new attack scenario (122). The disturbance behavior may be any one of the algorithm table (125) shown in FIG. 12, but it will be obvious to those skilled in the art that there may be disturbance behaviors not exemplified in the algorithm table (125) in the art.

[0129] For another example, referring to FIG. 12, the second artificial intelligence model can output data related to the absence of disruptive behavior corresponding to the new attack scenario (122) when the new attack scenario (122) exists in the second location (124) and the new attack scenario (122) does not exist within the predefined range (121-1) of the potential space (121).

[0130] In step S430, the cyber attack detection system (100) can predict a second sequence of attack techniques following a first sequence of attack techniques having a first sequence included in a new attack scenario.

[0131] In some embodiments related to step S430, the cyber attack detection system (100) sequentially inputs each attack technique included in the new attack scenario into a second artificial intelligence model and obtains a prediction result for a subsequent sequence of attack techniques that have not yet been input from the second artificial intelligence model.

[0132] For example, referring to FIG. 13, a cyber attack detection system (100) inputs a new attack scenario (122) into a second artificial intelligence model (112), and the second artificial intelligence model (112) can obtain attack techniques and sequence information (131) of attack techniques included in the new attack scenario predicted by the second artificial intelligence model (112).

[0133] In step S440, the cyber attack detection system (100) can evaluate whether the prediction result output by the second artificial intelligence model in step S430 is correct.

[0134] In some embodiments related to step S440, the cyber attack detection system (100) may perform step S500-1 in response to a judgment that the prediction result output by the second artificial intelligence model is similar to the new attack scenario by more than a threshold value. Step S500-1 will be described in detail later.

[0135] In some other embodiments related to step S440, the cyber attack detection system (100) may perform step S450 in response to a judgment that the prediction result output by the second artificial intelligence model is similar to the new attack scenario by less than a threshold. Step S450 will be described in detail later.

[0136] For example, as illustrated in FIG. 13, if the attack technique (132) included in the new attack scenario (122) includes the T1078 attack technique in the second sequence, and the attack technique and sequence information (131) of the attack technique included in the new attack scenario predicted by the second artificial intelligence model includes the T1055 attack technique in the second sequence, the cyber attack detection system (100) may determine that the detection of the new attack scenario (122) has failed.

[0137] In step S450, the cyber attack detection system (100) can evaluate whether it is possible to detect and defend against new attack scenarios.

[0138] In some embodiments related to step S450, the cyber attack detection system (100) may convert a new attack scenario into a feature vector and obtain a stealth score of the new attack scenario based on the value of each component included in the feature vector. Additionally, the detection probability for the new attack scenario may be determined based on the stealth score.

[0139] For example, the value of each component included in the feature vector may be a value related to the similarity of the new attack scenario to the signature of a predefined security solution, whether system files have been modified, and whether they have been obfuscated.

[0140] In some other embodiments related to step S450, the cyber attack detection system (100) inputs a new attack scenario into a second artificial intelligence model and can determine the probability of defense for the new attack scenario based on output data output by the second artificial intelligence model based on the similarity between each vector of the defense policy and the vector of the new attack scenario.

[0141] For example, referring to FIG. 14, the cyber attack detection system (100) can input a new attack scenario (122) into a second artificial intelligence model. Additionally, if the new attack scenario (122) exists at a first location (123) of a potential space (121), the second artificial intelligence model can output information about a first defense policy (142) having a similarity greater than or equal to a threshold value with the new attack scenario (122) and the similarity between the first defense policy (142) and the new attack scenario (122).

[0142] Furthermore, the cyber attack detection system (100) can determine the probability of defense against the new attack scenario (122) in response to the judgment that there exists a first defense policy (142) having a similarity to the new attack scenario (122) greater than or equal to a threshold value.

[0143] For another example, referring to FIG. 14, a cyber attack detection system (100) inputs a new attack scenario (122) into a second artificial intelligence model, and if the new attack scenario (122) exists in a second location (124) outside of a predefined range (121-1) of the potential space (121) of the second artificial intelligence model, a lower probability of defense can be determined compared to when the new attack scenario (122) is located in a first location (123).

[0144] In some other embodiments related to step S450, the cyber attack detection system (100) can evaluate whether detection and defense of a new attack scenario are possible based on the probability of defense.

[0145] For example, by referring to the attack scenario evaluation table (141) illustrated in FIG. 14, the cyber attack detection system (100) can determine the possibility of detection evasion for each attack scenario based on the detection probability and the probability of defense for each attack scenario.

[0146] The following explanation continues with reference to Fig. 2.

[0147] In step S500-1, the cyber attack detection system (100) may input the detection result into the first artificial intelligence model and store it in the storage (110) in response to the determination that the second artificial intelligence model has succeeded in detecting a new attack scenario. Here, the detection result may include attack scenario information already existing in the potential space of the second artificial intelligence model corresponding to the new attack scenario generated in step S300, defense policy information corresponding to the new attack scenario, and a detection success log.

[0148] In step S600, the cyber attack detection system (100) can input the new attack scenario and the detection failure log into the second artificial intelligence model in response to the judgment that it failed to detect a new attack scenario, and evaluate whether it is possible to generate detection failure cause data and a new detection strategy based on the output of the second artificial intelligence model.

[0149] In some embodiments related to step S600, the detection failure log may include data related to the detection strategy used to detect the new attack scenario.

[0150] In some other embodiments related to step S600, the cyber attack detection system (100) may extract techniques included in the new attack scenario and sequence information for each of the techniques in response to a determination that it failed to detect a new attack scenario.

[0151] In some other embodiments related to step S600, the cyber attack detection system (100) inputs the new attack scenario and the detection failure log into a second artificial intelligence model in response to a judgment that it failed to detect a new attack scenario, and based on the output of the second artificial intelligence model, can obtain data related to the coverage difference between a first detection strategy corresponding to a first attack scenario having a similarity of more than a threshold value with the new attack scenario and a detection strategy corresponding to the new attack scenario.

[0152] For example, the coverage of a detection strategy may refer to data related to the types of attack techniques that can be detected using a specific detection strategy.

[0153] In some other embodiments related to step S600, the cyber attack detection system (100) inputs data related to the coverage difference between a first detection strategy corresponding to a first attack scenario having a similarity greater than or equal to a threshold value and a detection strategy corresponding to a new attack scenario into a second artificial intelligence model, and can generate detection failure cause data based on the output of the second artificial intelligence model.

[0154] In some other embodiments related to step S600, the second artificial intelligence model can output data related to the cause of detection failure using the value of each component included in the feature vector corresponding to the new attack scenario.

[0155] For example, if the value of the encryption status component of the feature vector of a new attack scenario is above a threshold, the second AI model can output information that the cause of the detection failure is 'command obfuscation'.

[0156] In some other embodiments related to step S600, the second artificial intelligence model can output data related to the cause of detection failure based on predefined detection coverage information.

[0157] For example, if the second artificial intelligence model does not include the T1059 attack technique in the predefined detection coverage information, but the T1059 attack technique is included in the new attack scenario, it can output information that the cause of the detection failure is an 'attack outside the detection range'.

[0158] In some other embodiments related to step S600, the second artificial intelligence model can output data related to the cause of detection failure based on the similarity between a previously stored attack detection bypass policy and an attack detection bypass policy included in a new attack scenario.

[0159] For example, if the second AI model has a similarity level below a threshold with previously stored attack detection evasion policies included in a new attack scenario, it can output information that the cause of detection failure is 'high stealth'.

[0160] In some other embodiments related to step S600, the cyber attack detection system (100) inputs detection failure cause data and a new attack scenario into a second artificial intelligence model and can obtain a new detection strategy based on the output of the second artificial intelligence model.

[0161] For example, a new detection strategy may include patching requirements necessary to detect new attack scenarios.

[0162] As another example, the second AI model can output information regarding the differences between the new attack scenario and the closest defense policy in response to receiving data on the causes of detection failure and a new attack scenario as input. Additionally, based on the information regarding the differences, it can output recommended patch details and system updates.

[0163] In step S700-1, the cyber attack detection system (100) can store the new detection strategy in storage (110) if a new detection strategy is generated.

[0164] In step S700-2, the cyber attack detection system (100) may store a new attack scenario in storage (110) in response to a determination that it failed to generate a new detection strategy or failed to generate undetectable cause data, and may input the new attack scenario into a second artificial intelligence model to further train the second artificial intelligence model.

[0165] Up to this point, a method for learning a cyber attack detection model according to another embodiment of the present disclosure has been described with reference to FIGS. 2 through 14. The embodiments described above should be understood as illustrative in all respects and not restrictive.

[0166] FIG. 15 is a hardware configuration diagram of a computing system (1000) according to some embodiments of the present disclosure. The computing system (1000) of FIG. 15 may refer to, for example, the cyber attack detection system (100) described with reference to FIG. 1. The computing system (1000) may include one or more processors (1100), a system bus (1600), a communication interface (1200), a memory (1400) for loading a computer program (1500) executed by the processor (1100), and a storage (1300) for storing the computer program (1500).

[0167] The processor (1100) controls the overall operation of each component of the computing system (1000). The processor (1100) may perform operations on at least one application or program for executing methods / operations according to various embodiments of the present disclosure. Memory (1400) stores various data, instructions and / or information. Memory (1400) may load one or more computer programs (1500) from storage (1300) to execute methods / operations according to various embodiments of the present disclosure. A bus (1600) provides communication functions between components of the computing system (1000). A communication interface (1200) supports internet communication of the computing system (1000). Storage (1300) may non-temporarily store one or more computer programs (1500). A computer program (1500) may include one or more instructions in which methods / operations according to various embodiments of the present disclosure are implemented. When a computer program (1500) is loaded into memory (1400), the processor (1100) can perform methods / operations according to various embodiments of the present disclosure by executing one or more of the instructions.

[0168] In some embodiments, the computing system (1000) described with reference to FIG. 15 may be configured using one or more physical servers included in a server farm based on cloud technology such as a virtual machine. In this case, at least some of the components shown in FIG. 15, such as the processor (1100), memory (1400), and storage (1300), may be virtual hardware, and the communication interface (1200) may also be configured as a virtualized networking element such as a virtual switch.

[0169] A computer program (1500) according to some embodiments of the present disclosure may include instructions for performing steps of: inputting a learning dataset and an attack detection bypass policy of a computing system (1000) into a first artificial intelligence model and obtaining a new attack scenario based on the output of the first artificial intelligence model; inputting the new attack scenario into a second artificial intelligence model and obtaining a detection result for the new attack scenario based on the output of the second artificial intelligence model; and inputting the detection result for the new attack scenario into the second artificial intelligence model and obtaining a new detection strategy corresponding to the new attack scenario based on the output of the second artificial intelligence model.

[0170] Various embodiments of the present disclosure and effects according to those embodiments have been described with reference to FIGS. 1 to 15. The effects according to the technical concept of the present disclosure are not limited to those mentioned above, and other unmentioned effects will be clearly understood by a person skilled in the art from the description below.

[0171] The technical concept of the present disclosure described above may be implemented as computer-readable code on a computer-readable medium. The computer program recorded on the computer-readable recording medium may be transmitted to another computing device via a network such as the Internet and installed on the other computing device, thereby being used on the other computing device.

[0172] Although operations are depicted in a specific order in the drawings, it should not be understood that the operations must necessarily be executed in the specific order depicted or in a sequential order, or that all depicted operations must be executed to obtain the desired result. In certain situations, multitasking and parallel processing may be advantageous. Although embodiments of the present disclosure have been described above with reference to the attached drawings, those skilled in the art will understand that the present invention may be practiced in other specific forms without altering the technical concept or essential features thereof. Therefore, the embodiments described above should be understood as illustrative in all respects and not restrictive. The scope of protection of the present invention shall be interpreted by the claims below, and all technical concepts within the equivalent scope shall be interpreted as being included within the scope of rights of the technical concept defined by the present disclosure.

Claims

Claim 1 A method performed by a computing system comprises the steps of: inputting a training dataset and an attack detection evasion policy into a first artificial intelligence model and obtaining a new attack scenario based on the output of the first artificial intelligence model; inputting the new attack scenario into a second artificial intelligence model and obtaining a detection result for the new attack scenario based on the output of the second artificial intelligence model—the second artificial intelligence model being an artificial intelligence model trained based on a plurality of attack scenarios—; A method for learning a cyber attack detection model, comprising the steps of: inputting a detection result for the new attack scenario into the second artificial intelligence model and obtaining a new detection strategy corresponding to the new attack scenario based on the output of the second artificial intelligence model; wherein the step of obtaining the new attack scenario includes: inputting the training dataset and the attack detection evasion policy into the first artificial intelligence model and generating a prototype based on the output of the first artificial intelligence model; inputting the prototype into the first artificial intelligence model and evaluating whether the prototype is an attack scenario that already exists in the potential space of the first artificial intelligence model based on the output of the first artificial intelligence model; in response to the judgment that the prototype is an attack scenario that does not exist in the potential space, inputting the prototype into the first artificial intelligence model and evaluating the validity of the prototype based on the output of the first artificial intelligence model; and determining the prototype as the new attack scenario based on the judgment that the prototype is valid. Claim 2 A method for training a cyber attack detection model according to claim 1, further comprising, prior to the step of acquiring the new attack scenario, the step of inputting the training dataset into the first artificial intelligence model to train the first artificial intelligence model so that the first artificial intelligence model generates the attack detection bypass policy. Claim 3 A method for learning a cyber attack detection model according to claim 1, further comprising the step of storing the new detection strategy in a detection strategy storage, wherein the attack scenario is time-series data including multiple attack techniques. Claim 4 A method for learning a cyber attack detection model according to claim 1, further comprising the step of configuring a potential space of the first artificial intelligence model, wherein the step of configuring the potential space comprises: acquiring a plurality of attack scenarios and acquiring a vector for each of the plurality of attack scenarios; and mapping the vector for each of the plurality of attack scenarios to the potential space of the first artificial intelligence model. Claim 5 A method for training a cyber attack detection model according to claim 1, wherein the training dataset includes a plurality of attack scenarios, information on the attack target environment, and information on the attack target network structure. Claim 6 delete Claim 7 A method for learning a cyber attack detection model according to claim 1, wherein the first artificial intelligence model evaluates the validity of the prototype based on the position of the vector of the prototype in the potential space. Claim 8 A method for learning a cyber attack detection model according to claim 1, further comprising the step of inputting the attack scenario into the second artificial intelligence model to additionally train the second artificial intelligence model in response to a determination that a new detection strategy cannot be generated based on the output of the second artificial intelligence model. Claim 9 A method for training a cyber attack detection model, wherein, in claim 1, the first artificial intelligence model is a VAE-GAN (Variational AutoEncoder-Generative Adversarial Network) model and the second artificial intelligence model is a GAN model. Claim 10 A method for learning a cyber attack detection model according to claim 1, wherein the second artificial intelligence model includes vectors of the plurality of attack scenarios in a latent space, evaluates the reproducibility of the new attack scenario based on similarity between the plurality of attack scenarios and a part of the new attack scenario, and outputs attack disruption data based on the result of the evaluation. Claim 11 A method for learning a cyber attack detection model according to claim 1, further comprising the step of inputting the detection result for the attack scenario output by the second artificial intelligence model into the first artificial intelligence model in response to the detection that the attack scenario is a hostile scenario, and additionally training the first artificial intelligence model so that the first artificial intelligence model generates an attack detection bypass policy for the detection result for the attack scenario. Claim 12 A method performed by a computing system comprises the steps of: inputting a training dataset and an attack detection evasion policy into a first artificial intelligence model and obtaining a new attack scenario based on the output of the first artificial intelligence model; inputting the new attack scenario into a second artificial intelligence model and obtaining a detection result for the new attack scenario based on the output of the second artificial intelligence model—the second artificial intelligence model being an artificial intelligence model trained based on a plurality of attack scenarios—; A method for learning a cyber attack detection model, comprising the steps of: inputting a detection result for the new attack scenario into the second artificial intelligence model and obtaining a new detection strategy corresponding to the new attack scenario based on the output of the second artificial intelligence model; wherein the step of obtaining a detection result for the new attack scenario comprises: inputting the new attack scenario into the second artificial intelligence model and obtaining attack disruption data based on the output of the second artificial intelligence model; inputting a first attack technique included in the new attack scenario into the second artificial intelligence model and obtaining a prediction result for a second attack technique having the next sequence of the first attack technique based on the output of the second artificial intelligence model; comparing the second attack technique included in the new attack scenario with the prediction result for the second attack technique; and evaluating whether the new attack scenario is detectable based on the result of the comparison. Claim 13 A method performed by a computing system comprises: a step of inputting a learning dataset and an attack detection evasion policy into a first artificial intelligence model and obtaining a new attack scenario based on the output of the first artificial intelligence model; a step of inputting the new attack scenario into a second artificial intelligence model and obtaining a detection result for the new attack scenario based on the output of the second artificial intelligence model—the second artificial intelligence model being an artificial intelligence model trained based on a plurality of attack scenarios—; and a step of inputting the detection result for the new attack scenario into the second artificial intelligence model and obtaining a new detection strategy corresponding to the new attack scenario based on the output of the second artificial intelligence model, wherein the step of obtaining a new detection strategy corresponding to the new attack scenario based on the output of the second artificial intelligence model comprises: a step of inputting the new attack scenario and a detection failure log into the second artificial intelligence model in response to a failure in detection of the new attack scenario, and generating detection failure cause data based on the output of the second artificial intelligence model. A method for training a cyber attack detection model, comprising the step of inputting the detection failure cause data into the second artificial intelligence model and further training the second artificial intelligence model so that the second artificial intelligence model generates the new detection strategy. Claim 14 In claim 13, the step of inputting the new attack scenario and the detection failure log into a second artificial intelligence model in response to the failure to detect the new attack scenario and generating detection failure cause data based on the output of the second artificial intelligence model comprises: the step of inputting the new attack scenario and the detection failure log into the second artificial intelligence model and, based on the output of the second artificial intelligence model, obtaining data related to the difference between the coverage of the first detection strategy and the coverage of the detection strategy used to detect the new attack scenario; and the step of inputting data related to the difference between the coverage of the first detection strategy and the coverage of the detection strategy used to detect the new attack scenario into the second artificial intelligence model and, based on the output of the second artificial intelligence model, generating detection failure cause data, wherein the first detection strategy is a detection strategy corresponding to the first attack scenario having a similarity of more than a threshold value with the new attack scenario, a method for learning a cyber attack detection model. Claim 15 One or more processors; a memory for storing a computer program executed by the one or more processors, wherein the computer program comprises: a step of causing the processor to input a learning dataset and an attack detection evasion policy into a first artificial intelligence model and to obtain a new attack scenario based on the output of the first artificial intelligence model; a step of inputting the new attack scenario into a second artificial intelligence model and to obtain a detection result for the new attack scenario based on the output of the second artificial intelligence model—the second artificial intelligence model is an artificial intelligence model trained based on a plurality of attack scenarios—; A cyber attack detection system comprising: an instruction to input a detection result for the new attack scenario into the second artificial intelligence model and to obtain a new detection strategy corresponding to the new attack scenario based on the output of the second artificial intelligence model, wherein the step of obtaining the new attack scenario includes: inputting the training dataset and the attack detection evasion policy into the first artificial intelligence model and generating a prototype based on the output of the first artificial intelligence model; inputting the prototype into the first artificial intelligence model and evaluating whether the prototype is an attack scenario that already exists in the potential space of the first artificial intelligence model based on the output of the first artificial intelligence model; in response to a judgment that the prototype is an attack scenario that does not exist in the potential space, inputting the prototype into the first artificial intelligence model and evaluating the validity of the prototype based on the output of the first artificial intelligence model; and determining the prototype as the new attack scenario based on a judgment that the prototype is valid. Claim 16 In claim 15, the computer program further comprises instructions that cause the processor to perform the step of constructing a potential space of the first artificial intelligence model, wherein the step of constructing the potential space includes the step of obtaining a plurality of attack scenarios and obtaining a vector for each of the plurality of attack scenarios; and the step of mapping the vector for each of the plurality of attack scenarios to the potential space of the first artificial intelligence model, a cyber attack detection system. Claim 17 delete Claim 18 A cyber attack detection system according to claim 15, wherein the first artificial intelligence model evaluates the validity of the prototype based on the position of the vector of the prototype in the potential space. Claim 19 One or more processors; a memory for storing a computer program executed by the one or more processors, wherein the computer program comprises: a step of causing the processor to input a learning dataset and an attack detection evasion policy into a first artificial intelligence model and to obtain a new attack scenario based on the output of the first artificial intelligence model; a step of inputting the new attack scenario into a second artificial intelligence model and to obtain a detection result for the new attack scenario based on the output of the second artificial intelligence model—the second artificial intelligence model is an artificial intelligence model trained based on a plurality of attack scenarios—; A cyber attack detection system comprising instructions for inputting a detection result for the new attack scenario into the second artificial intelligence model and obtaining a new detection strategy corresponding to the new attack scenario based on the output of the second artificial intelligence model, wherein the step of obtaining a detection result for the new attack scenario includes: inputting the new attack scenario into the second artificial intelligence model and obtaining attack disruption data based on the output of the second artificial intelligence model; inputting a first attack technique included in the new attack scenario into the second artificial intelligence model and obtaining a prediction result for a second attack technique having the next sequence of the first attack technique based on the output of the second artificial intelligence model; comparing the second attack technique included in the new attack scenario with the prediction result for the second attack technique; and evaluating whether the new attack scenario is detectable based on the result of the comparison. Claim 20 One or more processors; a memory for storing a computer program executed by the one or more processors, wherein the computer program comprises instructions for the processor to perform the steps of: inputting a learning dataset and an attack detection evasion policy into a first artificial intelligence model and obtaining a new attack scenario based on the output of the first artificial intelligence model; inputting the new attack scenario into a second artificial intelligence model and obtaining a detection result for the new attack scenario based on the output of the second artificial intelligence model—the second artificial intelligence model being an artificial intelligence model trained based on a plurality of attack scenarios—; and inputting the detection result for the new attack scenario into the second artificial intelligence model and obtaining a new detection strategy corresponding to the new attack scenario based on the output of the second artificial intelligence model, wherein the step of obtaining a new detection strategy corresponding to the new attack scenario based on the output of the second artificial intelligence model comprises the steps of: inputting the new attack scenario and a detection failure log into the second artificial intelligence model in response to a failure in detection of the new attack scenario, and generating detection failure cause data based on the output of the second artificial intelligence model. A cyber attack detection system comprising the step of inputting the detection failure cause data into the second artificial intelligence model and further training the second artificial intelligence model so that the second artificial intelligence model generates the new detection strategy. Claim 21 A computer-readable recording medium storing instructions, wherein the instructions comprise: a step of inputting a learning dataset and an attack detection evasion policy into a first artificial intelligence model and obtaining a new attack scenario based on the output of the first artificial intelligence model; a step of inputting the new attack scenario into a second artificial intelligence model and obtaining a detection result for the new attack scenario based on the output of the second artificial intelligence model—the second artificial intelligence model is an artificial intelligence model trained based on a plurality of attack scenarios—; A computer-readable recording medium comprising: an instruction configured to input a detection result for the new attack scenario into the second artificial intelligence model and to obtain a new detection strategy corresponding to the new attack scenario based on the output of the second artificial intelligence model, wherein the step of obtaining the new attack scenario includes: inputting the training dataset and the attack detection evasion policy into the first artificial intelligence model and generating a prototype based on the output of the first artificial intelligence model; inputting the prototype into the first artificial intelligence model and evaluating whether the prototype is an attack scenario that already exists in the potential space of the first artificial intelligence model based on the output of the first artificial intelligence model; inputting the prototype into the first artificial intelligence model in response to a judgment that the prototype is an attack scenario that does not exist in the potential space and evaluating the validity of the prototype based on the output of the first artificial intelligence model; and determining the prototype as the new attack scenario based on a judgment that the prototype is valid.

Images