Cyber threat information processing device, cyber threat information processing method, and storage medium for storing program for processing cyber threat information

Abstract

The present invention provides a cyber threat information providing method comprising the steps of: extracting features by disassembling a first file; generating a malware image on the basis of the extracted features; generating an attention map corresponding to the malware image by inputting the malware image to a vision transformer (ViT) model; extracting, from the attention map, pixel positions of attention values included in the attention map; extracting an attention sequence by using at least one of the features, the malware image, the size of the malware image, and the pixel positions of the attention values; and generating an attention feature rule on the basis of the attention sequence.

Description

Cyber ​​threat information processing device, cyber threat information processing method, and storage medium storing a cyber threat information processing program

[0001] The disclosed embodiments relate to a cyber threat information processing device, a cyber threat information processing method, and a storage medium storing a cyber threat information processing program.

[0002]

[0003] Cybersecurity threats, particularly those centered around new or variant malware, are becoming increasingly sophisticated and inflicting increasing damage. To mitigate this damage and respond quickly, we are continuously improving our response technologies through multidimensional pattern composition and various complex analyses. However, recent cyberattacks are increasingly becoming more threatening rather than being adequately addressed within control. These cyberattacks are now reaching beyond existing ICT (Information and Communication Technology) infrastructure, directly impacting our lives in areas such as finance, transportation, the environment, and health.

[0004] One of the fundamental technologies for detecting and responding to most existing cybersecurity threats involves pre-creating a database of patterns for cyberattacks or malware and utilizing appropriate monitoring technologies where data flow is required. Existing technologies have evolved based on identifying and responding to threats when data flows or code matching the monitored patterns are detected. While these existing technologies offer the advantage of rapid and accurate detection when matching pre-established patterns, they can be difficult to detect or time-consuming for new or variant threats that lack established patterns or that bypass them.

[0005] Conventional technologies, even those leveraging AI analysis, focus on improving the detection and analysis of malware itself. However, fundamentally, the lack of a fundamental technology for countering cybersecurity threats means that these methods alone are limited in their ability to respond to new malware or its variants.

[0006] For example, there is a problem that the technology to detect and analyze already discovered malware itself cannot respond to decoy information or fake information intended to deceive the detection or analysis system, causing confusion.

[0007] For mass-produced malware with ample training data, sufficient characteristic information can be collected, enabling detection of maliciousness and malware type. However, for Advanced Persistent Threat (APT) attacks, which are produced in relatively small quantities and are sophisticated, training data often does not match, and the majority of attacks are targeted. Therefore, existing technologies, even with their advancements, face limitations.

[0008] Furthermore, traditionally, the methods and techniques for describing malware, attack code, or cyber threats varied depending on the analyst's perspective or analytical perspective. For example, the method for describing malware and attack behavior was not standardized globally, leading to confusion due to inconsistent descriptions by experts in the field even when detecting the same incident or malware. Furthermore, the names of detected malware were not unified, making it difficult to accurately identify the specific attack performed or to categorize it differently, even for the same malicious files. Consequently, the identified attack techniques were not explained in a standardized and standardized manner.

[0009] Conventional malware detection and analysis methods have focused on detecting the malware itself, and have had the problem of not being able to identify attackers when the attackers who create malware perform very similar malicious behavior are different.

[0010] In connection with the above problems, the conventional method had the problem of making it difficult to predict what kind of cyber threat attacks would occur in the near future due to the detection method focusing on individual cases.

[0011]

[0012] The purpose of the embodiments disclosed below is to provide a cyber threat information processing device, a cyber threat information processing method, and a storage medium storing a cyber threat information processing program that can detect and respond to malware that does not exactly match data learned by artificial intelligence and can respond to variants of malware.

[0013] Another object of the embodiment is to provide a cyber threat information processing device, a cyber threat information processing method, and a storage medium storing a cyber threat information processing program that can identify malware, attack techniques, attackers, and attack prediction methods in a very short period of time, even if the malware is a variant.

[0014] Another purpose of the embodiment is to provide a cyber threat information processing device, a cyber threat information processing method, and a storage medium for storing a cyber threat information processing program that can provide information on malicious codes whose names for malware detection are not unified or whose cyber attack techniques are not accurately described in a normalized and standardized manner.

[0015] Another object of the embodiment is to provide a cyber threat information processing device, a cyber threat information processing method, and a storage medium storing a cyber threat information processing program that can identify other attackers who create malicious codes that perform very similar malicious actions and predict what kind of cyber threat attacks will occur in the future.

[0016] Another purpose of the embodiment is to provide specific examples that can more clearly detect and recognize whether the difference in attack techniques or attack groups that occurs due to differences in the execution process, even though the execution result of the executed file is the same, is actually a different attack technique or is performed by a different attack group.

[0017] Another purpose of the examples is to provide specific examples of how cyber threat information, attack techniques and attack groups can be identified for various file types contained therein, even if they are non-executable files rather than executable files.

[0018] Another purpose of the embodiments is to provide examples of monitoring web pages and identifying web pages that contain malicious activity or information, and identifying whether components of the web pages contain malicious activity or information.

[0019] Another purpose of the examples is to provide specific examples that can identify cyber threat information, attack techniques and attack groups contained in web pages.

[0020] Another purpose of the embodiment is to provide an embodiment in which users, even non-experts, can easily understand the mechanism and basis of analysis of cyber threat information.

[0021]

[0022] One embodiment of the present invention provides a method for providing cyber threat information, comprising: a step of disassembling a first file to extract features; a step of generating a malware image based on the extracted features; a step of inputting the malware image into a ViT (Vision Transformer) model to generate an attention map corresponding to the malware image; a step of extracting a pixel location of an attention value included in the attention map from the attention map; a step of extracting an attention sequence using at least one of the feature, the malware image, the size of the malware image, and the pixel location of the attention value; and a step of generating an attention feature rule based on the attention sequence.

[0023] The above cyber threat information providing method is characterized by including the steps of: receiving a request for analysis of a second file from a user; classifying at least one of maliciousness, an attack group, an attack technique, and a threat type of the second file using the generated attention feature rule; and providing the classification result to the user.

[0024] One embodiment of the present invention provides a cyber threat information providing device, comprising: a database for storing data; and a processor; wherein the processor disassembles a first file to extract features, generates a malware image based on the extracted features, inputs the malware image into a ViT (Vision Transformer) model to generate an attention map corresponding to the malware image, extracts a pixel location of an attention value included in the attention map from the attention map, extracts an attention sequence using at least one of the feature, the malware image, the size of the malware image, and the pixel location of the attention value, and generates an attention feature rule based on the attention sequence.

[0025] The processor is characterized in that it receives a request for analysis of a second file from a user, classifies at least one of maliciousness, an attack group, an attack technique, and a threat type of the second file using the generated attention feature rule, and provides the classification result to the user.

[0026] One embodiment of the present invention provides a computer-executable cyber threat information providing program, which comprises: a step of disassembling a first file to extract features; a step of generating a malware image based on the extracted features; a step of inputting the malware image into a ViT (Vision Transformer) model to generate an attention map corresponding to the malware image; a step of extracting a pixel location of an attention value included in the attention map from the attention map; a step of extracting an attention sequence using at least one of the feature, the malware image, the size of the malware image, and the pixel location of the attention value; and a step of generating an attention feature rule based on the attention sequence.

[0027]

[0028] According to the embodiments disclosed below, it is possible to detect and respond to malware that does not exactly match data learned through machine learning, and to respond to variants of malware.

[0029] According to the embodiment, even if it is a variant of malware, it is possible to identify malware, attack techniques, and attackers in a very short period of time, and furthermore, it is possible to predict the attack techniques of a specific attacker in the future.

[0030] In one embodiment, the method of implementing a cyberattack can be accurately identified based on the presence of malware, attack technique, attack identifier, and attacker, and provided as a standardized model. In another embodiment, information on malware, where detection names are not standardized or cyberattack techniques are not accurately described, can be provided in a standardized and regularized manner.

[0031] It can also provide a means to predict the possibility of creating previously unknown malware and the attackers who might develop it, and to predict what kind of cyber threat attacks will occur in the future.

[0032] According to the embodiment, even if the execution result of the executed file is the same, it is possible to more clearly detect and recognize different attack techniques or different attack groups that occur depending on the difference in the execution process.

[0033] According to an embodiment, even if it is a non-executable file rather than an executable file, cyber threat information, attack techniques and attack groups can be identified for various file types contained therein.

[0034] According to an embodiment, it is possible to monitor web pages and identify web pages containing malicious behavior or information, and further identify cyber threat information, attack techniques, and attack groups contained in the web pages.

[0035] In an embodiment, cyber threat information can be easily understood by users, even if they are not experts, in terms of its mechanism and analysis basis.

[0036]

[0037] Figure 1 is a drawing illustrating one embodiment of a method for processing cyber threat information.

[0038] Figure 2 is a drawing disclosing one embodiment of a cyber threat information processing device.

[0039] Figure 3 is a drawing disclosing one embodiment of a cyber threat information processing device.

[0040] FIG. 4 is a diagram showing an example of performing static analysis of an executable file according to an embodiment disclosed.

[0041] FIG. 5 is a diagram showing an example of performing dynamic analysis of an executable file according to an embodiment disclosed.

[0042] Figure 6 is a diagram showing an example of in-depth analysis, in which malware is disassembled to determine that the file contains malicious behavior.

[0043] FIG. 7 is a diagram illustrating a flow of processing cyber threat information according to an embodiment disclosed.

[0044] FIG. 8 is a diagram illustrating values ​​converted from OP-CODE and ASM-CODE to normalized codes according to an embodiment disclosed.

[0045] FIG. 9 is a diagram illustrating vectorized values ​​of OP-CODE and ASM-CODE according to an embodiment of the present disclosure.

[0046] FIG. 10 is a diagram showing an example of converting a block unit of code into a hash value according to an embodiment of the present disclosure.

[0047] FIG. 11 is a diagram illustrating an example of an ensemble machine learning model according to an embodiment of the present disclosure.

[0048] FIG. 12 is a diagram illustrating a flow of learning and classifying data using machine learning according to an embodiment disclosed herein.

[0049] FIG. 13 is a diagram showing an example of performing labeling by identifying an attack identifier and an attacker using learning data according to an embodiment disclosed.

[0050] Figure 14 is a diagram showing the result of identifying an attack identifier according to an embodiment.

[0051] FIG. 15 is a diagram showing an example of matching an attack technique with codes extracted from binary code according to an embodiment disclosed.

[0052] FIG. 16 is a diagram showing an example of matching an attack technique with a code set including an OP-CODE according to an embodiment of the present disclosure.

[0053] Figure 17 is a diagram for explaining an example of performing a function unit attack technique and attack group identification.

[0054] Figure 18 is a diagram for explaining an example of performing attack techniques and attack group identification when functions are separated.

[0055] FIG. 19 is a drawing disclosing an example of obtaining characteristic information related to a cyber threat according to an embodiment.

[0056] FIG. 20 is a diagram illustrating a process of obtaining control flow using a branch instruction series according to an embodiment.

[0057] Figure 21 is a drawing illustrating a case where an instruction sequence is generated by combining instructions of a control block according to the instruction combining principle illustrated in the second example.

[0058] Figure 22 is a drawing illustrating another example of generating instruction sequences containing feature information using instructions within a control block.

[0059] Figure 23 is a drawing illustrating another example of generating instruction sequences containing feature information using instructions within a control block.

[0060] Figure 24 is a drawing illustrating another example of generating instruction sequences containing feature information using instructions within a control block.

[0061] Figure 25 is a drawing illustrating another example of generating instruction sequences containing feature information using instructions within a control block.

[0062] Figure 26 is a drawing illustrating another example of generating instruction sequences containing feature information using instructions within a control block.

[0063] Figure 27 is a drawing disclosing an example of generating an instruction sequence according to the examples described above.

[0064] Figure 28 is a drawing illustrating another embodiment of the disclosed cyber threat information processing device.

[0065] Figure 29 is a drawing illustrating another embodiment of the disclosed cyber threat information processing method.

[0066] Figure 30 is a conceptual diagram illustrating a non-executable file structure and a leader program for the non-executable file.

[0067] FIG. 31 is a block diagram of an embodiment of a method for obtaining cyber threat information of a non-executable file.

[0068] Figure 32 is a diagram showing an example of performing analysis of the first type of file included in the file analysis unit among examples of obtaining cyber threat information of a file.

[0069] Figure 33 is a diagram showing an example of performing a second type of analysis of a file included in a file analysis unit among examples of obtaining cyber threat information of a file.

[0070] FIG. 34 is a diagram illustrating the target and extracted information extracted by dynamic execution of a non-executable file by the second type of analysis for a file according to an embodiment.

[0071] Figure 35 is a diagram showing an example of a file analysis unit that can obtain cyber threat information on a file and performs a third type of analysis on the file.

[0072] Figure 36 is a diagram illustrating API hooking list information when the third analysis unit performs mild dynamic analysis according to an embodiment.

[0073] Figure 37 is a drawing for explaining a feature processing unit among embodiments capable of obtaining cyber threat information of non-executable files.

[0074] Figure 38 is an example diagram comparing the importance of feature information extracted from a non-executable file according to the disclosed embodiment.

[0075] Figure 39 is an example diagram for explaining the classification model of the attack technique classification unit according to the disclosed embodiment.

[0076] Figure 40 is a diagram illustrating an attack technique identified by selectively combining multiple analysis techniques for a non-executable file according to the disclosed example.

[0077] Figure 41 is an example diagram for explaining the classification model of the attack group classification unit according to the disclosed embodiment.

[0078] Figure 42 is a diagram illustrating the execution of the leader program and system call of the non-executable file described above.

[0079] Figure 43 is a drawing for explaining an example of hooking a system call in program code according to an embodiment.

[0080] FIG. 44 is a diagram disclosing an example of how cyber threat information can be tracked through dynamic analysis according to an embodiment.

[0081] Figure 45 is a drawing illustrating another embodiment of the disclosed cyber threat information processing device.

[0082] Figure 46 is a drawing illustrating another embodiment of the disclosed cyber threat information processing method.

[0083] FIG. 47 is a drawing that discloses an example of receiving or collecting information from a web page and identifying malicious information based on the information in an embodiment.

[0084] Figure 48 is a drawing illustrating the operation of a web crawler according to an embodiment.

[0085] FIG. 49 is a drawing showing an example of storing and managing web page data according to depth information of the disclosed embodiment.

[0086] FIG. 50 is a diagram showing an example of determining whether web page data is malicious based on analysis of multiple steps or layers according to an embodiment.

[0087] Figure 51 is a diagram illustrating a concept of analyzing web page data and providing detected information according to an embodiment.

[0088] Figure 52 is a drawing showing an example of the embodiment disclosed above operating on a computer.

[0089] FIG. 53 is a diagram disclosing one embodiment of a method for processing cyber threat information included in a web page.

[0090] FIG. 54 is a diagram disclosing one embodiment of a method for processing cyber threat information.

[0091] FIG. 55 is a diagram illustrating structural information based on tags of HTML data as a method for processing cyber threat information according to an embodiment.

[0092] FIG. 56 is a drawing disclosing an example of a method for processing cyber threat information according to an embodiment, wherein characteristic information related to cyber security threats is obtained from structural information based on tags of HTML data.

[0093] Figure 57 is a drawing illustrating a process of converting an HTML document exemplified above, excluding HTML grammar, into an embodiment, a part that may contain cyber threat information.

[0094] Figure 58 is a conceptual diagram illustrating an example of a method for processing cyber threat information according to an embodiment.

[0095] FIG. 59 is a drawing disclosing an example of a cyber threat information processing device included in a tag of a web page according to an embodiment.

[0096] Figure 60 is a drawing disclosing an embodiment linking cyber threat intelligence and an artificial intelligence-based natural language model.

[0097] FIG. 61 is a diagram disclosing an embodiment in which an intelligence platform including a natural language model provides cyber threat information (CTI) in natural language.

[0098] FIG. 62 is a drawing showing another embodiment in which the disclosed intelligence platform provides cyber threat information (CTI) in natural language using a natural language model.

[0099] FIG. 63 is a drawing showing another embodiment in which the disclosed intelligence platform provides cyber threat information (CTI) in natural language using a natural language model.

[0100] Figure 64 is a diagram illustrating an example of a flowchart in which a disclosed intelligence platform provides cyber threat information (CTI) in natural language using a natural language model.

[0101] Figure 65 is a drawing illustrating another example of an intelligence platform that provides cyber threat information (CTI) in natural language using a natural language model.

[0102] Figure 66 is a diagram illustrating an example of a flowchart in which the disclosed intelligence platform provides cyber threat information (CTI) in natural language using a natural language model.

[0103] Figure 67 is a drawing disclosing an embodiment linking cyber threat intelligence and ViT model.

[0104] Figure 68 is a drawing disclosing an embodiment of an intelligence platform including a ViT model processing cyber threat information.

[0105] Figure 69 is a drawing showing an example of an intelligence platform that has been disclosed generating an attention feature rule using a ViT model.

[0106] Figure 70 is a drawing showing an example of an intelligence platform that has been disclosed generating an attention feature rule using a ViT model.

[0107] Figure 71 is a drawing showing the attention feature rule generated by the disclosed intelligence platform.

[0108] Figure 72 is a drawing showing an example of detecting malicious code using an attention feature rule generated by an intelligence platform disclosed.

[0109] Figure 73 is a drawing showing the results of detecting malicious code using the attention feature rule generated by the disclosed intelligence platform.

[0110] Figure 74 is a drawing showing the results of detecting malicious code using the attention feature rule generated by the disclosed intelligence platform.

[0111]

[0112] Hereinafter, embodiments will be described in detail with reference to the attached drawings. In the embodiments, the framework, modules, application program interfaces, etc. may be implemented as devices combined with physical devices or implemented as software.

[0113] If the embodiment is implemented as software, it can be stored in a storage medium and installed in a computer or the like and executed by a processor.

[0114] Embodiments of a cyber threat information processing device and a cyber threat information processing method are disclosed in detail as follows.

[0115]

[0116] Figure 1 is a diagram illustrating one embodiment of a cyber threat information processing method. One embodiment of the cyber threat information processing method is described below.

[0117] Preprocessing of files input into the cyber threat information processing device is performed (S1000).

[0118] Preprocessing a file can provide identifying information that can be used to identify the file. An example of preprocessing a file is as follows.

[0119] Various metadata can be obtained from received files, including information about the file's source, the collection information obtained from the file, and the file's user information. For example, if the file contains a uniform resource locator (URL) or is included in an email, collection information about the file can be obtained. User information can include information about the user who created, uploaded, or ultimately saved the file. During the preprocessing process, metadata such as IP (Internet Protocol) information, country information based on IP, and API (Application Programming Interface) key information, such as the API information of the user who requested the analysis, can be obtained.

[0120] The preprocessing process can also extract the file's hash value. If the hash value is already known to the cyber threat information processing device, it can be used to identify the file's type and level of risk.

[0121] If the file is not already known, hash values ​​and file information can be retrieved from previously stored information or, if necessary, external reference websites to obtain analytical information for file type identification. For example, external reference websites such as the Cyber ​​Threats Analysis System (C-TAS) operated by the Korea Internet & Security Agency, the Cyber ​​Threat Alliance (CTA) operating system, and VitusTotal provide information based on file type.

[0122] For example, you can search for a file on the site using the hash value of a hash function such as MD5 (Message-Digest algorithm 5), SHA1 (Secure Hash Algorithm 1), or SHA 256. Then, you can identify the file using the search results.

[0123] As an example of performing file analysis, if an input file is transmitted over a mobile network, packets transmitted over network traffic can be stored if the input file is suspected mobile malware code using a network transmission packet reassembly technique, etc. The packet reassembly technique reassembles a series of packets corresponding to a single executable code from the collected network traffic, and if the file transmitted by the reassembled packets is suspected mobile malware code, the file is stored.

[0124] If the suspected mobile malware code is not extracted from the transmission file at this stage, you can download and save the suspected mobile malware code by directly accessing the download URL within the file.

[0125] Malicious activity analysis information related to the input file is generated (S2000).

[0126] Analysis information on malicious activity related to an input file may include static analysis information that analyzes information about the file itself or dynamic analysis information that can determine whether malicious activity is occurring by executing information obtained from the input file.

[0127] Analysis information at this stage may include in-depth analysis information utilizing processed information from executable files associated with the input file or performing memory analysis associated with the file.

[0128] Deep analysis may include artificial intelligence analysis to accurately identify malicious activity.

[0129] The analysis information at this stage may also include correlation analysis information that can be used to infer a correlation to an attack activity or an attacker by correlating previously stored or generated analysis information related to the file.

[0130] At this stage, multiple pieces of analysis information can be collated to provide an overall analysis result.

[0131] For example, static analysis, dynamic analysis, in-depth analysis, and correlation analysis information for a single file can be integrated and analyzed to accurately identify attack techniques and attackers. Integrated analysis eliminates redundancy between analysis data, and common information across analysis data can be used to improve accuracy.

[0132] For example, cyber threat breach information (indicators of compromise, IoC) collected through various analyses and channels can be standardized through normalizing or enrichment.

[0133] In the example of acquiring analysis information, it is not necessary to sequentially produce all of the analysis information described above. For example, static analysis information acquisition and dynamic analysis information acquisition may be performed only once, or dynamic analysis information may be performed before static analysis information.

[0134] Deep analysis information does not necessarily have to be performed after static or dynamic analysis, and correlation analysis can also be performed without deep analysis information.

[0135] Therefore, the processing order for acquiring the above analysis information can be changed and optionally performed. Furthermore, the process of acquiring the analysis information and generating the predictive information described above can be performed in parallel based on the information acquired from the file. For example, correlation analysis information can be generated even if the dynamic analysis is not yet complete. Similarly, dynamic analysis and in-depth analysis can be performed simultaneously.

[0136] In this case, the preprocessing step (S1000) exemplified above is for obtaining or identifying information of the file, so it can be performed as part of each analysis step when static analysis, dynamic analysis, in-depth analysis, or association analysis are performed individually or in parallel.

[0137] Detailed examples of this step are described below.

[0138] Predictive information on malicious behavior related to the above input file can be generated (S3000).

[0139] To improve the accuracy of the analysis, the dataset of various analyzed information above can be used to generate predictive information on the occurrence of malicious activity, attack techniques, attacker groups, etc.

[0140] Predictive intelligence can be generated through AI analysis of already analyzed data sets. Generating predictive intelligence is not a mandatory step. If a properly analyzed data set is prepared for AI analysis and the conditions are met, predictive intelligence regarding future malicious attacks can be generated.

[0141] This embodiment performs AI-based machine learning based on various analysis data. The embodiment can generate predictive information based on a dataset of analyzed information. For example, additional analysis information can be generated based on data learned through AI, and this newly generated analysis information can then be used as new training data and input data for the AI.

[0142] Here, the prediction information may include malware creator information, malware attack method information, malware attack group prediction, malware similarity prediction information, and malware spread prediction information.

[0143] The generated prediction information may include first prediction information that predicts the risk of the malware itself, and second prediction information that predicts the attacker, attack group, similarity, and spread of the malware.

[0144] Predictive analysis information including the first prediction information and the second prediction information may be stored in a server or database.

[0145] Detailed examples of this are described below.

[0146] After post-processing the above analysis information or prediction information, cyber threat information related to the input file is provided (S4000).

[0147] The embodiment determines the type and risk level of malware based on analysis or predictive information. Furthermore, the embodiment generates profiling information about the malware. Therefore, the results of self-analysis or additional and predictive analysis can be stored through file analysis. The generated profiling information includes attack techniques for the malware and labels for the attacker.

[0148] Cyber ​​threat information may include information on which the above preprocessing has been performed, generated or identified analysis information, generated prediction information, or information compiled from these pieces of information or information determined based on these pieces of information.

[0149] The cyber threat information provided may include information analyzed or predicted above, or may utilize analytical information stored in a database in relation to the input file.

[0150] According to an embodiment, information can be provided when a user searches for cyber threat information on already stored files or malicious actions as well as malicious actions on input files.

[0151] This integrated analysis information can be stored in a standardized format on a server or database, corresponding to the corresponding file. This integrated analysis information can be stored in a standardized format and used to search or retrieve cyber threat information.

[0152] Additional examples of countermeasures against user cyber threat information inquiries are detailed below.

[0153] Also disclosed below are examples of various user-provided interfaces that provide real-time cyber threat information according to embodiments of the present invention.

[0154]

[0155] FIG. 2 is a diagram illustrating an embodiment of a cyber threat information processing device. The embodiment of this diagram conceptually illustrates a cyber threat information processing device. Referring to this diagram, the embodiment of the cyber threat information processing device is described as follows.

[0156] The disclosed cyber threat information processing device includes a platform (10000) including a database and server (2100) and a database (2200) which are physical devices (2000) and an application programming interface (API) running on the physical device (2000). Hereinafter, the platform (10000) is referred to as a cyber threat intelligence platform (CTIP) or simply an intelligence platform (10000).

[0157] The server (2100) includes a computing device such as a central processing unit (CPU) or processor and can store or read data in a database (2200).

[0158] The server (2100) calculates and processes incoming security-related data, executes files, triggers various security events, and processes related data. Furthermore, the server (2100) controls the input / output of various cybersecurity-related data and stores data processed by the intelligence platform (10000) in a database (2200).

[0159] The server (2100) may include a network device for data input or a network security device. The central processing unit, processor, or computing device of the server (2100) may perform the framework exemplified in the drawings below or a module within the framework.

[0160] The intelligence platform (10000) according to the embodiment provides an application programming interface (API) for processing cyber threat information. For example, the intelligence platform (10000) can receive files or data from network security devices connected to the network or cyber-malicious activity prevention programming software that scans and detects malicious activity.

[0161] For example, the intelligence platform (10000) according to the embodiment may provide functions such as a SIEM (Security Information and Event Management) API that provides security events, an EDR (Environmental Data Retrieval) API that provides data on the execution environment, and a firewall API that monitors and controls network traffic according to defined security policies. In addition, the intelligence platform (10000) may also provide the role of an IPS (Intrusion Prevention Systems) API that performs a firewall-like role between internal and external networks.

[0162] An application programming interface (API) (1100) of an intelligence platform (10000) according to an embodiment can receive files containing malicious codes that perform cybersecurity attack activities from multiple client devices (1010, 1020, 1030).

[0163] An intelligence platform (10000) according to an embodiment may include a preprocessing unit (not shown), an analysis framework (1210), a prediction framework (1220), an AI engine (1230), and a postprocessing unit (not shown).

[0164] The preprocessing unit of the intelligence platform (10000) performs preprocessing to analyze cyber threat information on various files received from client devices (1010, 1020, 1030).

[0165] For example, the preprocessing unit can process a received file to obtain various metadata, including information about the file's source, collection information about how the file was obtained, and user information about the file. For example, if the file contains a uniform resource locator (URL) or is included in an e-mail, collection information about the file can be obtained. User information can include information about the user who created, uploaded, or finally saved the file. During the preprocessing process, file metadata, such as IP (internet protocol) information, country information based on IP, and API (Application Programming Interface) key information, can be obtained.

[0166] The preprocessing unit (not shown) of the intelligence platform (10000) can extract the hash value of the input file. If the hash value is already known to the cyber threat information processing device, the file type can be identified based on this.

[0167] If it is not a known file, you can obtain analysis information to identify the file type by looking up the hash value and file information on reference internet sites for cyber threat information such as the operating C-TAS (Cyber ​​Threats Analysis System), the operating system of the CTA (Cyber ​​Threat Alliance), and VitusTotal.

[0168] As explained, the hash value of the input file can be the hash value of a hash function such as MD5 (Message-Digest algorithm 5), SHA1 (Secure Hash Algorithm 1), or SHA 256.

[0169] The framework (1210) can generate analysis information on malicious code from input files. The framework (1210) is illustrated in the drawing as an example with N modules (1211, 1213, 1215, …, 1219) (where N is a natural number) capable of analyzing cyber threat information in various ways, such as static analysis, dynamic analysis, in-depth analysis, and correlation analysis.

[0170] Here, these various modules perform analysis and prediction on cyber threat information contained in the input file.

[0171] Among the modules included in the framework (1210), the static analysis module can analyze information on malicious behavior related to an input file and information related to malicious code for the file itself.

[0172] The dynamic analysis module can analyze information related to malware by performing various actions based on various information obtained from the input file.

[0173] The deep analysis module can analyze malware-related information by using processed executable files associated with the input file or by performing memory analysis related to the executable file. The deep analysis module can incorporate artificial intelligence analysis to accurately identify malicious activity.

[0174] The correlation analysis module may include correlation analysis information that can estimate correlations to attack behavior or attackers by correlating analysis information already stored or generated in relation to input files.

[0175] The framework (1210) can combine the information analyzed from the static analysis module, the dynamic analysis module, the in-depth analysis module, and the correlation analysis module with the analysis results on the characteristics and behavior of malicious code, and provide the combined final information to the user.

[0176] For example, the framework (1210) can integrate and analyze static analysis information, dynamic analysis information, in-depth analysis information, and correlation analysis information for a single file to accurately identify attack techniques and attackers. The framework (1210) removes overlapping portions between analysis information and uses common information between analysis information to increase accuracy.

[0177] The framework (1210) can standardize the information it provides, for example, by normalizing or enriching cyber threat information (indicators of compromise, IoCs) collected through various analyses and channels. Finally, it can generate standardized analysis information on malware or malicious behavior.

[0178] The static analysis module, dynamic analysis module, in-depth analysis module, and correlation analysis module of the framework (1210) can perform machine learning or deep learning techniques based on artificial intelligence analysis on the data to be analyzed to increase the accuracy of the data being analyzed.

[0179] The AI ​​engine (1230) can perform an artificial intelligence analysis algorithm to generate analysis information of the analysis framework (1210).

[0180] This information can be stored in a database (2200), and the server (2100) can provide analysis information on malicious code or malicious behavior stored in the database (2200) as cyber threat intelligence information at the request of a user or client.

[0181] Meanwhile, the framework (1210) can generate prediction information on the occurrence of malicious activity, attack techniques, attacker groups, etc. by using a data set of various analyzed information above to increase analysis accuracy.

[0182] The framework (1210) can generate prediction information on malicious behavior related to an input file by performing an artificial intelligence analysis algorithm using an AI engine (1230) based on a data set of analysis information analyzed by multiple analysis modules.

[0183] The AI ​​engine (1230) learns from a data set of analysis information using artificial intelligence-based machine learning to generate additional analysis information, and the additionally generated analysis information can be used as input data for the artificial intelligence as new learning data.

[0184] The prediction information generated by the framework (1210) may include malware creator information, malware attack method information, malware attack group prediction, malware similarity prediction information, and malware spread prediction information.

[0185] The framework (1210) that generates predictive information related to various types of malware or attack behavior, as described above, can store the generated predictive information in a database (2200). Furthermore, the generated predictive information can be provided to the user at the user's request or based on attack signs.

[0186] The server (2100) can provide cyber threat information related to the input file after post-processing the analysis information or prediction information stored in the database (2200) as described.

[0187] The processor of the server (2100) performs a task of determining the type of malware and the risk level of the malware based on the generated analysis information or prediction information.

[0188] The processor of the server (2100) can generate profiling information on malicious code. The database (2200) can store the results of self-analysis of files through file analysis or the results of additional and predictive analysis.

[0189] Cyber ​​threat information provided to the user by the server (2100) may include information on which the described preprocessing has been performed, generated or identified analysis information, generated prediction information, or information compiled from these pieces of information or information determined based on these pieces of information.

[0190] The cyber threat information provided may include information analyzed or predicted above, or may utilize analytical information stored in a database in relation to the input file.

[0191] According to an embodiment, information can be provided when a user searches for cyber threat information on already stored files or malicious actions as well as malicious actions on input files.

[0192] This integrated analysis information can be stored in a standardized format on a server or database, corresponding to the corresponding file. This integrated analysis information, stored in a standardized format, can be used to search or retrieve cyber threat information.

[0193] The embodiment analyzes input files and identifies attack behavior from the analyzed files. The embodiment can identify attack behavior within a file by matching the malicious code in the file with attack behavior details commonly recognized by cybersecurity experts.

[0194] And the embodiment can identify attack behavior (TTP) based on a database that stores matching relationships between cyber threat information and attack behavior (TTP) contained in a file.

[0195] An example of a database that records the attack behavior of these security experts is the MITRE ATT&CK database. MITRE ATT&CK is a database of actual security attack techniques and behaviors. By representing specific attack techniques and behaviors as components in a matrix format, it allows for the identification of attack techniques and behaviors in a consistent data set format.

[0196] MITRE ATT&CK classifies the attack techniques of hackers or malware into stages of the attack and expresses them in a matrix of CVE codes (Common Vulnerabilities and Exposures Codes).

[0197] The embodiment analyzes cyber threat information contained within a file to identify a specific attack behavior, and matches the identified type of attack behavior to actual attack codes recognized by expert groups, thereby enabling the attack behavior identification to be expressed in a professional and commonly recognized manner.

[0198] In this example, the server (2100) and the intelligence platform (10000) are described with different configurations for convenience of explaining the embodiment, but the intelligence platform (10000) can be performed by at least one processor within the server (2100).

[0199] Meanwhile, examples of cyber threat information processing can be included as hardware or software in various types of high-performance computing servers or distributed cloud servers and function as part of those servers.

[0200] In such cases, cyber threat information can be processed and provided from data or files included in communication between user clients and servers, as well as communication between servers or between servers and devices such as small terminals and vehicles, according to the disclosed embodiments.

[0201] The embodiments disclosed below can be implemented using miniaturized computing devices or software, and are therefore not limited to specific locations. They can even be incorporated into space vehicles such as satellites. For example, data or files received by a satellite or space vehicle can be processed for cyber threat information according to the embodiments below, and the results can be provided.

[0202] The following examples detail examples of a device or software receiving data, files, or information from an external source, processing cyber threat information from the received data, files, or information, and providing the results to a user.

[0203]

[0204] FIG. 3 is a diagram disclosing one embodiment of a cyber threat information processing device.

[0205] Herein, an example is disclosed in which an intelligence platform (10000) receives or collects files and analyzes and provides cyber threat information.

[0206] The intelligence platform (10000) can receive an executable file from a specific user's client (1010). Here, examples of executable files include EXE, ELF (Executable and Linkable Format), PE (Portable Executable), and APK (Android Application Package).

[0207] The intelligence platform (10000) may also receive non-executable files from a specific user's client (1020). Here, non-executable files collectively refer to embedded files that may contain malicious code or executable files, such as document files, script files, and emails, excluding directly executable files.

[0208] Meanwhile, the server (2100) operating the intelligence platform (10000) can directly collect various executable or non-executable files, such as external websites, through an Internet connection.

[0209] The intelligence platform (10000) or the server (2100) operating the intelligence platform (10000) can analyze cyber threat information from files received from users or collected directly and provide various information so that multiple users can efficiently recognize cyber attacks.

[0210] Below, examples of cyber threat information processing devices such as intelligence platforms (10000) or servers (2100) are sequentially disclosed, including examples of analyzing executable files, examples of analyzing non-executable files, and examples of providing cyber threat information to users based on the same.

[0211] Below, an example of a cyber threat information processing device such as an intelligence platform (10000) or a server (2100) analyzing an executable file is disclosed.

[0212]

[0213] Figure 4 illustrates an example of performing static analysis of an executable file according to an embodiment disclosed herein. Referring to the drawings, an example of a static analysis method according to the embodiment is described as follows.

[0214] As described, the type of file can be identified during the preprocessing stage or the initial stage of static analysis prior to performing static analysis. This figure illustrates cases where ELF, EXE, and ARK files are identified as file types for convenience, but the application of the embodiment is not limited thereto.

[0215] Static analysis or detection of malware can be performed based on the process of comparing the characteristics of the file itself with a database of previously confirmed patterns.

[0216] A static information extractor can obtain structural information by parsing the structure of the input file.

[0217] The structural pattern of the parsed file can be compared with the pattern of malicious code already stored in the database (DB) (2200).

[0218] The structural features and patterns of the parsed file can become meta information of the parsed file.

[0219] Although not shown in the examples disclosed above, a machine learning engine may also be used in the static analysis of the disclosed embodiments. The database (2200) may store a data set containing learned features of previously stored malware.

[0220] The AI ​​engine can learn the meta information obtained from the damaged file as above through machine learning and compare it with the data set already stored in the database (2200) to determine whether it is malware.

[0221] Files analyzed as malware through static analysis can have their structural features re-saved as a data set related to the malware.

[0222]

[0223] Figure 5 illustrates an example of performing dynamic analysis of an executable file according to an embodiment disclosed herein. Referring to the drawings, an example of a dynamic analysis method according to the embodiment is described as follows.

[0224] As explained, the file type can be identified during the preprocessing stage or the initial stage of dynamic analysis before performing dynamic analysis. Similarly, in this example, for convenience, the file types identified are ELF, EXE, and ARK files.

[0225] Preprocessing can identify file types that are subject to dynamic analysis. Identified files can then be executed in a virtual environment based on their type and nature.

[0226] For example, if the identified file is an ELF file, it can be passed through the waiting queue and executed on the operating system of a Linux virtual machine (VM).

[0227] Events that occur when an ELF file is executed can be recorded in the activity log.

[0228] In this way, Windows, Linux, and mobile operating system systems are virtually built for each type of identification file, and then the execution events of the virtual systems are recorded.

[0229] Furthermore, the recorded execution events can be compared with the execution events of malicious code already stored in the database (2200). Although not exemplified above, in the case of dynamic analysis, the recorded execution events can be learned through machine learning, and it can be determined whether the learned data is similar to the execution events of previously stored malicious code.

[0230] For dynamic analysis, a virtual environment must be built for each file, which can increase the scale of the analysis and detection system.

[0231]

[0232] Figure 6 discloses an example of disassembling malicious code as an example of in-depth analysis to determine that the file contains malicious behavior.

[0233] As described, disassembling an executable file yields OP-CODE and ASM-CODE, which are the codes in assembly language format.

[0234] For example, a specific function A within an EXE executable file can be converted into disassembled code or disassembled code containing OP-CODE when passed through a disassembler.

[0235] If the EXE executable file is a malicious code that causes malicious behavior, disassembling the function or code part that causes the behavior can obtain a set of disassembled codes that cause the malicious behavior.

[0236] The disassembled code set may include a set of OP-CODEs corresponding to the malicious act or malicious code or a set of OP-CODEs and ASM-CODEs combined.

[0237] Even if the malicious behavior is the same, the algorithm of the malicious code that performs it or the disassembly result of the executable file are not exactly the same, so artificial intelligence-based similarity analysis can identify whether the input malicious code corresponds to a specific set of disassembled code.

[0238] This can be used to identify attack techniques (TTPs) by matching the malicious behavior corresponding to a specific set of disassembled code to specialized and common attack methods or attack techniques such as MITRE ATT&CK.

[0239] Alternatively, a set of OP-CODEs or a combination of OP-CODEs and ASM-CODEs within a specific disassembled code can be used to determine the attack technique by matching them with the attack technique elements defined in MITRE ATT&CK.

[0240] This diagram shows an example of an executable file, a set of disassembled code from that executable file, and an attack technique corresponding to the attack technique elements in MITRE ATT&CK.

[0241]

[0242] FIG. 7 is a diagram illustrating a flow for processing cyber threat information according to an embodiment of the present disclosure.

[0243] This illustration illustrates the case where the files identified in this drawing are executable binary files of the ELF, EXE, and ARK types. The processing at this stage is related to the in-depth analysis described above.

[0244] First, as a first step, a detailed example of the process of extracting disassembled code including OP-CODE code is described as follows.

[0245] When you compile the source code, an executable file is created.

[0246] The raw source code is converted into new data in a form suitable for machine processing by a compiler in each executable operating system (OS) environment. This newly constructed binary data is not human-readable, making it impossible for humans to interpret the executable files and understand their internal logic.

[0247] However, for security system vulnerability analysis and various other purposes, the reverse process is performed to interpret or analyze machine language, which is called disassembly. This disassembly process can be performed according to the central processing unit (CPU) and processing bit count (32-bit, 64-bit, etc.) of a specific operating system.

[0248] By disassembling each of the executable files, ELF, EXE, and ARK, you can obtain the disassembled assembly code.

[0249] Disassembled code may contain a combination of OP-CODE and ASM-CODE.

[0250] The embodiment can analyze an executable file based on a disassembly tool to extract OP-CODE and ASM-CODE from the executable file.

[0251] The disclosed embodiment does not use the extracted OP-CODE and ASM-CODE as is, but reconstructs them for each function and reconstructs the OP-CODE array. When reorganizing the OP-CODE array, the original binary data can also be included to reconstruct the data so that data interpretation can be sufficiently performed. Through this rearrangement, the new combination of OP-CODE and ASM-CODE provides basic data for identifying not only attack techniques but also attackers.

[0252] The second step, the process of processing assembly data (ASM), is described in detail as follows.

[0253] The assembly data processing process is the process of analyzing similarity and extracting information based on data that is reconstructed into a form that is easy for humans or computers to read after separating only the OP-CODE and the necessary ASM-CODE.

[0254] At this stage, the disassembled assembly data can be converted into a certain data format.

[0255] Conversion of these data formats can be applied selectively without having to apply all of the conversion methods described below to increase data processing speed and ensure accurate data analysis.

[0256] Several functions can be extracted from assembly data that is a combination of rearranged OP-CODE and ASM-CODE.

[0257] Disassembling a single executable file can reveal an average of approximately 7,000 to 12,000 functions, depending on the program's size. These functions include some implemented by the programmer, while others are provided by default by the operating system.

[0258] Analyzing actual ASM code reveals that approximately 87% to 91% of functions are provided by the operating system (OS-supported), while only about 10% are actually implemented by programmers for program logic. These OS-provided functions are included in various DLLs and SO files installed by default during OS installation, along with their function names (default functions). These OS-provided functions have already been analyzed and stored, allowing them to be filtered from the analysis target data. By isolating only the code that needs to be analyzed in this way, subsequent processing speed and performance can be improved.

[0259] The embodiment can process the OP-CODE by separating it into function units to accurately perform a functional analysis of the program. The embodiment can perform the minimum unit of all semantic analysis based on the functions included in the assembly code.

[0260] To improve analysis performance and processing speed, the embodiment filters out operator-level functions with inaccurate meanings and also removes functions with information content below a threshold from the analysis target. The presence and degree of function filtering can vary depending on the embodiment.

[0261] The embodiment can remove comment data provided by the disassembler when outputting OP-CODE organized according to a function. And the embodiment can rearrange the disassembled code.

[0262] For example, the disassembled code output by the disassembler may have the order [ASM-CODE, OP-CODE, parameters].

[0263] The embodiment can remove parameter data from assembly data and reorganize or reconstruct the disassembled code in the above order into [OP-CODE, ASM-CODE]. The disassembled code thus reorganized can be normalized or vectorized for easy processing. Furthermore, processing speed can be significantly increased.

[0264] In particular, among the disassembled codes having a combination of [OP-CODE, ASM-CODE], the ASM-CODE portions have different data lengths and are therefore not easy to compare with each other. Therefore, in order to verify the uniqueness of the assembly data, the data can be normalized into a data format of a specific size. For example, in an embodiment, in order to verify the uniqueness of the disassembled code of the combination of [OP-CODE, ASM-CODE], the data portion can be converted into a data set of a specific length that is easy to normalize, such as CRC (cyclic redundancy check) data.

[0265] As an example, in the disassembled code of the [OP-CODE, ASM-CODE] combination, it is also possible to convert the OP-CODE portion into CRC data of the first length and the ASM-CODE portion into CRC data of the second length.

[0266] The normalized data converted to OP-CODE and ASM-CODE maintains the uniqueness of each code prior to conversion. To accelerate the similarity determination of the normalized data converted with uniqueness, vectorization can be performed on the normalized data.

[0267] As explained, normalization or vectorization processes as data transformation processes can be selectively applied to increase data processing speed and enable accurate analysis of data.

[0268] Detailed examples of the normalization and vectorization processes are described in detail below.

[0269] The detailed analysis process of the data for analyzing the disassembled code in the third step is as follows.

[0270] In this process, conversion of various data formats can be used to increase data processing speed and for accurate data analysis. It is not necessary to apply all of the conversion methods described below, but some of them can be selectively applied.

[0271] This is the step of analyzing the similarity with malicious code based on the function-specific data set within the converted disassembled code based on the converted data.

[0272] The embodiment can convert the vectorized OP-CODE and ASM-CODE data sets back into byte data to perform code-to-code similarity.

[0273] Based on the reconverted byte data, a hash value for each block can be extracted, and a hash value for the entire data can be generated based on the unique value for each block.

[0274] In order to efficiently perform comparison of block units, which are portions of byte data, hash values ​​can be extracted and compared by extracting hash values ​​of units designated to extract unique values ​​for each block unit.

[0275] In this way, the Fuzzy Hashing technique can be used to extract hash values ​​for a specified unit and compare the similarity of two or more pieces of data. For example, the embodiment uses the CTPH (Context Triggered Piecewise Hashing) method among Fuzzy Hashing methods to compare hash values ​​extracted for each block with hash values ​​of some units of previously stored malware to determine similarity.

[0276] In summary, the embodiment generates a unique value of the disassembled code of OP-CODE and ASM-CODE to verify the uniqueness of each specific function based on the fact that the combined code of OP-CODE and ASM-CODE implements a specific function in units of functions. Then, based on this unique value, the unique value of each block among the OP-CODE and ASM-CODE of the disassembled code can be extracted to perform a similarity calculation.

[0277] A detailed example of extracting a hash value for each block is also disclosed with reference to the drawing below.

[0278] As described, the embodiment can utilize block-level hash values ​​when performing similarity operations.

[0279] The extracted block-level hash values ​​consist of string data (byte data), which can be used to compare code similarity using numerical values. Performing byte comparisons across billions of disassembled code data sets can consume enormous amounts of time just to obtain a single similarity result.

[0280] Therefore, in the embodiment, String Data (Byte Data) can be converted into numerical values, and based on these numerical values, similarity analysis can be quickly performed using artificial intelligence technology.

[0281] In the embodiment, the String Data (Byte Data) of the extracted block-unit hash value can be vectorized based on N-gram data. The embodiment of this drawing exemplifies a case where the block-unit hash value is vectorized into 2-gram data to increase the operation speed. However, the embodiment does not necessarily have to convert the block-unit hash value into 2-gram data, and it is also possible to vectorize and convert it into 3-gram, 4-gram,… N-gram data. As N increases in N-gram data, the characteristics of the data can be accurately reflected, but the speed of the data processing time increases.

[0282] As described, byte conversion, hash conversion, and N-gram conversion below can be optionally applied to increase data processing speed and accurately analyze data.

[0283] The 2-gram transformation data presented here has a maximum dimension of 65,536. As the dimensionality of the training data increases, its distribution becomes sparse, which can negatively impact classification performance. Furthermore, as the dimensionality of the training data increases, the time and space complexity for training the data also increases.

[0284] To address these issues, the embodiment can be processed using various natural language processing algorithms based on various text representations. This embodiment illustrates such algorithms using the Term Frequency-Inversed Document Frequency (TF-IDF) technique as an example.

[0285] As an example of how to handle the similarity of training data at this stage, the Term Frequency-Inversed Document Frequency (TF-IDF) technique can be used to select meaningful features (patterns) when determining attack identifiers or classes (T-IDs) from high-dimensional data. Typically, TF-IDF is used in search engines to find documents with high similarity, and the mathematical formulas for calculating it are as follows.

[0286] [Mathematical Formula 1]

[0287]

[0288] Here, tf(t,d) represents the frequency of a specific word t in a specific document d, and the more frequently the word appears, the higher the value.

[0289]

[0290] [Equation 2]

[0291]

[0292] idf(t,D) is the inverse of the proportion of documents d that contain a specific word t, with a lower value the more frequently a word appears in multiple documents.

[0293]

[0294] [Equation 3]

[0295]

[0296] tf-idf(t,d,D) is the product of tf(t,d) and idf(t,D), and can be used to quantify which word is more appropriate for which document.

[0297] The TF-IDF method is a method that reflects weights according to the importance of words in the document word matrix, as in Equation 3, using the frequency of words according to Equation 1 and the inverse document frequency (a specific inverse of the document frequency) according to Equation 2.

[0298] In an embodiment, based on the characteristics or patterns of words in the block-level code, a document containing the word can be inferred as an attack identifier (T-ID). Therefore, by calculating TF-IDF for patterns extracted from the block-level code, it is possible to extract patterns that frequently appear within a specific attack identifier (T-ID) or to remove codes having patterns unrelated to a specific attack identifier (T-ID).

[0299] For example, if a specific pattern A is expressed across all attack identifiers (T-IDs), the TF-IDF value for that pattern will be measured as low. Furthermore, such a pattern can be judged to be unnecessary for distinguishing actual attack identifiers (T-IDs). Algorithms for determining similarity in natural language, such as TF-IDF, can also be implemented through machine learning algorithms.

[0300] The embodiment can reduce unnecessary operations and shorten inference time by removing these unnecessary patterns.

[0301] Specifically, the embodiment converts and performs a similarity algorithm based on textual representations of various natural language processing techniques on block-level code data. The similarity algorithm removes code patterns unrelated to attack identifiers, significantly shortening the execution of the algorithms and machine learning-based classification processes described below.

[0302] The embodiment can perform classification modeling to classify attack identifier patterns based on features or patterns in block-level code. The embodiment can learn whether vectorized block-level code features or patterns are patterns of known attack identifiers and classify them into accurate attack techniques or implementation methods. The embodiment utilizes various ensemble machine learning models to classify accurate attack implementation methods, i.e., attack identifiers and attackers, for code determined to have code patterns similar to malicious code.

[0303] Ensemble machine learning models are a technique that generates multiple classification nodes from prepared data and combines the predictions of each classification node to achieve accurate predictions. As described above, ensemble machine learning models are used to classify whether the characteristics or patterns of words in block-level code indicate an attack implementation method, i.e., whether they represent an attack identifier or an attacker.

[0304] When applying ensemble machine learning models, thresholds can be set for classifying prepared data to prevent over-detection and false positives. Only data above the set detection threshold will be classified, and data below the set detection threshold will not be classified.

[0305]

[0306] As described above, various data format conversions can be used to speed up data processing and ensure accurate data analysis. Specific examples of applying the data conversion methods described above to ensemble machine learning models are described in detail below.

[0307] The fourth step, profiling, which identifies and labels attack techniques (TTPs), is described as follows.

[0308] An example of vectorizing input binary data by extracting features from disassembled code including OP-CODE and ASM-CODE based on already analyzed attack code or malicious code is described above.

[0309] This vectorized data is trained through machine learning modeling, then classified into specific attack techniques, and the classified codes are labeled during the profiling process.

[0310] Labeling can be done in two main parts: attaching a unique index to the attack identifier defined in a standardized model, and filling in information about the user who wrote the attack code.

[0311] Labeling should be based on a standardized model, such as the Attack Identifier (T-ID) reflected in MITRE ATT&CK, to ensure accurate information is delivered to users without additional work.

[0312] Furthermore, the labeling is provided to distinguish not only the attack identifier but also the attacker who implemented it. Therefore, it can be used to identify not only the attack identifier but also the attacker and the corresponding implementation method.

[0313] The embodiment enables advanced profiling based on data learned from a previously classified disassembled code dataset (OP-CODE, ASM-CODE, or a combination thereof). The embodiment can also utilize data from the static, dynamic, or associative analyses described above as reference data for labeling. Therefore, even for previously unanalyzed datasets, profiling data can be obtained very quickly and efficiently by considering the results of static, dynamic, and associative analyses together.

[0314] The process of learning code with a pattern similar to the malware in step 3 above, classifying the learned data, and profiling the classified data in step 4 can be performed together by a machine learning algorithm.

[0315] A detailed example of this is provided below. A real-world example of a profiled data set is also illustrated below with reference to the diagram.

[0316]

[0317] FIG. 8 is a diagram illustrating values ​​converted from OP-CODE and ASM-CODE of disassembled code to normalized code as an example of data conversion of the disclosed embodiment.

[0318] As explained, disassembling the executable outputs data that is a combination of OP-CODE and ASM-CODE.

[0319] The embodiment can remove comment data output by function from disassembled data and change the arrangement order of OP-CODE, ASM-CODE, and corresponding parameters to facilitate processing.

[0320] Convert the reconstructed OP-CODE and ASM-CODE into normalized code data, and the example in this drawing illustrates CRC data as normalized code data.

[0321] For example, OP-CODE can be converted to CRC-16 and ASM-CODE can be converted to CRC-32.

[0322] In the first row of the example table, the push function of OP-CODE is changed to CRC-16 data of 0x45E9, and 55 of ASM-CODE is changed to CRC-32 data of 0xC9034AF6.

[0323] In the second row, the mov function of OP-CODE was changed to CRC-16 data of 0x10E3, and 8B EC of ASM-CODE was changed to CRC-32 data of 0x3012FD2C. In the third row, the lea function of OP-CODE was changed to CRC-16 data of 0xAACE, and 8D 45 0C of ASM-CODE was changed to CRC-32 data of 0x9214A6AA.

[0324] In the fourth row, the push function of OP-CODE is changed to CRC-16 data of 0x45E9, and 50 of ASM-CODE is changed to CRC-32 data of 0xB969BE79.

[0325] Unlike this example, other normalized code data or code data of different lengths may be used in addition to the CRC data.

[0326] By converting the disassembled code into normalized code, the uniqueness of each code is secured, while subsequent operations, similarity calculations, and vectorization can be performed quickly and easily.

[0327]

[0328] FIG. 9 is a diagram illustrating vectorized values ​​of OP-CODE and ASM-CODE of disassembled code as an example of data conversion of the disclosed embodiment.

[0329] This figure illustrates the results of vectorizing the code of the normalized OP-CODE (CRC-16 according to the example above) and the normalized ASM-CODE (CRC-32 according to the example above).

[0330] The vectorized value of the normalized OP-CODE code (OP-CODE Vector) and the vectorized value of the normalized ASM-CODE code (ASM-CODE Vector) are shown in table format in this figure.

[0331] The OP-CODE Vector value and ASM-CODE Vector value of each row in this drawing correspond to the normalized value of OP-CODE and the normalized value of ASM-CODE of each row exemplified above.

[0332] For example, the vectorized values ​​of CRC data 0x45E9 and 0xB969BE79 in the fourth row of the table in this drawing are 17897 and 185 105 121 44 in the fourth row of the table in this drawing, respectively.

[0333] When vectorization is performed on data normalized in this way, the functions and ASM-CODE of the disassembled OP-CODE are converted into vectorized values ​​while each including its own unique characteristics.

[0334]

[0335] FIG. 10 is a diagram showing an example of data conversion of an embodiment of the disclosure, in which a block unit of code is converted into a hash value.

[0336] To perform similarity analysis, each vectorized OP-CODE and ASM-CODE data set is reconverted into byte data. The reconverted byte data can be converted into block-level hash values. Then, based on these block-level hash values, a hash value for the entire reconverted byte data is generated.

[0337] In the embodiment, hash values ​​such as MD5 (Message-Digest algorithm 5), SHA1 (Secure Hash Algorithm 1), and SHA 256 may be used to produce a reconverted hash value, and a fuzzy hash function may be used to determine the similarity between data.

[0338] The first row in the table in this diagram indicates the human-readable characters that may be included in the data. The values ​​contained in blocks of reconverted byte data may contain these human-readable characters.

[0339] Each character can correspond to the ASCII value of the second row: 97, 98, 99, 100, ..., 48, 49.

[0340] The data containing the character values ​​of the first row can be segmented into blocks whose ASCII values ​​can be summed.

[0341] The third row of the table shows the sum of the ASCII values ​​corresponding to each character value within a block unit having four characters.

[0342] For the first block, it can have a value of 394, which is the sum (ascii sum) of the ascii values ​​97, 98, 99, and 100 corresponding to the characters in that block.

[0343] And the last row shows the sum of the ASCII values ​​of each block converted to its Base 64 representation. The letter K is the sum of the first block.

[0344] In this way, we can obtain a signature called Kaq6KaU for the data.

[0345] Based on these signatures, the similarity between two block-unit data can be calculated.

[0346] This embodiment calculates hash values ​​using a fuzzy hash function for determining similarity among block units included in code among reconverted byte data, and determines similarity based on the calculated hash values. CTPH (Context Triggered Piecewise Hashing) is exemplified as a fuzzy hash function for determining similarity, but other fuzzy hash functions capable of calculating data similarity can also be used.

[0347]

[0348] FIG. 11 is a diagram illustrating an example of an ensemble machine learning model according to an embodiment of the present disclosure.

[0349] The embodiment can accurately classify the attack identifier (T-ID) of a file determined to be malware using an ensemble machine learning model.

[0350] The hash value of a block unit composed of String Data (Byte Data) is digitized based on N-gram feature information, and then the similarity can be calculated using techniques such as TF-IDF to determine whether this is an attack identifier (T-ID) or a class to be classified.

[0351] In order to improve the performance of attack technique identification by reducing unnecessary operations, the embodiment can remove unnecessary patterns based on similarity among the above hash values.

[0352] And the data with unnecessary patterns removed can be modeled through ensemble machine learning to classify attack identifiers.

[0353] There are methods such as voting, bagging, and boosting that combine the learning results of multiple classification nodes of an ensemble machine learning model. An ensemble machine learning model that appropriately combines these methods can contribute to improving the classification accuracy of training data.

[0354] Here, we explain how to classify attack identifiers more accurately by using the Random Forest method with a bagging method as an example.

[0355] The Random Forest method generates a large number of decision trees to reduce classification errors resulting from a single decision tree and achieve generalized classification results. In an embodiment, a Random Forest learning algorithm utilizing at least one decision tree can be applied to prepared data. Here, the prepared data refers to data from which unnecessary patterns have been removed from block-level fuzzy hash values.

[0356] To determine the similarity of block-level hash values, a decision tree model with at least one node is implemented. Depending on the information gain of the decision tree, comparison conditions can be optimized for feature values ​​(here, the number of occurrences of classification patterns based on block-level hash values) that can distinguish one or more classes (attack identifiers; T-IDs).

[0357] For this purpose, a decision tree such as the one illustrated in the drawing can be created.

[0358] In this drawing, the upper squares (2510, 2520, 2530, 2540) represent conditions for classifying terminal nodes, and the lower squares (2610, 2620, 2630) represent classes classified as terminal nodes.

[0359] For example, when applying a Random Forest model as an ensemble machine learning model, it is a classification model that utilizes an ensemble technique using one or more decision trees. By varying the input data characteristics of the decision trees that make up the Random Forest model, various decision trees are constructed. Classification is performed on the multiple decision tree models generated, and the final classification class is determined using a majority voting technique. Testing of each node can be performed in parallel, increasing computational efficiency.

[0360] When classifying classes, a threshold value can be set to prevent over-detection and false detection, values ​​below the lower threshold value can be discarded, and classification can be performed on data targets above the detection threshold value.

[0361]

[0362] FIG. 12 is a diagram illustrating a flow of learning and classifying data using machine learning according to an embodiment of the present disclosure.

[0363] Profiling of input data may include a classification step (S2610) and a learning step (S2620).

[0364] In an embodiment, the learning step (S2620) may include (a) a hash value extraction process, (b) an N-gram pattern extraction process, (c) a natural language processing analysis (TF-IDF analysis) process, (d) a pattern selection process, (e) a model learning process, etc.

[0365] And in the embodiment, the classification step (S2610) may include (a) a hash value extraction process, (b) an N-gram pattern extraction process, (f) a pattern selection process, (g) a classification process by vectorization, etc.

[0366] Among the profiling steps according to the embodiment, the classification step (S2620) is first described as follows.

[0367] Receives input data from a set of executable files or processed files.

[0368] Receive input data from a set of executable files stored in a database or from an executable file passed from the processing process exemplified above. The input data may be vectorized data converted from disassembled code containing OP-CODE and ASM-CODE code.

[0369] A fuzzy hash value is extracted from the disassembled code as input data (a) and N-gram pattern data for a specific function is extracted (b). At this time, 2-gram pattern data including patterns judged to be similar to malicious code among the existing semantic pattern set can be selected (f).

[0370] N-gram data of the selected pattern can be converted into vectorized data, and the vectorized data can be classified into a function whose meaning is determined by the pattern (g).

[0371]

[0372] Among the profiling steps according to the embodiment, the learning step (S2610) is performed as follows.

[0373] If the input data is a new file, a fuzzy hash value is extracted from the disassembled code, which is the input data (a).

[0374] The extracted fuzzy hash value is vectorized into N-gram data (2-gram in this example) (b).

[0375] Perform natural language processing analysis such as TF-IDF on the extracted specific pattern (c)

[0376] Among the data sets with patterns related to the existing attack identifier (T-ID), data sets with high similarity are selected, and the rest are filtered out (d). At this time, sample data sets containing some or all of the characteristics of the data sets with patterns related to the attack identifier (T-ID) can be selected by comparing them with the data sets stored in the existing semantic pattern set.

[0377] N-gram data can be trained based on the extracted sample data set (e).

[0378] The vectorized data of N-grams is input into a classification model to obtain probabilities for each attack identifier (T-ID). For example, the probability that the vectorized data of the N-gram structure is a specific attack identifier (T-ID) T1027 is A%, the probability that the attack identifier T1055 is (100-A)%, etc. can be obtained.

[0379] The classification model can use an ensemble machine learning model such as a random forest that includes at least one decision tree.

[0380] Here, based on the classification model, we can determine which attack technique or attacker the vectorized N-gram data is.

[0381] Labeling is performed by classifying the input data based on the classification result of the classification model (e) or the selection result of an existing stored pattern (f) (g).

[0382] The results of the final labeling are illustrated with reference to the following drawing.

[0383]

[0384] FIG. 13 is a diagram showing an example of labeling an attack identifier and an attacker by learning and classifying input data according to an embodiment disclosed.

[0385] This diagram is a table format diagram showing the attack identifier, attacker or attack group, fuzzy hash value corresponding to assembly code, and corresponding N-gram (here written as 2-gram data) as a result of the profiler.

[0386] Upon completion of profiling according to the embodiment, classified data can be obtained with respect to the implementation of the following attack methods.

[0387] Depending on the profiling by example, the attack identifier (T-ID) and the attacker or attacker group (Attacker or Group) may be labeled respectively.

[0388] Here, the attack identifier (T-ID) can follow a standardized model as described, and this example illustrates the result of assigning an attack identifier (T-ID) provided by MITRE ATT&CK®.

[0389] As described above, labels may also be added to identified attackers or attacker groups. This diagram illustrates an example of attacker TA504 being identified by labeling an attacker or attacker group.

[0390] SHA-256 (size) represents the fuzzy hash value and data size of the malware corresponding to each attack identifier (T-ID) or attacker group (Attacker or Group). As described, this malware can be matched by rearrangements and combinations of OP-CODE and ASM-CODE.

[0391] And the value of the section indicated as N-gram is N-gram pattern data corresponding to the attack identifier (T-ID) or the fuzzy hash value of the attacker group and the malware, and in this example, is indicated as part of 2-gram data.

[0392] As illustrated in this drawing, the fuzzy hash values ​​of malicious codes (OP-CODE and ASM-CODE) and the attack identifiers (T-IDs) or attacker groups corresponding to N-gram pattern data can be labeled and stored.

[0393] The labeled data shown can be used as reference data for ensemble machine learning and can also be used as reference data for classification models.

[0394]

[0395] Figure 14 is a diagram showing the result of identifying an attack identifier according to an embodiment.

[0396] This diagram illustrates a Euclidean Distance Matrix, which can represent the similarity between two data sets.

[0397] In this figure, bright areas indicate low similarity between the two data sets, and dark areas indicate high similarity between the two data sets.

[0398] In this drawing, T10XX represents an attack identifier (T-ID), and the characters T, K, and L in parentheses represent attacker groups that created attack techniques according to the corresponding attack identifier (T-ID), respectively.

[0399] That is, the rows and columns represent attack identifiers (T-IDs) generated by each attacker group (T, K, L), and the rows and columns have the same meaning. For example, T1055(K) represents the T1055 attack generated by the L attacker group, and T1055(K) represents the same attack method T1055 generated by the K attacker group.

[0400] Since each sample in the data set contains its own sample, calculating the distance from each other sample shows a distribution with high identity in the diagonal direction from the upper left to the lower right.

[0401] This diagram demonstrates that even when attackers with the same attack identifier (T-ID) are associated with different attack groups, they exhibit similar characteristics. For example, the attack identifier T1027 can be evaluated as highly similar if the attack techniques are similar, even if the attack group is T or K.

[0402] Therefore, when learning is performed based on the data set extracted as in the above example, the features for the same attack technique (T-ID) implemented by the same attacker are clearly identified (the darkest part), and it can be confirmed that the same attack technique (T-ID) implemented by different attackers has a high degree of similarity (the darkest part in the middle).

[0403] Therefore, by extracting and applying sample data based on the combination of OP-CODE and ASM-CODE in this way to classify attack techniques, a specific attack technique or identifier (T-ID) can be reliably classified even if the attacker is different. Conversely, through the combination of OP-CODE and ASM-CODE, not only can the specific code implemented within the malware be clearly identified, but also the attack implementation method, including the attacker and attack identifier, can be identified.

[0404]

[0405] Figure 15 illustrates an example of matching attack techniques with codes extracted from binary code according to the disclosed embodiment. This example uses a standardized model as an example of matching attack techniques.

[0406] Here we exemplify the MITRE ATT&CK® Framework as a standardized model.

[0407] For example, in cybersecurity, the term “malicious activity” has been interpreted differently by different analysts and often has different interpretations depending on their respective perspectives.

[0408] There's been significant effort among experts to standardize the definition of "malicious behavior" occurring on international systems and ensure everyone has a consistent interpretation. MITRE (https: / / attack.mitre.org), a non-profit research and development organization funded by the U.S. federal government and working on national security-related projects, researched the definition of "malicious behavior" and developed and published the ATT&CK Framework. This framework defines "malicious behavior" for cyber threats and malware, enabling everyone to share a common understanding.

[0409] The MITRE ATT&CK Framework (hereinafter referred to as MITRE ATT&CK) is an acronym for Adversarial Tactics, Techniques, and Common Knowledge, a compilation of the latest attack techniques used by attackers. MITRE ATT&CK is a standardized data set that categorizes and catalogs information on various attack techniques used by various attack groups by analyzing the attack methods (tactics) and techniques (techniques) of adversary behaviors after observing actual cyberattack cases.

[0410] MITRE ATT&CK, a slightly different approach from the traditional cyber kill chain, systematizes (patterns) threat tactics and techniques to improve the detection of sophisticated attacks. Originally, ATT&CK began at MITRE to document TTPs (tactics, techniques, procedures) for hacking attacks used in corporate environments using the Windows operating system. Since then, ATT&CK has evolved into a framework that maps TTP information based on analysis of consistent attack behavior patterns from attackers, enabling the identification of attacker behavior.

[0411] The malicious behavior mentioned in the disclosed embodiment can be expressed by matching the malicious code to an attack technique based on a standardized model such as MITRE ATT&CK, and any standardized model can identify and classify the malicious code by element and match it to an attack identifier.

[0412] This diagram illustrates conceptually how the malicious behavior of malware matches the attack technique based on the MITRE ATT&CK model.

[0413] An executable file EXE can contain several functions (Function A, B, C, D, E,…, N,…, Z) that are performed when the file is executed. A group of functions containing at least one of these functions can perform a single attack tactic.

[0414] In the example of this drawing, functions A, B, and C correspond to tactic A, and functions D, B, and F correspond to tactic B. Similarly, functions Z, R, and C correspond to tactic C, and functions K and F correspond to tactic D.

[0415] An embodiment may correspond to a set of functions corresponding to each attack tactic and a portion of a specific disassembled code. The database already stores attack identifiers (T-IDs) of attack tactics, techniques, and procedures (TTPs) that can correspond to disassembled codes learned by artificial intelligence.

[0416] The attack identifier (T-ID) of attack methods (Tactics, Techniques, Procedures) (TTP) follows a standardized model, and the example in the diagram here is MITRE ATT&CK as a standardized model of cyber threat information.

[0417] Accordingly, the embodiment can match the resulting data extracted from disassembled code in a binary file with a standardized attack identifier. A more specific method for matching the attack identifier is disclosed below.

[0418]

[0419] FIG. 16 illustrates an example of matching an attack technique with a code set including an OP-CODE according to an embodiment disclosed.

[0420] Most AI engines use a trained data set based on various malware characteristics to identify malware. While this approach can determine whether a piece of malware is malicious, it can be difficult to explain why the malware is malicious. However, as illustrated in the example, by matching it with a standardized attack vector (TTP) identifier, it is possible to identify the specific threat factors present in the malware. Therefore, the embodiment can accurately convey cyber threat information to security managers and enable them to manage cyber threat information systematically and over the long term.

[0421] The embodiment can reflect not only the identifier or label of the attack method (TTP) but also the characteristics of how the attack method (TTP) was implemented as an important factor when generating a data set for artificial intelligence training to identify attack methods (TTP) based on disassembled code.

[0422] Even malware implementing the same TTP (Tactical Threat Protection) cannot be created with identical code, depending on the developer. In other words, while the TTP descriptions are written in human-spoken language, the implementation and code writing methods vary depending on the developer.

[0423] These differences in code writing depend on the developer's capabilities or the way or habits of implementing program logic, and these differences are expressed as differences between binary code or its disassembled OP-CODE and ASM-CODE.

[0424] Therefore, simply assigning or matching attack identifiers based on the type of attack method (TTP) resulting from the attack makes it difficult to accurately identify the attacker or group of attackers who created the malware.

[0425] Conversely, if modeling is performed by reflecting the characteristics of disassembled OP-CODE and ASM-CODE as important variables, it is possible to identify the developer who developed a specific malware or attack tool, or even the tool itself that automatically generates it.

[0426] The disclosed embodiments can generate threat intelligence of critical importance in modern cyber warfare based on the unique characteristics of the disassembled OP-CODE and ASM-CODE combined code. That is, based on these unique characteristics, the embodiments can identify how attack code or malware operates, as well as who developed it and with what intent.

[0427] And, based on the characteristics of the attacker's continued attacks, vulnerable systems can be supplemented and proactive and preemptive responses to cybersecurity threats can be made possible.

[0428] In this concept, the embodiment provides completely different results in terms of performance and method of identifying attack techniques based on attack results simply based on OP-CODE.

[0429] The embodiment can generate a dataset of disassembled code based on features combining disassembled OP-CODE and ASM-CODE to accurately identify and classify the coding techniques used to implement a TTP. By modeling to identify unique characteristics from the dataset thus generated, it is possible to identify not only the TTP but also the characteristics of the developer, i.e., who the developer (or automated production tool) is.

[0430] This diagram shows an example of matching an OP-CODE data set modeled in the manner described above to an attack identifier.

[0431] In this example, the first OP-CODE set (OP-CODE set #1) matches the attack technique identifier T1011, the second OP-CODE set (OP-CODE set #2) matches the attack technique identifier T2013, and the third OP-CODE set (OP-CODE set #3) can match the attack technique identifier T1488, and the Nth OP-CODE set (OP-CODE set #N) matches any attack technique identifier T1XXX. The standardized model MITRE ATT&CK® expresses the attack technique identifiers in a matrix format by element, but embodiments may additionally identify attackers or attack tools in addition to the attack technique identifiers.

[0432] For convenience, this diagram is shown as an OP-CODE data set. However, identifying an attack technique with a data set of disassembled code including OP-CODE and ASM-CODE allows for more detailed attack techniques to be identified than identifying an attack technique with only the OP-CODE data set.

[0433] Analyzing a combination of data sets of disassembled code, according to an embodiment, may identify not only the attack technique identifier but also the attacker or attack group.

[0434] Therefore, the embodiment can not only provide a more advanced technology in terms of intelligence information acquisition than existing technologies, but also solve problems that could not be solved in the conventional security field.

[0435] To secure accurate intelligence information in complex environments like the above, rapid data processing and algorithms are required. Below, we describe additional examples related to this and their corresponding performance.

[0436]

[0437] Therefore, according to the disclosed embodiment, it is possible to detect and respond to malware that does not exactly match data learned through machine learning, and to respond to variants of malware.

[0438] According to the embodiment, even if it is a variant of malware, it is possible to identify malware, attack techniques, and attackers in a very short period of time, and furthermore, it is possible to predict the attack techniques of a specific attacker in the future.

[0439] In one embodiment, the method of implementing a cyberattack can be accurately identified based on the presence of malware, attack technique, attack identifier, and attacker, and provided as a standardized model. In another embodiment, information on malware, where detection names are not standardized or cyberattack techniques are not accurately described, can be provided in a standardized and regularized manner.

[0440] It can also provide a means to predict the possibility of creating previously unknown malware and the attackers who might develop it, and to predict what kind of cyber threat attacks will occur in the future.

[0441]

[0442] Below, another embodiment of the cyber threat information processing device and method disclosed above is disclosed.

[0443] The cyber threat information processing described above enabled analysis of the characteristics of threat information at the function level. However, even within programs that achieve the same results, it can be difficult to clearly identify attack techniques or attack groups depending on the logic of the program containing the functions, or if the functions are used differently, such as by being separated, even if the program logic remains unchanged.

[0444]

[0445] Figure 17 is a diagram illustrating an example of performing attack techniques and attack group identification on a function basis.

[0446] In this example, we assume that we have disassembled an executable file (e.g., EXE) and identified the functions contained within it. The identified functions are referred to as Function 1, Function 2, Function 3, and Function 4.

[0447] Among the identified functions, Function 2 may include instructions that perform function operations. Here, the instructions included in function Function 2 are indicated as Instruction 1, Instruction 2, Instruction 3, Instruction 4, Instruction 5, Instruction 6, and Instruction 7.

[0448] However, in a program, a single function may be divided into multiple subfunctions during execution. In this example, assume that Function 2 is divided into two subfunctions and executed. Then, Function 2 can be divided into two subfunctions, each with its own instructions.

[0449] For convenience of explanation, here, an example is given in which one subfunction included in Function 2 includes Instruction 1, Instruction 2, and Instruction 3, and another subfunction includes Instruction 4, Instruction 5, Instruction 6, and Instruction 7.

[0450] However, in a program, subfunctions can be included in one function, Function 2.

[0451] When extracting feature information related to cyber threats by function unit, one feature information corresponding to Function 2 (cyber threat feature information A, simply expressed as feature information A) can be identified.

[0452] By analyzing the characteristic information related to the cyber threat of the function unit disclosed above according to the embodiment described above, attack techniques and attack groups can be identified.

[0453]

[0454] Figure 18 is a diagram illustrating an example of performing attack techniques and attack group identification when functions are separated.

[0455] This example is an example that produces the same results as the example disclosed above, but here it exemplifies a case where one of the functions is clearly separated into sub-functions in the program.

[0456] That is, this example illustrates a case where Function 2, among the functions identified from the executable file, is split into Function 2-1 and Function 2-2 in the program. Here, even if Function 2 is split into Function 2-1 and Function 2-2, there is no change in the program logic compared to when one function of Function 2 is executed.

[0457] Although the program logic is the same, if Function 2 is simply separated into two functions (Function 2-1 and Function 2-2), the feature information corresponding to each function (Feature Information B and Feature Information C) will be different, so the attack technique and attack group identification results based on the feature information may be different.

[0458]

[0459] Therefore, even in cases where an attack technique or attack group is identified based on the execution of one function and multiple functions that execute the same logic in a program, it is possible to identify this as the same attack technique and attack group according to the following examples.

[0460] The following examples disclose examples of identifying attack techniques and attack groups based on characteristic information that takes into account the control flow and order of instructions performed by various functions within a program.

[0461] By utilizing feature information based on the flow and order of instructions within the program's functions, feature information can be obtained even if the functions within the program are different and implement substantially the same logic.

[0462] Even if the format of the program causing the cyber threat is slightly modified or is a variant, the attack technique and attack group can be clearly identified based on this characteristic information.

[0463] Below, we present an example of profiling control flow and identifying sequences according to instructions within a function.

[0464]

[0465] FIG. 19 discloses an example of obtaining characteristic information related to a cyber threat according to an embodiment.

[0466] Here, by disassembling the executable function indicated as EXE, we can obtain control blocks containing various functions.

[0467] After obtaining the control flow of the instructions within the obtained control blocks (ControlBlocks), the order of the control blocks according to the control flow can be checked and the instruction sequence can be obtained based on this.

[0468] And, based on the obtained instruction sequence, cyber threat characteristic information can be identified.

[0469] Detailed embodiments of obtaining a control block or a corresponding code block have already been disclosed above.

[0470] In this example, the control blocks (ControlBlocks) obtained by disassembling the executable function (EXE) are indicated as ControlBlock1, ControlBlock2, ControlBlock3, …, ControlBlock6.

[0471] Here, the control blocks ControlBlock1, ControlBlock2, ControlBlock3, …, ControlBlock6 can correspond to each instruction set. As explained above, the instruction sets described above are each different, but the execution logic within each instruction set may be the same.

[0472] Therefore, the control flow is analyzed for the Control Blocks to identify whether the Control Blocks perform the same logic.

[0473] For example, in order to easily explain the embodiment, a graph is created and explained by analyzing the control flow of code blocks according to program execution.

[0474] For example, instructions in the order of execution among the instruction sets included in Control Block 1 are indicated as C1, C2, C3, …, C6. To make it easier to understand, instructions in the order of execution among the instruction sets are indicated using a Control Flow Graph (CFG).

[0475] The order of instructions in the control flow graph of the instructions shown in this example can be obtained, and the obtained order is expressed here using the Depth First Search (DFS) method. The Depth First Search (DFS) method is a method that repeatedly selects an instruction as an addition node in a search tree, applies applicable instructions to this node, and adds the instruction as a child node of the next level in the search tree.

[0476] Then, the instruction order applied according to the instruction control flow within the instruction set corresponding to the control block (ControlBlock) can be obtained.

[0477] In this example, the control flow order of instructions included in Instruction Set 1 corresponding to ControlBlock1 can be (C1, C2, C4, C5, C3, C6).

[0478] The order of control flow of instructions included in instruction set 2 corresponding to ControlBlock2 can be (C2, C4, C5).

[0479] The order of control flow of instructions included in instruction set 3 corresponding to ControlBlock3 can be (C3, C6).

[0480] And, an instruction sequence can be generated according to the obtained instruction sequence, and in this way, characteristic information about cyber threats can be distinguished according to the instruction sequence.

[0481] Here, an example is disclosed in which there are six instruction sequences classified according to the order of control flow in instruction set 1 corresponding to ControlBlock1, and one feature information is extracted for each of the six instruction sequences.

[0482] In this way, even if a function within a program is separated or changed into functions that perform substantially the same logic, cyber threat information based on the same logic can be distinguished.

[0483] Below, several examples are disclosed of obtaining instruction sequences using various control flows within control blocks (ControlBlocks) containing various functions.

[0484] First, we present an example of obtaining various control flows within the included control blocks (ControlBlocks).

[0485] Obtain control blocks (ControlBlocks) by disassembling the executable file.

[0486] Within control blocks (ControlBlocks), instructions can be identified that reference specific blocks within the control block or control blocks outside the control block. Instructions that branch within the code in this way are referred to here as branch instructions.

[0487] Examples of branch instruction types include Call and Jump functions. These functions can reference specific blocks within the control block or control blocks outside the control block.

[0488] Therefore, by identifying the reference address according to these branch instructions, the control flow of the instructions can be obtained.

[0489]

[0490] Figure 20 illustrates a process of obtaining control flow using a branch instruction series according to an embodiment.

[0491] Extract the disassembled control block (cblk1) and identify instructions of the branch instruction type within the extracted control block (cblk1).

[0492] Among the reference addresses that refer to instructions of the branch instruction type that branches on the code, check the reference (outgoing reference, indicated as outgoing-ref) that refers to a location outside the control block (cblk1).

[0493] The left side of this diagram is an example to illustrate a specific outgoing reference analysis.

[0494] In this example, the reference (Reference A) that points to a location inside the control block (cblk1) rather than an outgoing reference can be ignored. That is, since Reference A points to the inside of the control block (cblk1), it can be ignored when generating control flow.

[0495] And, the control flow can be created by dividing the case where the outgoing reference of the control block (cblk1) points to the starting address or starting instruction of another control block (cblk2) (Reference B) and the case where it points to the internal address or internal instruction of another control block (cblk3) (Reference C).

[0496] In this example, reference B points to the starting address or instruction of the target control block (cblk2), so the target control block (cblk2) can be included in the control flow generation as is.

[0497] Meanwhile, since reference C points to instruction 2 (instr2) inside the target control block, a new third control block (cblk3-2) including instruction 2 (instr2) to the last instruction of the control block (cblk3) can be included in the control flow generation.

[0498] The right side of this drawing is an example of generating control flow for a specific control block (cblk1) according to the example described above.

[0499] As a result of analyzing the control flow of the control block (cblk1) according to the outgoing reference analysis on the left, a control flow for the control block (cblk1) can be generated.

[0500] A control flow generated according to such an example may include the second control block (cblk2) as a vertex within the control flow if the first control block (cblk1) refers to the start address or instruction of the second control block (cblk2).

[0501] And when the first control block (cblk1) points to an internal or intermediate location or instruction of the third control block (cblk3), the generated control flow can separate the third control block (cblk3) from the instruction of the location pointed to, and include a new control block (cblk3-2) as a vertex with the instruction of the location pointed to as the starting instruction.

[0502] According to an embodiment, if a branch instruction of a specific control block is an outgoing reference, a control flow can be generated according to the location or instruction pointed to by the outgoing reference.

[0503] A control flow generated for a specific control block includes the second control block as a vertex if its outgoing reference points to the starting point of the second control block. In addition, the generated control flow includes a new control block as a vertex whose starting instruction is the instruction at the pointing point if the outgoing reference points to the middle point of the third control block.

[0504] In the example of this drawing, reference A of the first control block (cblk1) is ignored because it is a reference pointing to the inside of the first control block (cblk1), and reference B of the first control block (cblk1) points to the start address of the second control block (cblk2), so the second control block (cblk2) is included as a vertex. Reference C of the first control block (cblk1) points to the inside of the second control block (cblk2), so a new control block can be created from instruction 2 of the second control block (cblk2) and included as a vertex.

[0505] This drawing is an example of a control flow graph (CFG) that displays the generated control flow, with the lower vertices positioned on the left side of the graph in ascending order based on the starting address of the control block (cblk).

[0506]

[0507] Below, an example of obtaining cyber threat characteristic information of an executable file according to an instruction sequence generated by searching for reference relationships of disassembled control blocks of the executable file as described above is disclosed.

[0508] Instruction sequences generated based on reference relationships can represent the characteristics of cyber threat information.

[0509] The control flow generation described above can be performed using the depth-first search (DFS) method to generate instruction sequences by merging the instructions of the control block in an order based on a specific principle.

[0510] Below, we provide an example of how to combine instruction sequences that can obtain characteristics of cyber threat information.

[0511] As a first example of combining instruction sequences, when generating instruction sequences based on the reference relationship of instructions within a control block, the instruction sequence can be generated by performing a depth-first search for instructions that have control flow meaning.

[0512] Here, instructions that have the meaning of control flow mean removing functions of the NOP (non-operation) or RET (return) series among the instructions called within the control block, or functions of the branch series such as the JUMP function or CALL function.

[0513] These series of functions only create edges in the control flow graph when constructing the graph, not the actual instruction sequence. Therefore, when sequentially combining instructions within the control flow graph using depth-first traversal, these series of functions do not contribute to generating the instruction sequence.

[0514] A first example of generating instruction sequences based on the reference relationships of instructions within a control block is to combine meaningful instructions that can be included in an actual instruction sequence, and not to include branches or simply referencing instructions in the combination.

[0515] It combines instructions in a depth-first search manner in the control flow graph, thus generating instruction sequences without using branch-like instructions or instructions that simply reference them.

[0516] As a second example of generating instruction sequences according to the reference relationship of instructions within a control block, a stack frame can be adjusted when a control block is called by a function of the CALL series among instructions within the control block.

[0517] A stack frame is a space created to delimit functions within the stack. For example, a stack frame can contain parameters, return addresses, local variables, etc., and is created when a function is called and destroyed when the function terminates.

[0518] Typically, a stack frame includes a stack pointer (sp), which indicates the starting point of the stack, and a base pointer (bp), which is a pointer to specific data on the stack. If the stack frame changes, the stack pointer (sp) and base pointer (bp) may change.

[0519] Instructions involving pointers on stack frames are not used to combine instruction sequences, such as using depth-first search, because they act as logic noise in control flow. Just as branch instructions are not used to combine instruction sequences, as exemplified above, instructions involving stack frames are also not used.

[0520]

[0521] Figure 21 illustrates a case where instructions of a control block are combined to generate an instruction sequence according to the instruction combining principle illustrated in the second example.

[0522] When a control block is called by a CALL series function, instructions related to the stack frame are not related to the logic by control flow, so an instruction sequence can be created without using them when combining instructions.

[0523] This diagram illustrates the control blocks of the sample code, denoted app1, and the control blocks of the sample code, denoted app2. The sample codes app1 and app2 perform the same function, but in this example, the app1 sample code repeats the same code, whereas the app2 sample code does not repeat the same code, but instead has a function called fool1 call fool2 to perform the same function.

[0524] Let's explain using the control block of the app2 sample code as an example. The stack frame can be initialized before the start of the control block of the app2 sample code. (0x100003eb0 ~ 0x100003eb4).

[0525] Here, (pushq %rbp) in the code means saving the base pointer, and (movq %rsp, %rbp) indicates saving the stack pointer to the base pointer.

[0526] And (subq %16, %rsp) in the code indicates moving the stack pointer location to the top of the stack, so that the top of the stack has an address smaller than the base.

[0527] The stack can be cleaned up before the return of the control block in the app2 sample code (0x100003ef9 ~ 0x100003efd).

[0528] Here, (addq $16, %rsp) in the code means moving the stack pointer to the base, which has the effect of clearing all values ​​on the stack.

[0529] Also, (popq %rbp) in the code indicates restoring the previous base pointer that was saved.

[0530] Therefore, when app1 is called thereafter, the instructions related to the stack frame before the call are not related to the control flow, so they are not considered when generating the instruction sequence by combining instructions by the call.

[0531] In this way, when the stack frame is adjusted by the separation of functions related to the stack frame, that is, when the instructions related to the stack frame are not related to the logic by control flow, the instruction sequence is generated without consideration for generating the instruction sequence.

[0532]

[0533] Another example of generating instruction sequences containing feature information using instructions within a control block is disclosed.

[0534] When generating instruction sequences containing feature information using instructions within a control block, the instruction sequences can be generated by reflecting the edge weight of the graph according to control flow analysis.

[0535] A graph reflecting the edge weight of the graph according to control flow analysis is shown in the drawing below as a comparative example.

[0536]

[0537] FIG. 22 is a diagram illustrating another example of generating instruction sequences containing feature information using instructions within a control block.

[0538] Here are sample codes app1 and app3 that achieve the same result.

[0539] In this example, the control block represented by the app1 sample code on the left has a structure in which the same logic or code with different variables is repeated twice.

[0540] The app3 sample code on the right illustrates a case where the same code is not repeated, but instead converted to a function and called twice (NET-6-110).

[0541] The results of the two sample codes in this drawing are the same, but when generating an instruction sequence based on the app3 sample code, the instruction of the control block (0x100003ef0) that is called twice can be added twice to the graph that analyzes the control flow to generate the instruction sequence.

[0542] When generating instruction sequences using instructions within a control block in this way, instructions that are repeatedly called can be generated by reflecting edge weights in the control flow graph. Accordingly, instructions that are called multiple times can be reflected as weights in the generated instruction sequence.

[0543] A graph reflecting the edge weight of the graph according to control flow analysis is shown in the drawing below as a comparative example.

[0544]

[0545] FIG. 23 is a diagram illustrating another example of generating instruction sequences including feature information using instructions within a control block. FIG. 24 is a diagram illustrating another example of generating instruction sequences including feature information using instructions within a control block. FIG. 25 is a diagram illustrating another example of generating instruction sequences including feature information using instructions within a control block.

[0546] A fourth embodiment of generating instruction sequences containing feature information using instructions within a control block is as follows.

[0547] The sample codes app1, app2, and app3 illustrated in this drawing are as described above.

[0548] Sample code app1 is code that repeatedly executes the same code, sample code app2 is code that calls a function called fool1 to call fool2 so that the same code is not repeated but is executed the same way, and sample code app3 is code that calls the function fool2 twice.

[0549] Even when generating an instruction sequence based on codes that perform the same logic, the instruction sequence may vary depending on the operands of the functions within the file because the offsets are different for each file.

[0550] As illustrated in this diagram, the operands, which are the operators of the function, are all different for the same function.

[0551] The instruction sequences that can characterize cyber threat information can be affected by the operands, which are values ​​within the boxes in this drawing.

[0552]

[0553] Therefore, when generating instruction sequences containing characteristic information using instructions within a control block, the operands of the function can be removed and the instruction sequences can be generated using only the opcodes.

[0554]

[0555] FIG. 26 is a diagram illustrating another example of generating instruction sequences containing feature information using instructions within a control block.

[0556] As a fifth embodiment of generating instruction sequences including feature information using instructions within a control block, when generating an instruction sequence based on instructions within a control block, instructions that simply pass parameters may act as noise in the logic flow.

[0557] In the control block of the sample code illustrated in this drawing, function 0x100003ef0 is called twice, each time passing a parameter.

[0558] Instructions that are simply concerned with parameter passing are excluded because they only generate noise when generating control flow and do not contribute meaningfully to the actual feature information or the corresponding instruction sequence.

[0559]

[0560] As disclosed above, examples of generating an instruction sequence corresponding to characteristic information of cyber threat information based on instructions included in a control block when disassembling an executable file to generate assembly code are disclosed.

[0561] Since the examples illustrated above can be applied duplicatively, an instruction sequence can be generated based on at least one of the five examples described above.

[0562]

[0563] Figure 27 discloses an example of generating an instruction sequence according to the examples described above.

[0564] By considering and combining the characteristics, order, and references of instructions within a control block, an instruction sequence containing characteristic information such as cyber threat information can be generated.

[0565] When generating an instruction sequence in this way, for example, branch series functions that cause code branching, such as JUMP functions or CALL functions, can be removed according to the reference relationship of instructions within the control block, and an instruction sequence can be generated according to the control flow.

[0566] Another example of generating an instruction sequence is when a stack frame is adjusted by separating functions related to the stack frame, it is possible to generate an instruction sequence by eliminating instructions that are not related to the logic by control flow.

[0567] Another example of generating instruction sequences is to generate them by reflecting edge weights in the instruction's control flow graph. This allows for generating instruction sequences by reflecting the weights of the control flow graph for instructions that are frequently called in the generated instruction sequence.

[0568] Another example of generating an instruction sequence is that the operands in the disassembled code change the offsets, so the operands of the function can be removed and the instruction sequence can be generated using only the op-codes.

[0569] Another example of generating an instruction sequence is that instructions that are only concerned with passing parameters do not contribute meaningfully to the instruction sequence, so they can be excluded from the instruction sequence generation.

[0570] Applying at least one of these examples can generate an instruction sequence that can contain characteristic information of cyber threat intelligence based on the control flow within the disassembled control block.

[0571] An instruction sequence can be generated based on the main code (0000000100003f60 <_main>) included in the sample codes app1, app2, and app3 exemplified above.

[0572] The code of the generated instruction sequence can be normalized and vectorized as described above. The vectorized content can then be converted into a hash code. The converted hash code can contain unique characteristic information of cyber threat information. The cyber threat characteristic information contained in the hash code can be used to identify attack techniques and attack groups using the artificial intelligence technique described above.

[0573] In this diagram, the rows corresponding to CFG represent graphs according to control flow analysis for sample codes app1, app2, and app3, respectively.

[0574] In this example, the graph according to the control flow analysis of the sample code app1 is expressed as 0:100003f60 -> 1:100003ed0, and the graph according to the control flow analysis of the sample code app2 is expressed as 0:100003f60 -> 1:100003f00 -> 2:100003ed0.

[0575] And the graph according to the control flow analysis of the sample code app3 is expressed as 0:100003f60 -> 1:100003f40 -> 2:100003ef0. Here, the control flow of 1:100003f40 -> 2:100003ef0 reflects the edge weight of 2.

[0576] The graph for each control flow analysis is generated by applying at least one of the five examples illustrated above.

[0577] The rows corresponding to "Instruction Sequence" represent the instruction sequences for the sample codes app1, app2, and app3, respectively. Therefore, even though the sample codes app1, app2, and app3 are not completely identical, the instruction sequences according to the methods exemplified above are all identical because they perform the same result.

[0578] The last row, corresponding to Fuzzy Hash, converts the instruction sequences for sample codes app1, app2, and app3 into hash codes. The hash information of the control block of each sample code can serve as characteristic information.

[0579] As this example demonstrates, sample codes app1, app2, and app3, although slightly different, share the same meaning from a cyber threat intelligence perspective. In other words, the hash codes for sample codes app1, app2, and app3 are identical, and the corresponding feature information for each code is identical.

[0580]

[0581] Figure 28 is a drawing illustrating another embodiment of the disclosed cyber threat information processing device.

[0582] Another embodiment of a cyber threat information processing device may include a server (2100) including a processor, a database (2200), and an intelligence platform (10000).

[0583] The database (2200) can store already classified malware or pattern codes of malware.

[0584] The processor of the server (2100) can perform a first execution module (18101) that disassembles an executable file received from an application programming interface (1100) to obtain disassembled code.

[0585] And the processor of the server (2100) can perform a second execution module (18503) that generates an instruction sequence based on a control flow according to the relationship between instructions in the disassembled code.

[0586] Examples of the execution process of the second execution module (18103) are illustrated in FIGS. 19 to 27.

[0587] The processor of the server (2100) may perform a third execution module (18505) that converts the generated instruction sequence into a feature data set related to cyber threat information. The feature data set may be feature vector data and a hash function.

[0588] The processor of the server (2100) may execute an artificial intelligence engine (1230) and determine whether the converted specific format data set is similar to the stored malware based on the determination, and execute a fourth execution module (18507) that classifies the converted specific format data set into at least one standardized attack identifier based on the determination.

[0589] An example of the execution process of the 4th execution module (18507) is described with reference to FIG. 19, FIG. 20, FIG. 21, FIG. 27, FIG. 28, etc.

[0590]

[0591] Figure 29 is a drawing illustrating another embodiment of the disclosed cyber threat information processing method.

[0592] Obtain the disassembly code that disassembles the executable file (S4100).

[0593] An instruction sequence is generated based on the control flow according to the relationship between instructions in the disassembled code (S4200).

[0594] Examples of obtaining an instruction sequence based on the control flow according to the relationship between instructions in the code are illustrated in detail in FIGS. 19 to 27.

[0595] The above generated instruction sequence is converted into a feature data set related to cyber threat information (S4300).

[0596] The generated instruction sequences can be converted into feature vector data and then converted into hash function values. Examples of converting a code block including an instruction sequence into vector data and hash function values ​​have been described in detail above. For example, the embodiments of FIGS. 21 to 26 can be used for data conversion. For an example of converting a code block including an instruction sequence into vector data and hash function values, refer to this embodiment.

[0597] Cyber ​​threat information is acquired by learning a feature data set related to the aforementioned cyber threat information using an artificial intelligence model (S4400). An example of classifying attack techniques or attack groups by learning data containing feature information related to cyber threats using an artificial intelligence model is described in detail above. The learning model and classification model are also described in detail.

[0598] Therefore, patterns associated with specific attack identifiers can be identified from code blocks generated by extracting only instruction sequences related to cyber threats. Furthermore, accurate attack identifiers can be determined probabilistically based on data associated with the selected attack identifier. Attack groups can also be identified, as illustrated above.

[0599] The acquired cyber threat information can be provided back to the user from the server. By querying the API for information about an executable file or entering an executable file, the user can obtain specific cyber threat information related to that executable file, such as detailed attack techniques and attack groups.

[0600] The above discloses embodiments of processing cyber threat information by analyzing executable files for the system in the assembly area.

[0601] Below, we disclose an embodiment of identifying and processing cyber threat information from non-executable files. Recently, especially due to the COVID-19 pandemic, all activities, including economic, social, and educational activities, have shifted to non-face-to-face interactions, leading to the expansion of tens of thousands of online platforms, including online commerce, remote work, and distance learning. Consequently, the number of non-executable files shared online has increased, and attackers are increasingly exploiting this to conduct phishing attacks and Advanced Persistent Threat (APT) attacks using various non-executable files.

[0602] However, general users still lack awareness of non-executable malware, and existing antivirus products, developed specifically for executable files, struggle to detect them. Furthermore, even when non-executable malware is detected, the reason for detection is often insufficient. Therefore, detection of non-executable malware and the basis for such detection are essential. Considering these points, the following describes in detail an embodiment of identifying and acquiring cyber threat information from non-executable files.

[0603] Note that a non-executable file here refers to a file whose external form is non-executable and requires a separate executable program to run. To accurately describe a non-executable file, the description will be provided with reference to the drawing.

[0604]

[0605] Figure 30 is a conceptual diagram illustrating a non-executable file structure and a leader program of the non-executable file.

[0606] Non-executable files, which can be represented by document-type files with file extensions such as PDF or DOC, can embed media files such as text, scripts, and images, as well as other executable or non-executable files, as shown in this drawing.

[0607] As shown in the example in this drawing, non-executable files can contain scripts, text, or media. Non-executable files can also contain executable files or other non-executable files.

[0608] Non-executable files can be loaded and their contents inspected by an executable file (a non-executable file reader program) that can read the file. Malicious non-executable files can be loaded by the reader program (while it is running) and induce the reader program to perform the following actions:

[0609] When a malicious non-executable file is executed, it may, for example, execute a script containing malicious behavior. Alternatively, the script may connect to a malware distribution server, download and execute the malware, or extract and execute an executable file containing the malicious behavior embedded in it.

[0610] Additionally, when a malicious non-executable file is executed, it may extract and open a non-executable file that contains or embeds malicious behavior, or extract and open a media file that contains malicious behavior.

[0611]

[0612] Below, embodiments are disclosed that can detect non-executable malicious files and identify corresponding attack techniques and attack groups. The disclosed embodiments utilize artificial intelligence models to classify non-executable files as normal or malicious, identify attack groups within non-executable files, or identify attack behavior within non-executable files.

[0613]

[0614] FIG. 31 discloses a block diagram of an embodiment capable of obtaining cyber threat information of a non-executable file.

[0615] This embodiment includes a file analysis unit (4300), a feature processing unit (Feature Fusion) (4400), a malicious document detector (Malicious Document Detector) (4500), an attack technique classification unit (Attack Technique Classifier) ​​(4610), and an attack group classification unit (Attack Group Classifier) ​​(4620).

[0616] The file analysis unit (4300) can receive a non-executable file (unknown document) and analyze various cyber threat information of the non-executable file.

[0617] The file analysis unit (4300) may include a first analysis unit (4310), a second analysis unit (4320), and a third analysis unit (4330), and may analyze characteristic information of a non-executable file input from each analysis unit.

[0618] The feature processing unit (4400) extracts a feature vector from the feature information analyzed by the file analysis unit (4300) and converts the extracted vector into an appropriate form so that the malware detection unit (4500) can determine whether or not it is malicious.

[0619] The malware detection unit (4500) uses artificial intelligence techniques to detect whether the input feature vectors converted into data contain malicious activity. If the malware detection unit (4500) determines that the input data does not contain cyber threat information, it determines it to be a normal file (normal document).

[0620] The attack technique classification unit (4610) and the attack group classification unit (4620) can classify attack techniques (e.g., T1204.001) and attack groups (e.g., G001) according to the cyber threat information system based on artificial intelligence techniques for data detected as malicious by the malicious detection unit (4500).

[0621] Here, according to the cyber threat information system, the attack behavior contained in the non-executable file is an attack technique called T1204.001, and the group that created the attack behavior is an attack group called G001.

[0622] The blocks illustrated can be implemented in hardware or in software, each executed by a server processor. Below, detailed examples of each part of the illustrated block diagram are provided.

[0623]

[0624] Figure 32 is a diagram showing an example of performing a first type of analysis of a file included in a file analysis unit among examples of obtaining cyber threat information of a file.

[0625] The first analysis unit (4310) analyzes the input file itself, which is expressed here for convenience as performing a type of static analysis.

[0626] The first analysis unit (4310) performs static analysis, such as extracting and analyzing malicious payloads, scripts, etc. contained within the document of a non-executable file, and identifying hidden attachments or malicious data disguised as other files.

[0627] The first analysis unit (4310) performs a static feature extraction step, a static feature processing step, and a static feature conversion step. If the first analysis unit (4310) is implemented in hardware, the first analysis unit (4310) may include a static feature extraction unit (4312), a static feature processing unit (4315), and a static feature conversion unit (4317).

[0628] The first analysis unit (4310) can separate non-executable files, such as files within a document, based on static analysis, and analyze the separated files. Based on static analysis, the first analysis unit (4310) can extract hidden malicious payloads within non-executable files, scripts capable of executing them, and information about the document's format.

[0629] For example, the static feature extraction unit (4312) can extract URI information, scripts, embedding files, actions, textual contents, and document metadata within non-executable files.

[0630] The static feature extraction unit (4312) can extract image files or attachments of various formats, for example, from embedded files.

[0631] The static feature processing unit (4315) can process the static feature information (URIs, Scripts, Embedding files, Actions, etc.) extracted by the static feature extraction unit (4312) and perform additional analysis and processing according to the static feature information.

[0632] The static feature processing unit (4315) can process the extracted information in detail to reflect the attacker's intention information in the feature information that can distinguish the attack technique and attack group identification.

[0633] For example, the static feature processing unit (4315) can obtain URI meta information by parsing a URI with a URI parser, and based on this, it can confirm the attacker's intention to induce the user to download a malicious file for secondary infection or to induce the user to access an external phishing website from a document.

[0634] The static feature processing unit (4315) can obtain script metadata through analysis of extracted scripts, and based on this, can obtain information on which language scripts an attacker prefers for vulnerability attacks or malicious actions.

[0635] The static feature processing unit (4315) can check the hidden payload identifier from the embedded file and obtain the payload type of the embedded file, and based on this, can obtain information on what technique the attacker uses to hide the malicious payload.

[0636]

[0637] In addition, the static feature processing unit (4315) can check the type of the attached file from the embedded file to confirm the actual file type (true file type), and based on this, it can obtain information on what data the attacker included as an attachment file within the document and what was disguised.

[0638] The static feature processing unit (4315) can classify various actions contained in a non-executable file and obtain action metadata, and based on this, can obtain information on what actions or techniques are used to induce malicious actions.

[0639] In this way, the static feature processing unit (4315) can obtain information on the attacker's intent from various extracted static analysis information. In addition, the static feature processing unit (4315) can obtain information on which files are included in a non-executable file in an abnormal form and whether the files are in script form.

[0640] The static feature conversion unit (4317) converts the static feature information extracted by the static feature processing unit (4315). For example, the static feature conversion unit (4317) performs a normalization or vectorization process as described above so that cyber threat information can be processed based on the static feature information extracted by the feature processing unit (4400).

[0641]

[0642] Figure 33 is a diagram showing an example of performing a second type of analysis of a file included in a file analysis unit among examples of obtaining cyber threat information of a file.

[0643] The second analysis unit (4320) can extract cyber threat information by analyzing non-executable files based on dynamic analysis. The third analysis unit (4320) can extract behavioral information that occurs when a non-executable file is actually executed by executing it with a corresponding program, such as a reader program.

[0644] For convenience, the second analysis unit (4320) is expressed as performing a dynamic analysis step below.

[0645] The second analysis unit (4320) builds a safely separated virtual environment for dynamic analysis of non-executable files and executes a corresponding program for the non-executable file in the virtual environment.

[0646] The second analysis unit (4320) can analyze what parameters are used to perform an action when a system call is called in a process that occurs when a non-executable file is executed in a corresponding program.

[0647] The second analysis unit (4320) performs the execution stage, dynamic feature extraction stage, and feature transformation stage. If the second analysis unit (4320) is implemented in hardware, it may include an execution unit (4322), a dynamic feature extraction unit (4325), and a dynamic feature transformation unit (4327).

[0648] The Sandbox Document Reader of the execution unit (4322) executes the input non-executable file as a corresponding program in a virtual environment.

[0649] The system call analysis unit (System Call Hooking) of the execution unit (4322) monitors whether a specific system call is called in a process derived from an executed response program, and through this, it can analyze which parameters are used to perform the execution action.

[0650] The system call analysis unit (System Call Hooking) of the execution unit (4322) can obtain system calls monitored based on dynamic analysis and corresponding extractable parameter data.

[0651] For example, the system call analysis unit (System Call Hooking) of the execution unit (4322) can analyze the corresponding packet data, etc. when the Send API is called while the program is being executed, and obtain parameter information of the system call, such as what packet data and how much is transmitted over the network.

[0652] The System Call Hooking section of the execution unit (4322) can analyze the tracing information by tracing the stack of system calls executed by the leader program of a non-executable file in reverse. This tracing information includes the execution order of functions according to the system call and information on variables used by those functions.

[0653] A detailed example of the system call hooking is described in detail below.

[0654] The dynamic feature extraction unit (4325) can extract and collect the results of execution in a virtual environment by the execution unit (4322). For example, the dynamic feature extraction unit (4325) can collect various command information generated when a script is executed, and information on the communication type, IP address, and port number generated by a network connection resulting from the execution of the leader program.

[0655] The dynamic feature extraction unit (4325) can collect various packet data downloaded while the leader program is running, or collect information about the path of the target file or packet contents from the payload of the packet.

[0656] As another example, the dynamic feature extraction unit (4325) may obtain information about the program being executed and its target file when a file is executed or opened.

[0657] The dynamic feature transformation unit (4327) transforms the information collected or extracted by the dynamic feature extraction unit (4325). For example, the dynamic feature transformation unit (4327) performs a normalization or vectorization process so that cyber threat information can be processed based on the feature information extracted by the dynamic feature transformation unit (4327).

[0658]

[0659] FIG. 34 is a diagram illustrating the target and extracted information extracted by dynamic execution of a non-executable file by a second type of analysis for a file according to an embodiment.

[0660] When a non-executable file is run with a reader program, various actions can be performed within the program. This diagram exemplifies categories of actions performed, including running / opening a script, connecting to a server, downloading, extracting a file, and running / opening a file. However, numerous other actions are possible.

[0661] When a script is executed by executing a non-executable file's reader program, functions such as WinExec and System can be executed via the System Call API. These functions can execute command-line commands; this example shows powershell.exe being executed.

[0662] When a non-executable file's leader program connects to another server, a Socket can be executed via the System Call API. Here, the resulting communication type parameter is AF_INFT. Additionally, when Connect is executed via the System Call API, a port number can be obtained as a parameter.

[0663] As an example, when a non-executable file is executed as a reader program, functions such as Send, SendTo, Recv, RecvFrom, Fopen, Fwirte, CreateFile, WriteFile, CreateProcess, and ShellExecute can be executed through the System Call API depending on the category of the action performed. Examples of parameters that can be extracted according to each System Call API function are illustrated in the section on the right.

[0664]

[0665] Figure 35 is a diagram showing an example of performing a third type of analysis on a file, included in a file analysis unit, among examples of obtaining cyber threat information on a file.

[0666] The third analysis unit (4330) obtains cyber threat information characteristics based on information stored in memory during the execution preparation phase for non-executable files. Since it analyzes data in memory immediately before dynamic execution in a virtual environment, the third analysis unit (4330) is referred to hereinafter as performing a mild dynamic analysis phase for convenience.

[0667] When performing a mild dynamic analysis step, the third analysis unit (4330) can extract and analyze OP-code and operator information included in memory, or deobfuscated malicious payload data, in the malicious behavior preparation step according to file execution.

[0668] The third analysis unit (4330) does not extract parameters generated while executing the dynamic analysis described above. The third analysis unit (4330) performs so-called API hooking on key system functions that are essential for malicious behavior immediately before dynamic execution in a virtual environment, thereby suspending the process when the function is called, and extracting (dumping) the information loaded into memory at that time.

[0669] To this end, the third analysis unit (4330) performs an execution preparation step, a memory extraction step, a data extraction step, and a feature transformation step. If the third analysis unit (4330) is hardware-separated, the third analysis unit (4330) may include an execution preparation unit (4331), a memory extraction unit (4333), a data extraction unit (4335), and a feature transformation unit (4337).

[0670] The third analysis unit (4330) can obtain and analyze data of a malicious payload from memory based on information from the stage of preparing a malicious act.

[0671] In the execution preparation stage, the execution preparation unit (4331) prepares a non-executable file (target file) and a leader program (application) in the user area. The execution preparation unit (4331) can prepare various file systems, network systems, or memory in preparation for events that occur when the corresponding leader program (application) is executed in the kernel area.

[0672] The execution preparation unit (4331) prepares for execution with API hooking list information so that the application can perform API hooking on the system's main functions immediately before execution. Detailed API hooking list information is exemplified in the drawing below.

[0673] The memory extraction unit (4333) halts the process when a function on the API hooking list is called, dumps the data stored in memory at that time, and extracts information. The memory extraction unit (4333) can obtain analysis information that can serve as cyber threat information from data immediately prior to the function's process execution.

[0674] The data extraction unit (4335) can obtain OP-code, operator data, and deobfuscated data from data obtained by memory dumping by the memory extraction unit (4333).

[0675] For example, the data extraction unit (4335) can disassemble data obtained by the memory extraction unit (4333) through memory dumping, and classify OP-code, operator data, and deobfuscated data from the disassembled data.

[0676] The data extraction unit (4335) here can obtain the analysis target data as conversion data for OP-codes, operator data, and deobfuscation data corresponding to functions on the API hooking list, not the entire executable file.

[0677] The feature conversion unit (4337) performs a process of normalizing or vectorizing cyber threat information based on the obtained OP-code, operator data, and deobfuscated data so that it can be processed.

[0678]

[0679] Figure 36 is a diagram illustrating API hooking list information when a third analysis unit performs mild dynamic analysis according to an embodiment.

[0680] The API hooking list information provided is an example of the API categories in the left column and the APIs that can be included in the API hooking list within each API category in the right column.

[0681] Examples of API categories include Window OS Native API, HTML DOM Parser API, and VBS Script Engine API.

[0682] For the Window OS Native API category, examples of APIs that can be used for API hooking are provided, for the HTML DOM Parser API category, 7 APIs are provided, and for the VBS Script Engine API category, 11 APIs are provided.

[0683]

[0684] Figure 37 is a drawing for explaining a feature processing unit among embodiments capable of obtaining cyber threat information of non-executable files.

[0685] As disclosed, the first analysis unit (4310) and the second analysis unit (4320) can obtain and analyze static feature information and dynamic feature information, respectively, for non-executable files.

[0686] Meanwhile, the third analysis unit (4330) can acquire and analyze cyber threat information from the memory information of an application running in connection with a non-executable file in a virtual environment by hooking the API of the application. In the disclosed embodiment, the analysis performed by the third analysis unit (4330) is referred to as mild dynamic analysis.

[0687]

[0688] The feature processing unit (4400) can selectively collect and process static feature information, dynamic feature information, and mild dynamic feature information extracted by the first analysis unit (4310), the second analysis unit (4320), and the third analysis unit (4330), respectively.

[0689] The malware detection unit (4500) can determine whether a non-executable file contains cyber threat information based on information processed by the feature processing unit (4400).

[0690] And the attack technique classification unit (4610) can classify in detail the attack behavior or attack technique of the cyber threat information detected by the malicious detection unit (4500) according to a specific system.

[0691] The attack group classification unit (4620) can classify who planned or executed the attack based on the cyber threat information detected by the malicious detection unit (4500).

[0692] The feature processing unit (4400) can generate feature information using one of static feature information, dynamic feature information, and mild dynamic feature information, or by combining at least two or more of them.

[0693] The feature processing unit (4400) generates feature information by selectively combining the extracted information according to the characteristics of each extracted static feature information, dynamic feature information, and mild dynamic feature information, or by considering the classification model of the attack technique or attack group.

[0694] For example, among the extracted feature information, feature information for classifying attack techniques and feature information for classifying attack groups can be combined by evaluating the importance of each feature differently. This is illustrated in detail in the drawings below.

[0695] Accordingly, the feature processing unit (4400) can selectively or combinedly use at least one of the extracted static feature information, dynamic feature information, and mild dynamic feature information.

[0696] For example, if, unlike static feature information and dynamic feature information, only mild dynamic feature information has information at the assembly code level, mild dynamic feature information may not be used in the attack group classification model.

[0697] In this case, the malware detection unit (4500) or the attack technique classification unit (4610) can detect malware or classify attack techniques using all feature information among static feature information, dynamic feature information, and mild dynamic feature information, and the attack group classification unit (4620) can separately classify attack groups by selectively using static feature information and dynamic feature information.

[0698] Since the feature information extracted in this way all has different importance and characteristics, malware detection, attack technique classification, and attack group classification can be performed based on the feature information selected or combined accordingly.

[0699] Meanwhile, the malware detection unit (4500) determines whether a non-executable file is malicious based on a machine learning model. For example, if the feature processing unit (4400) processes at least one feature among static feature information, dynamic feature information, and mild dynamic feature information, the malware detection unit (4500) can detect whether the file is malicious based on feature vector data corresponding to the feature information.

[0700] An example of determining whether something is malicious or not based on feature vector data is described in detail above.

[0701]

[0702] Figure 38 is an example diagram comparing the importance of feature information extracted from a non-executable file according to the disclosed embodiment.

[0703] In this graph example, the horizontal axis represents the index according to feature information, and the vertical axis represents the importance score. The index of feature information according to the attack group model (Group model) and the index of feature information according to the attack technique identifier (TID model) have peak values ​​at different feature indices.

[0704] This means that the characteristics of the feature information indicating the attack technique and the feature information indicating the attack group are different, as explained above.

[0705] Accordingly, the feature processing unit (4400) can select or selectively combine static feature information, dynamic feature information, and mild dynamic feature information differently, respectively, for malware detection, attack technique classification, and attack group classification, according to the characteristics of such feature information, so that a detection model or a classification model is performed.

[0706]

[0707] Figure 39 is an exemplary diagram for explaining a classification model of an attack technique classification unit according to the disclosed embodiment.

[0708] This drawing shows an example of an attack technique classification section according to an embodiment classifying and outputting attack techniques.

[0709] As disclosed, the attack technique classification unit classifies the attack technique of a non-executable file by performing a machine learning model based on the feature vector data for cyber threats output by the feature processing unit when the non-executable file is judged to be malicious because it contains cyber threat information.

[0710] When an attack technique classification unit uses a machine learning model to classify attack techniques, it can use the class labels of the training data as the correct answer and learn based on them. This training data includes independent variables (feature vector data) and dependent variables (class labels).

[0711] Typically, the dependent variable can be an integer value (single label) where the class label represents a single index number.

[0712] However, since a single file can contain multiple attack techniques, the attack technique classification unit can use a multi-label technique that defines the dependent variable as T vectors rather than a single integer value. In other words, the attack technique classification unit can receive feature vector data and classify it into binary vectors corresponding to attack techniques through multi-label classification.

[0713] The attack technique classification unit is a multi-output classification model that learns a binary classification model for each class label and can generate classification models as many as T, which is the number of attack techniques that can be classified.

[0714] To simply express what has been explained in a formula, the predicted value y, which is a T-dimensional vector, and the predicted value oi for the input vector x of the i-th attack technique classification model fi can be defined as follows.

[0715]

[0716]

[0717] The dependent variable, the class label, can be represented as a multidimensional vector such as [1, 1, 0] for the attack technique identified as T1059.005 when classified as a single label or for the attack technique identifiers T1059.005, T1564.007, T1204.002 when classified as multi-labeled as described.

[0718] And the attack technique classification section can output the probability for three attack techniques as shown at the bottom of this diagram.

[0719]

[0720] Figure 40 is a diagram illustrating an attack technique identified by selectively combining multiple analysis techniques for a non-executable file according to the disclosed example.

[0721] This diagram illustrates the identifier (technique ID) of each attack technique, the name of the attack technique, and the description of each attack technique.

[0722] For example, the name of the attack technique identifier T1059.001 is Command and Scripting Interpreter: PowerShell, and this attack technique refers to an attack technique of a non-executable file that performs malicious actions using a PowerShell script.

[0723] The name of the attack technique identifier T1059.005 exemplified above is Command and Scripting Interpreter: Visual Basic, and this attack technique refers to an attack technique of a non-executable file that performs malicious actions using the Visual Basic programming language.

[0724]

[0725] Figure 41 is an exemplary diagram for explaining a classification model of an attack group classification unit according to the disclosed embodiment.

[0726] The attack group classification unit can classify attack groups based on a classification model, unlike the examples illustrated in FIGS. 29 and 30.

[0727] The attack group classification unit can classify attack groups that intend to commit attacks based on the feature vector data output by the feature processing unit.

[0728] As an example of such clustering, the attack group classification unit can perform clustering analysis based on feature vector data and group data with similar characteristics into one group.

[0729] The attack group classification unit can assign clustering identification information to each clustered group based on the structure, content, attack behavior attachments, and form of malicious data of documents extracted from non-executable files.

[0730] And the attack group classification unit can learn the learning data using a decision tree model based on the given clustering identification information (or grouping identification information) and classify the clustered groups.

[0731] This diagram illustrates a decision tree that classifies groups according to some characteristic, based on clustering identities (or grouping identities).

[0732] The topmost box represents the root node. The root node, which has a clustering identity, is sequentially split into subnodes at the decision node based on various characteristics contained in the non-executable or executable file, thereby displaying the tree structure of the learned decision tree model.

[0733] Here, the decision nodes and subnodes are also represented in the form of boxes.

[0734] When the Attack Group Classification Unit classifies attack groups, it can provide clustering and group-specific group profiling information. For example, the Attack Group Classification Unit can provide group profiling analysis information that includes various factors, such as the language of the text within a document, the type of content within the document, whether the document contains specific scripts, or whether the document includes actions that are automatically performed upon execution.

[0735] This diagram illustrates an example of an attack group classification unit classifying groups based on a tree structure, with the last leaf node through the sixth branch illustrating a classification model that can distinguish groups from each other.

[0736] The last leaf nodes of this tree node can contain group profiling information that distinguishes the group. For example, this could be profiling information that distinguishes the group, such as whether the document's text is in English, whether it contains metadata and its length, or whether it contains content.

[0737] For example, group profiling information may include information such as (1) the text within the document is in English, (2) the document contains no media content, (3) the document contains JavaScript, and (4) the document contains an action function that is automatically performed when the document is executed.

[0738]

[0739] Below, we present a detailed example of the system call hooking component of the dynamic analysis described above. As described above, there may be cases where the maliciousness of a non-executable file can be determined based on static analysis features.

[0740] However, static analysis features alone often fail to identify whether a non-executable file contains malicious activity or provide a detailed explanation of how the malicious activity occurs. Therefore, running a reader program to load the non-executable file can accurately identify the process of malicious activity and provide a detailed explanation.

[0741] When a leader program related to a non-executable file is executed, the leader program performs actions according to a combination of system calls provided by the operating system.

[0742] When the leader program runs on the Windows operating system, the following system calls may be used:

[0743]

[0744] Figure 42 is a diagram illustrating the execution of the leader program and system call of the non-executable file described above.

[0745] Non-executable files can contain scripts, media files, executable files, other non-executable files, text, etc. These non-executable files can be executed by a corresponding reader program. If the reader program runs on a Windows operating system, various system calls, as illustrated in this diagram, may be used, depending on the files contained within the non-executable file, as described above.

[0746] For example, when a script is executed within a non-executable file, system calls such as WinExec, CreateProcess, and ShellExecute are used, and when a server is connected, system calls such as Socket and connect are used. When a download action is performed by executing a non-executable file, system calls such as send, sendto, recv, and recvfrom may be used. When a file is extracted by executing a non-executable file, system calls such as fopen, fwrite, CreateFile, and WriteFile may be used, when a file is executed, system calls such as WinExec, CreateProcess, and system may be used, and when a file open action is performed, system calls such as ShellExecute and system may be used, respectively.

[0747] However, these system calls called by the leader program can be hooked (indicated by point A in the diagram) when the system call is called.

[0748] When hooking a system call at point A, you can obtain the parameter values ​​or memory values ​​passed to each system call by dumping them.

[0749] Although this example is only for the Windows operating system, the same example can be applied to other operating systems such as mobile operating systems or Linux operating systems.

[0750]

[0751] Figure 43 is a drawing for explaining an example of hooking a system call in program code according to an embodiment.

[0752] In this drawing, the command send may include a function signature as exemplified.

[0753] The information transmitted according to the above command in this program code can be confirmed by dumping the memory data of [buf] and [len].

[0754] By dumping the parameter values ​​and memory values ​​passed according to the system call that executes the leader program of a non-executable file in this way, it is possible to determine what actions the malicious activity causes and what information is used.

[0755]

[0756] FIG. 44 discloses an example of tracking cyber threat information through dynamic analysis according to an embodiment.

[0757] An embodiment can generate stack trace information of a leader program at the hooking point when a leader program on a specific operating system uses a system call.

[0758] This example diagram shows the process of obtaining the sequence of malicious actions and the details of malicious actions according to related variables through the stack trace information generated after hooking the system call WinExec in the Windows operating system.

[0759] Here is an example of a stack trace at the point where the WinExec system call, which is the final step, is hooked. According to the generated stack trace information, we can see that the functions main -> find_lastest_target -> get_script were called in that order before the WinExec system call.

[0760] The boxes containing the functions in this diagram indicate the local variables used by each function. For example, the find_lastest_target function uses the local variables count and targets.

[0761] Finally, the get_script function calls the WinExec system call. If malicious activity occurs, the stack trace information can be used to explain the specific mechanism.

[0762] That is, the following explanation can be provided according to the reverse order of the calling functions related to the system call in the stack trace information.

[0763] (1) Attempt to execute the suspicious command lpCmdLine via the system call WinExec.

[0764] (2) Functions are executed in the order of main -> find_lastest_target -> get_script through the leader program.

[0765] (3) The local variables of each function are set as follows, and the description of the local variables is as follows.

[0766] (a) main:

[0767] target_list - Description of local variables

[0768] (b) find_lastest_target:

[0769] count - Description of local variable

[0770] targets - Description of local variables

[0771] (c) get_script:

[0772] script_src - Description of local variables

[0773] cmd - Explanation of local variables

[0774]

[0775] According to an embodiment, when a non-executable file is executed by a leader program and a malicious action occurs, the leader program can hook a system call on the operating system and then provide a specific mechanism for the malicious action by using the order of functions related to the system call and the variables of the functions.

[0776]

[0777] Figure 45 is a drawing illustrating another embodiment of the disclosed cyber threat information processing device.

[0778] Another embodiment of a cyber threat information processing device may include a server (2100) including a processor, a database (2200), and an intelligence platform (10000).

[0779] The database (2200) can store already classified malware or pattern codes of malware.

[0780] The processor of the server (2100) can receive a non-executable file received through an application programming interface (1100).

[0781] The processor of the server (2100) can perform a first feature analysis module (18601) that analyzes and extracts static feature information related to cyber threats of a non-executable file received through an API.

[0782] A detailed example of the analysis of static feature information performed by the first feature analysis module (18601) is described in Fig. 32, etc.

[0783] The processor of the server (2100) can perform a second feature analysis module (18603) that analyzes and extracts static feature information related to cyber threats of non-executable files received through an API.

[0784] Detailed examples of the analysis of dynamic feature information performed by the second feature analysis module (18603) are disclosed in detail in FIGS. 33, 34, and 42 to 44.

[0785] When the second feature analysis module (18603) analyzes dynamic feature information, it can obtain cyber threat information by dumping the memory data generated at that time by hooking the system call requested by the non-executable file's leader program to the operating system.

[0786] The second feature analysis module (18603) can obtain mechanism information on malicious behavior from the order of functions called immediately before hooking a system call and the parameters corresponding to those functions.

[0787] The processor of the server (2100) can perform a third feature analysis module (18605) that analyzes and extracts mild dynamic feature information related to cyber threats of non-executable files received through an API.

[0788] A detailed example of the analysis of mild dynamic feature information performed by the third feature analysis module (18605) is disclosed in detail in FIGS. 35 and 36.

[0789] The third feature analysis module (18605) can perform API hooking on the main functions of the application system that executes non-executable files, so that when the function is called, the process is put into a suspended state and the information loaded into the memory at that time can be extracted (dumped).

[0790] The third feature analysis module (18605) disassembles the data in the memory to obtain OP-code, operator data, and deobfuscated data, and can obtain feature information related to cyber threat information based on the obtained data.

[0791] The processor of the server (2100) can perform a feature processing module (18607) that selectively combines feature information related to cyber threats analyzed by the first feature analysis module (18601), the second feature analysis module (18603), and the third feature analysis module (18605) to create feature data related to cyber threat information.

[0792] A detailed embodiment of the feature processing module (18607) is described in detail in FIG. 37.

[0793] The processor of the server (2100) can perform a malicious detection module (18608) that detects whether a non-executable file received through an API contains malicious activity based on characteristic information of cyber threat information processed by the characteristic processing module (18607).

[0794] The processor of the server (2100) may perform a classification module (18609) that classifies the attack technique and attack group of the malicious activity by performing an AI engine (1230) when a non-executable file contains a malicious activity based on the results performed by the malicious detection module (18608).

[0795] Detailed practical examples of generating information on attack techniques and attack groups of non-executable files classified by the classification module (18609) are disclosed in detail in FIGS. 38 to 41.

[0796]

[0797] Figure 46 is a drawing illustrating another embodiment of the disclosed cyber threat information processing method.

[0798] A non-executable file is input and at least one feature analysis related to a cyber threat of the input non-executable file is performed (S4500).

[0799] Examples of performing static feature information, dynamic feature information, and mild dynamic feature information related to cyber threats of non-executable files are disclosed.

[0800] Detailed examples of analysis of static feature information are illustrated in Fig. 32, and detailed examples of analysis of dynamic feature information are illustrated in Figs. 33, 34, and 42 to 44, respectively. Detailed examples of analysis of mild dynamic feature information are also disclosed in detail in Figs. 35 and 36.

[0801] It is possible to detect whether a non-executable file contains malicious activity based on feature information that is selectively combined with analysis information according to at least one feature analysis (S4600).

[0802] If a non-executable file contains malicious activity, classification information on the attack technique and attack group can be generated (S4700). Detailed practical examples of generating information on the attack technique and attack group of a non-executable file are detailed in FIGS. 38 to 41.

[0803] Cyber ​​threat information on non-executable files analyzed as above is provided to the user (S4800).

[0804]

[0805] Accordingly, according to the disclosed embodiment, even if a program achieves the same result, it is possible to accurately provide cyber threat information on attack techniques and attack groups and respond to variants of malicious code, even if the logic of the program including the functions is different, such as when the functions are separated or used differently, even if there is no change in the logic of the program.

[0806] According to an embodiment, even if a non-executable file contains malicious activity, it can accurately detect it and provide cyber threat information on the corresponding attack technique and attack group.

[0807]

[0808] Hereinafter, examples of a cyber threat information processing device and method thereof are disclosed for monitoring web pages, identifying web pages containing malicious behavior or information, and identifying whether components constituting the web page contain malicious behavior or information.

[0809]

[0810] FIG. 47 discloses an example of receiving or collecting information from a web page and identifying malicious information based on the information.

[0811] A cyber threat information processing device or method according to an embodiment receives or collects information from the World Wide Web (hereinafter simply referred to as a web page). The embodiment can search the collected web pages, analyze whether the web pages cause specific malicious behavior, and provide cyber threat information to the user based on the analysis.

[0812] An embodiment of a cyber threat information processing device disclosed in this drawing includes a data collection unit (5100) and an analysis and detection unit (5200). As an embodiment of a cyber threat information processing method, the embodiment includes a data collection step and an analysis and detection step.

[0813] The data collection unit (5100) may include a web crawler (5110) and a data bundle (5120).

[0814] The web crawler (5110) can collect information related to the URL of a web page entered through web crawling.

[0815] The Web Crawler (5110) collects all information associated with the URL of a web page and creates a copy of the page or indexes the created page for faster processing.

[0816] The web crawler (5110) of the embodiment can quickly process large amounts of URL input data through parallel processing. For example, the web crawler (5110) can quickly and simultaneously process information related to an input URL in a single thread, such as HTML information, JavaScript information within a web page, media file information such as images, and various files to be distributed by the web page. A detailed example of this is disclosed below.

[0817] The data bundle (5120) can group and output various levels processed in parallel by the web crawler (5110).

[0818] The analysis detection unit (5200) can analyze and detect data containing malicious activity from a data bundle collected and processed by the data bundle unit (5120). To this end, the analysis detection unit (5200) may include an antivirus unit (5210), a deobfuscator unit (5220), a malware detection unit (YARA) (5230), a data parser (5240), an AI engine (5250), and a data provider unit (Report).

[0819] For example, the AntiVirus (5210) can analyze collected web data and identify malware based on the collected data, such as HTML code.

[0820] The Deobfuscator (5220) can deobfuscate data output by the Data Bundle (5120) if the data is obfuscated.

[0821] The malware detection unit (YARA) (5230) can search for malware, that is, attack tools or attacker signature patterns, that contain patterns or signatures according to certain rules in the malicious codes analyzed and identified by the antivirus unit (5210) or data output by the deobfuscator unit (5220).

[0822] For example, the malware detection unit (YARA) (5230) can detect and classify malware based on the input data according to rules such as YARA.

[0823] The data parser (5240) can parse data according to the deobfuscation of the deobfuscator (5220).

[0824] The AI ​​engine (5250) can determine whether data output by the malware detection unit (YARA) (5230) or data parser (5240) is malicious or normal based on a machine learning model.

[0825] The web crawler (5110) of the disclosed embodiment can collect and process data related to web pages in parallel. Furthermore, the analysis detection unit (5200) can identify whether data contained in or associated with a web page is malicious by using detection engines in conjunction with the three detection stages described above (antivirus detection, signature-based malware detection, and AI-based detection).

[0826] Therefore, the embodiment can quickly monitor web page data and accurately identify whether it is malicious.

[0827]

[0828] Figure 48 is a drawing illustrating the operation of a web crawler according to an embodiment.

[0829] As shown in the example in this drawing, the web crawler can collect data from web pages by processing multiple threads in parallel on a single processor.

[0830] This diagram shows an example of a web crawler that runs four processes in parallel, each collecting data related to a different web page.

[0831] Process #1, Process #2, Process #3, and Process #4 can each input address information of different web pages, for example, URL information.

[0832] In the example of this drawing, if process #1 receives address information of a specific webpage (in this example, www.kisa.or.kr), the first collection and analysis thread of process #1 can distribute the address information of the input webpage and webpage address information according to sub-depths of the webpage to other collection and analysis threads.

[0833] This diagram illustrates a scenario where 100 collection and analysis threads simultaneously collect information from a webpage and its sub-webpages. Multiple collection and analysis threads operating in parallel can perform in-memory processing, collecting and analyzing data from each webpage within that thread.

[0834] Each thread can sequentially receive and process data according to web pages and depths, for example, using the circular queue dequeue (DeQ) and enqueue (EnQ) methods.

[0835] Therefore, among multiple collection and analysis threads operating in parallel, the master or first thread can assign web page analysis tasks to other threads based on the depth information of the input web page.

[0836] The collector in the collection and analysis thread can immediately access web pages based on queue requests, load web page data into the in-memory collector, and make HTTP requests for that web page data. When the collection and analysis thread receives an HTTP response containing the web page data, it can analyze it in the analyzer within the in-memory processing.

[0837] In this case, if the HTTP response received by the analyzer of the collection and analysis thread contains information about a sub-web page, the information about the sub-web page can be immediately distributed to another thread to enable analysis of similar web page data.

[0838] The URL of a web page entered in this way may contain other URLs within it, and additional pages may be visited and analyzed based on the depth information contained therein.

[0839] In this example, we have illustrated process #2, process #3, and process #4, but other processes can perform operations in a similar manner.

[0840]

[0841] FIG. 49 discloses an example of storing and managing web page data according to depth information of the disclosed embodiment.

[0842] This diagram illustrates the relationship between web pages based on the entered URL and the linked web pages based on depth.

[0843] The depth levels for the main web page and its sub-web pages are indicated as 0, 1, and 2, respectively. In this example, the main web page at depth level 0 may contain various links, references, or script files within it.

[0844] The web page at depth level 1 may be an HTML file linked to the above link on the main web page or a file linked to each other by the above script file.

[0845] In this example, the HTML file at depth level 1 is linked to the main web page and includes link information for the first Java (JS) script file and link information for an image file (e.g., logo.png). In this example, the Java Script file at depth level 1 is linked to the script file of the main web page.

[0846] Again, the web page at depth level 2 contains the first Java (JS) script file and the image file linked to the HTML file at depth level 1.

[0847] In this way, when the URL information of a main web page is entered, the embodiment can store and manage the URL information of the depth information according to the number of links connected to it. In this case, the embodiment can normalize the URL information.

[0848] An embodiment can normalize, store, and manage web pages and linked web pages according to links by encoding only characters allowed in host names of Unicode strings using Punycode techniques according to RFC 3492.

[0849]

[0850] FIG. 50 discloses an example of determining whether web page data is malicious based on analysis of multiple steps or layers according to an embodiment.

[0851] According to an embodiment, data of a web page collected by a web collection unit is temporarily stored in a data bundle unit (5120) and then determined to be malicious based on analysis of various stages or layers of an analysis detection unit (5200).

[0852] In the example of this drawing, the web crawler (5110) can analyze and collect various types of data within a web page. This example exemplifies the collection of various file types, such as HTML files, JavaScript (JS) files, VB Script (VBS) files, and EXE executable files.

[0853] Various types of data within a web page collected by the web crawler (5110) can be stored in a data bundle (5120). As a type of data bundle (5120) of the example disclosed above, a memory buffer (5120) is exemplified.

[0854] Various types of data stored in the memory buffer (5120) can be determined to be malicious or not at various layers.

[0855] For example, the AntiVirus component (5210) can detect known cyber threat information based on data patterns. The AntiVirus component (5210) can identify known web data, such as HTML malware, based on a previously known antivirus engine.

[0856] The deobfuscator (5220) deobfuscates obfuscated data stored in the memory buffer (5120). For example, if obfuscated JavaScript is present within web page data, it can be deobfuscated.

[0857] The malware detection unit (YARA) (5230) performs pattern-based malicious behavior detection on data stored in the memory buffer (5120) and deobfuscated or received from the antivirus unit (5210). The malware detection unit (YARA) (5230) can detect data within a web page based on patterns, for example, according to YARA rules, identify malware and attack tools within the data, and identify attacker signature patterns.

[0858] The AI ​​engine (5250) can determine whether the data transmitted by the AI-based malware detection unit (YARA) (5230) is malicious or normal based on an AI algorithm.

[0859] By analyzing the collected web page data across multiple stages and layers, as in the example disclosed, more accurate cybersecurity threats can be detected and analyzed for web page data.

[0860] Meanwhile, in the case of executable files such as EXE files included in web pages, the presence of malware, attack techniques, and attack groups can be identified in the same manner as described in FIGS. 16 to 34 or FIGS. 35 to 45.

[0861] For non-executable files included in web pages, the malware, attack technique, and attack group can be identified in the same manner as described in FIGS. 46 to 62.

[0862] In an embodiment, if malicious activity is detected on a collected web page, the recorded data of the web page can be provided to the user or administrator and stored for data acquisition.

[0863] For example, if malicious data is detected on a specific webpage, an embodiment may store an HTTP Archive (HAR) format file of that webpage. An administrator or security officer can then perform additional analysis, including log data, from the stored HTTP Archive (HAR) format file of the webpage, thereby securing evidence for malicious detection.

[0864] An example of providing users with the monitoring results of a web page based on an HTTP Archive (HAR) format file is shown below.

[0865]

[0866] Figure 51 illustrates a concept of analyzing web page data and providing detected information according to an embodiment.

[0867] As disclosed above, web page crawling by the web collection unit and data analysis and malware detection of web pages by the analysis detection unit can be performed sequentially.

[0868] If the data on a webpage is detected as malicious, other webpages are continuously crawled to collect webpage data. If the detection results indicate malicious activity, the relevant webpage data can be saved in an HTTP Archive (HAR) format file by revisiting the webpage.

[0869] HTTP Archive (HAR) format files are files that record the interactions between web browsers and websites. Therefore, the list of data recorded within an HTTP Archive (HAR) format file includes all resource files for that web page, HTTP request and response records, and script files associated with the web page.

[0870] In an embodiment, a user or cybersecurity officer can obtain record information, such as transactions related to such web pages, as a result of web page monitoring.

[0871] Users can check the history information of a webpage by replaying the webpage history information, such as HTTP Archive (HAR) format files, and perform further analysis or obtain supporting data on malicious activity.

[0872]

[0873] Figure 52 discloses an example of the embodiment disclosed above operating on a computer.

[0874] As disclosed, the cyber security threat information processing device including the data collection unit (5100) and the analysis detection unit (5200) can be operated in parallel on multiple computer nodes.

[0875] The illustrated drawing illustrates a cyber threat information processing device including a master node and multiple slave nodes.

[0876] A Docker container can run on the operating system of a cloud system of a single master node (5710). The data collection unit and analysis / detection unit exemplified above may be implemented as separate hardware, but in the example of this drawing, they may also run on a Docker container.

[0877] In such a case, applications running on each Docker container can perform the embodiments disclosed above by utilizing the resources of the cloud system.

[0878] The master node (5710) may include one or more docker containers and a database capable of performing the embodiments disclosed above.

[0879] When operating in a single Docker container of a master node (5710), a data collection unit operating in a specific Docker container can transmit web page link information related to the collected web page to another Docker container operating in the master node (5710) or slave nodes (5720). In addition, the master node (5710) can assign tasks related to monitoring for malicious detection of web pages to slave nodes by taking load balancing into consideration.

[0880] Web page monitoring systems running on multiple hosts based on the example Docker Swarm can be managed as a single master-slave cluster system.

[0881] In this case, the master node (5710) of the cluster system may periodically transmit a heartbeat packet to the slave nodes (5720) to determine whether the server is faulty.

[0882] The master node (5710) of the cluster system can check the status of the slave nodes (5720) to determine if there is a server failure. Conversely, if the master node (5710) of the cluster system wants to expand the processing capacity for web page monitoring, it can deploy a Docker image to a new node and include it in the cluster system.

[0883] In this way, the master node (5710) of the cluster system can perform scale-out for web page monitoring by performing registration and deregistration of nodes within the cluster as in the disclosed example.

[0884] FIG. 53 discloses one embodiment of a method for processing cyber threat information contained in a webpage.

[0885] Web pages are collected and linked data is classified based on the data contained in the web pages or link depth (S5910). When collecting and classifying web pages, processing can be performed in parallel across multiple computer nodes, and the process can be performed on a Docker container on each node as the computer nodes scale out. Detailed examples of this are disclosed in FIGS. 48, 49, and 52.

[0886] Detects whether data included in the above webpage or the linked data is malicious on multiple layers (S5920).

[0887] The data contained in the above webpage refers to various data or files distributed by the above webpage, such as HTML data, JavaScript data, and media files such as images or audio. The data linked to the above webpage includes various types of data or files linked to the above webpage. A detailed example of this is disclosed in Fig. 50.

[0888] For example, in the first layer, cyber threat information can be detected based on the antivirus-based HTML data pattern for data included in the web page or the linked data.

[0889] For example, in the second layer, cyber threat information can be detected based on malware, such as attack tools or attacker signature patterns, that contain patterns or signatures based on certain rules in the data contained in the webpage or the linked data. If the data contained in the webpage or the linked data is obfuscated, deobfuscation can be performed. For example, in the case of obfuscated JavaScript, a deobfuscation tool can be applied and a signature pattern can be found based on YARA rules, etc.

[0890] For example, in the third layer, it is possible to detect whether cyber threat information, such as malicious behavior data, is included in the data included in the web page or the linked data based on an artificial intelligence algorithm.

[0891] The three detection steps for data contained in the above webpage or the above linked data may be performed in parallel or sequentially.

[0892] In the case of data included in the webpage or linked data detected as malicious in the above detection steps, the record data of the webpage is provided or stored (S5930).

[0893] Web page history data can be included by replaying web page history information, such as HTTP Archive (HAR) format files. Users can use this history data to further analyze malicious activity or obtain supporting data.

[0894]

[0895] Below, a more specific example of determining whether collected web page data is malicious is disclosed.

[0896] If you obtain reference information that provides a website, such as URL information, you can obtain HTML (Hypertext Markup Language) data from the web page data of that URL.

[0897] Previous HTML malware detection and analysis simply relied on machine learning to train the entire HTML data, identifying malicious behavior based on the frequency of specific tags or characters within the HTML. Therefore, it was difficult to determine which elements within the HTML were causing specific malicious behavior and who was responsible for it.

[0898] The disclosed embodiment overcomes these problems by enabling the identification of specific attack behaviors within HTML data and even attack group identification.

[0899] Web page data includes HTML (Hypertext Markup Language) data that describes it, and HTML (Hypertext Markup Language) data can describe the contents of a web page using tags, which are a set of various commands.

[0900] For example, HTML data contains a group of tags, each containing an opening and closing tag within the data, and a group of tags can thus constitute a portion of the HTML data.

[0901] While HTML supports slightly different tags depending on the web browser, it generally supports similar tags. Therefore, the embodiment can detect and identify attacker attacks based on the technical content contained in a tag group.

[0902] For example, an attacker can exploit the functionality of a webpage's HTML tags to carry out an attack. If the attacker uses the same attack technique on a webpage, the data described within that webpage's HTML tags may appear similar when analyzing cyber threat intelligence.

[0903] The embodiment can identify whether a malicious tag or a malicious tag similar to the malicious tag is based on the similarity of a partial region of a tag unit of HTML data.

[0904] Detailed examples of this are disclosed below.

[0905] FIG. 54 discloses one embodiment of a method for processing cyber threat information.

[0906] Web page data is acquired based on link information and the tag structure information of the web page data is analyzed (S6110). As an example of the tag structure information of the web page data, the Document Object Model (Dom) Tree structure is exemplified below.

[0907] According to the above tag structure information, data included in the tag area of ​​the web page data is converted into tag feature data (S6120). Based on the tag structure information, data in tag units that can be modified by an attacker among HTML data can be converted into tag feature data. Detailed examples of tag feature data are disclosed below.

[0908] By learning the converted tag feature data, cyber threat information regarding the data contained in the tag area is acquired (S6130). By classifying the tag feature data using a classification model of an artificial intelligence algorithm, attack techniques and attack groups for malicious activity can be identified for each tag section.

[0909]

[0910] Figure 55 illustrates structural information based on tags of HTML data as a method for processing cyber threat information according to an embodiment.

[0911] HTML data can be analyzed by tag unit. This diagram is an example of a Document Object Model (Dom) Tree representing the tag unit of HTML data. The Dom Tree is related to the depth according to the sequential order of tags, and each tag can become an object or node. Therefore, if you obtain the Dom Tree of HTML data, you can easily understand the HTML structure.

[0912] This diagram is an example of analyzing HTML data, illustrating the DOM tree structure according to the position and depth of tags.

[0913]

[0914] In this drawing example, the tag (5910) indicating the end of the tag portion surrounding the entire HTML document, the end of the tag indicating the name of the HTML document (5920), the end of the tag area indicating the body of the HTML document (5930), and the end of the tag group indicating a script in the HTML document (5940) are illustrated with their respective identification numbers.

[0915] And the end of a group of tags indicating the title (heading) of the content within the HTML document body (5950), the end of a group of tags inserting another HTML page within the document, i.e. the content of overlapping browsing (5960), and the end of a tag area creating a hyperlink (5970) are exemplified, respectively.

[0916] In this way, HTML data can be analyzed as information in a hierarchical structure and separated into tag units that can identify the characteristics of the HTML data.

[0917] Here, as an example of separating HTML data into tag areas that can identify the characteristics of HTML data, an example of classifying HTML data according to the Dom Tree is disclosed.

[0918]

[0919] FIG. 56 discloses an example of obtaining characteristic information related to cyber security threats from structural information based on tags of HTML data as a method for processing cyber threat information according to an embodiment.

[0920] First, to facilitate implementation, an example is disclosed of obtaining characteristic information related to cyber security threats of web page data by using a web page having tag structure information of the drawing disclosed above.

[0921] As in the example disclosed above, tag structure information of HTML data can be obtained by analyzing the Dom Tree.

[0922] The tag data obtained here is shown in the left section, and the web page data corresponding to each tag data is shown in the right section.

[0923] According to the example disclosed above, as a tag area or tag data included in the tag structure information of HTML data, , <iframe>, , <script>나 < / script>exemplified.

[0924] In this drawing example, the text (5980) included in the tag body among the tag structure information is as follows, as illustrated in the drawing.

[0925] onload="teclear();"

[0926] Background="ground.gif"

[0927] Link=”#ff2ff”

[0928] Text=”#ff0001e”

[0929] Link=”fff2ff”

[0930] And in this example, the tag image among the tag structure information<image> The content included in the area could be a URL address where the image source is provided (in the example of this diagram, http: / analytics.hosting24.com / do.php).

[0931] Users or attackers can arbitrarily modify or add cyber threat information to the HTML data corresponding to each tag area included in the tag structure information.

[0932] Therefore, in these cases, data that can be modified or arbitrarily modified by an attacker can be replaced with data for detecting or analyzing cyber threat information.

[0933] Here, data that can be arbitrarily modified by a user or attacker refers to values ​​that can be arbitrarily modified by a user, excluding HTML grammar among HTML data, and refers to URL addresses or string values ​​within the tag area.

[0934] According to the example above, the values ​​that can be arbitrarily modified among the HTML data include functions (teclear() in the example of this drawing), URL addresses (http: / analytics.hosting24.com / do.php in the example of this drawing), strings (web hosting in the example of this drawing), and variable names (weight in the example of this drawing), which may be data that can be modified by an attacker.

[0935] In the above example, the function, teclear(), is data that indicates that it is a function among HTML data (e.g.,<func> ), the URL address is data that indicates that it is a URL address among HTML data (e.g.,<http><url><ext : php> ) can be replaced with.

[0936] Also, in the above example, the string (e.g., web hosting) is data that indicates that it is a specific character string among HTML data (e.g.,<string> ), variable names (e.g., height, width) are data that indicates that they are variable names in HTML data (e.g.,<name> (etc.) can be converted or replaced.

[0937] In this way, when replaceable parts are replaced according to certain rules, such as oil, among HTML data, the converted tag information can be converted into vectorized data as information representing cyber threat information.

[0938]

[0939] Figure 57 illustrates a process of converting an HTML document exemplified above by processing a portion that may include cyber threat information, excluding HTML grammar, according to an embodiment.

[0940] According to an embodiment, HTML data according to URL information can be analyzed according to tag area or tag data according to tag structure information.

[0941] In this example, when the HTML data of a specific web page is analyzed into tag areas or tag data according to tag structure information, each tag data is located in the left column.

[0942] In this example, each tag data (6110) is<body> ,<image> ,<iframe> , , <script>나 < / script>can be divided into

[0943] Data corresponding to each tag data in an HTML document is processed according to certain rules as shown above, and is shown here in each preprocessing section (6120).

[0944] For example, the data of the body part is processed as follows according to the conversion rules.

[0945] onload=”<func> ();”

[0946] Background=”<name> .gif”

[0947] Link=”<hex> "

[0948] Text=”<hex> "

[0949] Link=”<hex> "

[0950] As in the example disclosed above, the function included in the tag area of ​​HTML data is<func> (), the name of the image is<name> , the hexadecimal code contained in the link or text<hex> can be converted to

[0951] And the string is<string> , the URL address is<http><url> Convert each to and the variable name is<name> It is converted to . In this way, parts other than those that are absolutely necessary for HTML grammar can be changed according to a certain format or principle, and the rules for conversion here can be easily changed by those skilled in the art.

[0952] Data in the preprocessing section (6120) is converted into normalized data of a certain length, and the normalized data can be converted into a fuzzy hash value.

[0953] In the example of this drawing, the fuzzy hash section (6130) represents the result of data of the preprocessing section (6120) processed according to certain rules being converted into a fuzzy hash value.

[0954] That is, among HTML data<body> The fuzzy hash value converted from the data in the preprocessing section (6120) processed from the data in the tag area is exemplified in the first row of the fuzzy hash section (6130).

[0955] Among HTML data<image> The fuzzy hash value converted from the data in the preprocessing section (6120) processed from the data in the tag area is exemplified in the second row of the fuzzy hash section (6130).

[0956] Also among HTML data<iframe> The fuzzy hash value converted from the data in the preprocessing section (6120) processed from the data in the tag area is exemplified in the third row of the fuzzy hash section (6130).

[0957] In this way, data processed from the tag area of ​​HTML data can be converted into hash values ​​applied to a fuzzy-based hash function after normalization.

[0958] As exemplified above, the extracted Hash value can be converted into N-gram data and converted into tag feature data (61400) using the frequency according to the M-byte pattern. Here, an example is disclosed in which the 2-gram technique is applied to the extracted Hash value and converted into tag feature data using the frequency according to the 2-byte pattern.

[0959] Hereinafter, data that can represent cyber threat information by converting each tag area according to tag structure information is referred to as tag feature data. In other words, tag feature data can be cyber threat feature information corresponding to tag units distinguished according to tag structure information.

[0960] Therefore, if a classification model is trained based on tag vector data, it is possible to determine whether it is malicious or not.

[0961]

[0962] Figure 58 is a diagram conceptually illustrating an example of a cyber threat information processing method according to an embodiment.

[0963] The embodiment can acquire web page data and process the web page data by separating the web page data according to tag structure information (6210) of the web page data. The web page data can be input as URL information or collected in the form of web crawling.

[0964] This example conceptually displays the results of analysis using tag structure information (6210) of input web page data when web page data is input. For convenience of explanation, the tag structure information (6210) is the same as the example disclosed above.

[0965] According to the tag structure information (6210), HTML data can be converted according to certain rules for each tag area or tag data, and the converted data can be normalized and converted into a hash value. In addition, the HTML data converted into the hash value can be converted into tag feature data, which is N-gram data.

[0966] This example illustrates the result of converting HTML data corresponding to the tag area among tag structure information (6210) into tag feature data (6220).

[0967] Tag feature data (6220) may include data related to an attack or its pattern data, excluding grammar essential to HTML. Accordingly, tag feature data (6220) may include data that can identify an attack identifier or an attack group among cyber threat information.

[0968] The embodiment can be used to learn with a tree-based classification model (6230) based on tag feature data (6220). For example, based on a prepared tag feature database (DB) (6240), a random forest learning algorithm using at least one decision tree (6245) can be applied to input tag feature data (6220) to classify whether the tag feature data (6220) is malicious.

[0969] The tag feature database (DB) (6240) stores data of tag areas included in HTML data as malicious or normal tag feature data according to malicious label information of the web page. In other words, data of tag areas within HTML that contain malicious activity are stored as malicious tag data in the database, and data of tag areas within normal HTML are stored as normal tag data in the database.

[0970] That is, based on the classification result of the tree-based classification model (6230) of the embodiment, it is possible to probabilistically determine whether tag feature data (6220) is malicious (6250). Here, an example is disclosed in which data in a tag area within an HTML document is determined to have a 98% probability of being malicious.

[0971] And if the tag characteristic data (6220) is malicious, the attack technique identifier and attacker group included in the tag characteristic data (6220) can also be identified.The example herein discloses an attack technique identifier called Blackhole and an attacker group Lazarus identified for tag feature data (6220).

[0972] Therefore, the embodiment can identify not only whether the HTML document itself contained in web page data is malicious, but also which tag area of ​​the HTML is malicious. Furthermore, rather than simply detecting or classifying HTML data as malicious based on machine learning, or determining maliciousness based on the frequency of a specific number of tags or the frequency of a specific character within the HTML, it can identify attack techniques and attack groups of specific tag data in HTML data, enabling accurate malicious detection and analysis.

[0973]

[0974] FIG. 59 is a drawing disclosing an example of a cyber threat information processing device included in a tag of a web page according to an embodiment.

[0975] Another embodiment of a cyber threat information processing device may include a server (2100) including a processor, a database (2200), and an intelligence platform (10000).

[0976] The database (2200) can store already classified malicious code or pattern code of malicious code.

[0977] The processor of the server (2100) can receive location information, such as link information of a web page, through an application programming interface (1100).

[0978] The receiving module (18801) of the framework (18000) can receive the web page data using the link information of the web page received through the API according to the instructions of the processor of the server (2100).

[0979] The analysis module (18803) can analyze the received web page data based on the link information of the web page to obtain tag structure information for the web page data. As an example of the tag structure information, the Document Object Model (Dom) Tree structure is exemplified.

[0980] The conversion module (18805) can convert data included in the tag area of ​​the web page data into tag feature data according to the tag structure information of the web page data. The conversion module (18805) can convert data in the part that can be modified by the user, in addition to the part regarding the essential structure that constitutes the web page, into tag feature data of the tag unit according to the tag structure information.

[0981] The learning module (18807) uses an AI engine (1230) to apply a classification model to tag feature data to obtain cyber threat information of data included in a tag area according to tag structure information.

[0982] The learning module (18807) classifies tag feature data into a classification model according to the algorithm of the AI ​​engine (1230) to identify attack techniques and attack groups for malicious actions in each tag section.

[0983] The learning module (18807) applies a classification model to feature data such as tag feature data, and examples thereof are disclosed in detail in FIGS. 27 to 30 and FIGS. 54 to 57.

[0984]

[0985] An intelligence platform that provides information on APT attacks in the manner described above can also provide a real-time intelligence line feed service.

[0986] More specifically, the intelligence platform can provide users with real-time processed cyber threat information through natural language processing. This allows users to access hourly, automatically collected and analyzed cyber threat information processed through the intelligence platform. Cyber ​​threat information can be provided on-demand, via an API, or as an alert via an application that sends messages or emails.

[0987] Specific examples are described below.

[0988]

[0989] Cybersecurity information often differs in the way it is presented and in the format in which it is presented, depending on the level of understanding and capabilities of cybersecurity experts.

[0990] Therefore, even though the detection capability of malware has increased as artificial intelligence analysis has increased, there is a problem that the effectiveness of this detection capability is very low if the detected malware is not properly explained and the information is not provided.

[0991] Because the identification and transmission of the same malware was not done accurately, the response of experts was sometimes inaccurate, and it was even more difficult to accurately convey and explain it to the general public.

[0992] The standardized model MITRE ATT&CK can alleviate these difficulties to some extent, but below are examples of cyber threat intelligence that can be easily and efficiently used by both the general public and cybersecurity managers to detect and respond to malware.

[0993] In particular, the following discloses embodiments that can maximize the effectiveness of cyber threat intelligence disclosed in conjunction with a natural language model (NLP) or a large language model (LLM).

[0994]

[0995] Figure 60 discloses an embodiment linking cyber threat intelligence and an artificial intelligence-based natural language model.

[0996] The disclosed embodiment includes an intelligence platform (10000), a physical device (2000) which is a computing device, and a natural language model (30000).

[0997] The intelligence platform (10000) includes an application programming interface (API) (1100) that receives various requests for cyber threat information from client A (1010) and a framework (1200) that processes cyber threat information.

[0998] The framework (1200) includes several modules (1211, 1213, 1215, 1217, ..., 1219) that process cyber threat information based on a physical device (2000) and an AI engine (1230). Various examples of this have been disclosed above.

[0999] For example, client A (1010) may request or inquire about the intelligence platform (10000) to determine whether executable files such as EXE, ELF, PE, APK, and document files, script files, emails, or non-executable files that may contain executable files are malicious, or may inquire about cyber threat information related to the files.

[1000] The application programming interface (API) (1100) receives files or cyber threat information requested by client A (1010).The framework (1200) provides users with received files or analyzed or predicted cyber threat information (CTI) using modules (1211, 1213, 1215, ...) that perform various analyses such as static analysis, dynamic analysis, and in-depth analysis, and an AI engine (1230).

[1001] The physical device (2000) includes an on-premise or cloud server (2100) including a processor and a database (2200) storing various types of data related to cyber threat information.

[1002] The server (2100) can perform processes of modules (1211, 1213, 1215, ...) within the framework (1200) using a processor, or collect various cyber threat information data on the Internet through crawling.

[1003] The database (2200) can store analyzed or collected cyber threat information, or store cyber threat information based on MITRE ATT&CK.

[1004] Meanwhile, the artificial intelligence-based natural language model (30000) can directly receive a query (hereinafter simply referred to as a CTI query) regarding a file or cyber threat information requested by a client or receive it through the intelligence platform (10000). The artificial intelligence-based natural language model (30000) can provide a natural language explanation of the data related to the requested file or cyber threat information as a response to the CTI query.

[1005] In this drawing, the query module (1217) of the intelligence platform (10000) can create, convert, or provide a file or cyber threat information requested by a client into a query that can be processed by a natural language model (30000).

[1006] The artificial intelligence-based natural language model (30000) may be a simple language model (LM) or a large-scale language model (LLM). Furthermore, the artificial intelligence-based natural language model (30000) may be included in the intelligence platform (10000), or may be a separate model not included in the intelligence platform (10000), but may exchange data with each other to jointly process cyber threat information or provide descriptive information for queries regarding cyber threat information.

[1007] The disclosed intelligence platform (10000) can be implemented by at least one processor within a server (2100). Since the intelligence platform (10000) can be implemented using a miniaturized computing device or software, it is not limited to a specific location and can even be incorporated into a space vehicle such as a satellite. For example, the data or files received by a satellite or space vehicle can be processed to determine if there is any cyber threat information, and the results can be provided according to the following embodiments.

[1008] Conversely, an intelligence platform (10000) may be used to initiate responses to files or CTI queries received from space vehicles such as satellites.

[1009] Below, examples are disclosed in which an intelligence platform (10000) and an artificial intelligence-based natural language model (30000) are linked to process cyber threat information requested by a user and provide explanatory information thereon.

[1010]

[1011] Figure 61 discloses an embodiment in which an intelligence platform including a natural language model provides cyber threat information (CTI) in natural language.

[1012] In this example, the AI ​​engine (1230) of the intelligence platform (10000) may include a natural language model (30000).

[1013] The client (1010) can inquire about cyber threat information (CTI) related to the file, whether the input data is an executable file or a non-executable file, or transmit a related CTI query to the intelligence platform (10000).

[1014] Here, the cyber threat information (CTI) or CTI query inquired by the user may include, for example, whether it is malicious, the hash value of the file, assembly code or function information included in the assembly code, and other information related to the file.

[1015] The intelligence platform (10000) can receive transmitted executable or non-executable files and analyze the executable or non-executable files in the modules of the framework (1200). Examples of the modules of the framework (1200) performing malicious behavior analysis on executable files, non-executable files, or collected web data are disclosed above. Here, the various analysis modules exemplified above are indicated as an arbitrary Nth module (1217).

[1016] Meanwhile, the query module (1217) of the framework (1200) transmits cyber threat information (CTI) or queries related to the file submitted by the client (1010) to the AI ​​engine (1230) including a natural language model.

[1017] The Nth module (1217) can transmit analysis information of files related to cyber threat information (CTI) or CTI queries inquired by the user to the query module (1217). For example, the Nth module (1217) can transmit information on whether the analyzed file is malicious, an attack behavior, an attack technique, an attack group, or an attack campaign in which multiple attack behaviors are linked to the query module (1217).

[1018] The query module (1217) transmits cyber threat information (CTI) or queries submitted by a user to the AI ​​engine (1230), or generates a CTI supplementary query based on information analyzed by the N module (1217) in relation to the user CTI query and transmits the query to the AI ​​engine (1230).

[1019] For example, a CTI supplementary query may be or contain keywords, analysis values, or analysis values ​​of analyzed cyber threat intelligence (CTI). For example, a CTI query may be or contain values ​​or identifiers such as hash values, MITRE & ATT&CK attack IDs, identifiers for attack groups, or attack techniques associated with an attack campaign.

[1020] Then, the natural language model of the AI ​​engine (1230) can generate a natural language answer to a user CTI query or CTI supplementary query based on various cyber threat information (CTI) analyzed by the N module (1217).

[1021] The intelligence platform (10000) provides a response to a CTI query by providing the user with a natural language response generated by the natural language model of the AI ​​engine (1230) together with the CTI analysis information generated by the framework (1200). The response to the CTI query includes a natural language explanation of the cyber threat information (CTI) the user inquired about in relation to the file, such as whether it is malicious, an attack behavior, an attack technique, an attack group, or an attack campaign in which multiple attack behaviors are linked. In addition, for inquiries about binary files such as assembly code or functions included in the file, explanatory information may be provided as to whether it is related to maliciousness based on the results analyzed by the intelligence platform (10000).

[1022] The framework (1200) of the intelligence platform (10000) provides various analysis information on files or information that has been previously analyzed and stored in a database (2200), and can generate or suggest to the user various CTI supplementary queries related to the user's CTI query.

[1023] In addition, the AI ​​engine (1230) of the intelligence platform (10000) generates natural language explanations for user CTI queries and CTI supplementary queries based on analyzed or stored cyber threat information, and provides CTI-related natural language answers to the user.

[1024] Since the intelligence platform (10000) analyzes or provides previously analyzed information in natural language in response to a user CTI query, according to the embodiment, even if the user is a non-expert, easy and accurate information transmission and response to cyber threat information are possible.

[1025]

[1026] Figure 62 discloses another embodiment in which the disclosed intelligence platform provides cyber threat information (CTI) in natural language using a natural language model.

[1027] An example of providing a simple natural language explanation of real-time line feed or CTI information using an artificial intelligence-based model (e.g., AI engine) provided within the intelligence platform (10000) disclosed above is disclosed.

[1028] An embodiment of this drawing discloses an example in which the disclosed intelligence platform (10000) analyzes cyber threat information (CTI) and provides explanatory information thereof in conjunction with a large-scale natural language model (30000).

[1029] This example is similar to the example disclosed above, except that the artificial intelligence-based model (e.g., AI engine) within the intelligence platform (10000) is replaced with a large-scale natural language model (30000).

[1030] When the intelligence platform (10000) receives a user's cyber threat information (CTI) or CTI query, the query module (1217) can transmit it to a large-scale natural language model (30000).

[1031] The query module (1217) of the intelligence platform (10000) can generate a CTI query corresponding to the cyber threat information (CTI) submitted by a user based on the cyber threat information (CTI) analyzed by the N module (1219) or previously analyzed and stored in the database (2200) or the CTI information, or generate a CTI supplementary query and transmit it to the large-scale natural language model (30000).

[1032] A large-scale natural language model (30000) can receive a CTI query or a CTI supplementary query from a query module (1217) and generate a natural language explanation as an answer to the CTI query. In addition, the large-scale natural language model (30000) can receive at least one of a CTI query and CTI analysis information generated in a framework (1200) of an intelligence platform (10000) from a query module (1217) and generate a natural language explanation as part of an answer to a cyber threat information (CTI) or CTI query inquired by a user based on the CTI analysis information.

[1033] The large-scale natural language model (30000) transmits the generated natural language explanation to the intelligence platform (10000), and the intelligence platform (10000) can provide the natural language explanation, which is the CTI query answer transmitted by the large-scale natural language model (30000), to the user as part of the answer.

[1034] The response to a CTI query includes a natural language description of the cyber threat information (CTI) the user inquired about regarding the file, such as whether it is malicious, the attack behavior, the attack technique, the attack group, or an attack campaign in which multiple attack behaviors are linked. In addition, the large-scale natural language model (30000) can generate explanatory information regarding whether a binary file, such as an assembly code, or the functions contained in the file is related to maliciousness based on the results analyzed by the intelligence platform (10000).

[1035] An example of a large-scale natural language model (30000) generating natural language explanations as answers to CTI queries is as follows.

[1036] A large-scale natural language model (30000) may include a CTI query language processing unit (30100), a CTI query interpretation unit (30200), and a CTI query answer generation unit (30300).

[1037] The CTI query language processing unit (30100) can analyze a user query for knowledge extraction using semantic and syntax analysis techniques included in the CTI query. For example, it can perform tasks such as part-of-speech analysis, named entity analysis, dependency analysis, semantic recognition, and ellipsis recovery included in the user CTI query. For example, dependency analysis can analyze the dependency relationship between words according to the sentence structure of the user CTI query, and semantic recognition can recognize the semantic relationship between words included in the user CTI query.

[1038] The CTI query interpretation unit (30200) can analyze questions included in a CTI query to determine the user's intention and recognize various information about answers that should be presented as output of the intelligent question-answering system.For example, the CTI query interpretation unit (30200) can perform the function of distinguishing questions based on the sentence structure and meaning of the CTI query and recognizing sub-question types and relationships between sub-questions.

[1039] The CTI query answer generation unit (30300) can infer answers to CTI queries and determine and generate the best answer. The CTI query answer generation unit (30300) generates candidate answers, and can generate all possible answer candidates from structured or unstructured resources based on CTI questions and question classification information. Although not shown in the drawing, the structured or unstructured resources used by the CTI query answer generation unit (30300) may be cyber threat information (CTI) that has been analyzed and stored in the database (2200). For example, the structured or unstructured resources may include information on whether an analyzed file is malicious, an attack behavior, an attack technique, an attack group, or an attack campaign in which multiple attack behaviors are linked.

[1040] In addition, the structured or unstructured resource may be the result of analysis of assembly code, binary format file, function included in the file, or CFG instruction sequence analyzed by the framework (1200) of the intelligence platform (10000).

[1041] The CTI question-answer generation unit (30300) can generate candidate answers for evidence collection targets from structured or unstructured resources including cyber threat information (CTI) analyzed and stored in a database (2200).

[1042] And the CTI question and answer generation unit (30300) can generate a CTI question and answer by inferring an answer based on evidence including cyber threat information (CTI) analyzed and stored in the database (2200) and adding the best answer as an explanation.

[1043] Although not shown here, if the large-scale natural language model (30000) is in the form of a platform with a separate user interface, it may receive CTI-related inquiries or CTI questions from users separately from the intelligence platform (10000). In such a case, the large-scale natural language model (30000) may receive previously analyzed cyber threat information (CTI) stored in the database (2200) of the intelligence platform (10000) or cyber threat information (CTI) directly analyzed from the intelligence platform (10000).

[1044] And the large-scale natural language model (30000) can infer the above answer based on the cyber threat information (CTI) provided by the intelligence platform (10000), generate a CTI query answer, and provide the user with natural language explanation information for the CTI query.

[1045] Below, an example of providing the cyber threat information (CTI) outlined above in natural language is described in detail.

[1046]

[1047] Figure 63 discloses another embodiment in which the disclosed intelligence platform provides cyber threat information (CTI) in natural language using a natural language model.

[1048] The application programming interface (API) (1100) of the intelligence platform can receive a request for analysis of a file, cyber threat information (CTI) related to a file, or a query related to CTI from a client (1010).

[1049] The framework (1100) of the application programming interface (API) (1100) may include multiple analysis modules or prediction modules.For example, the framework (1100) described above can perform static analysis, dynamic analysis, in-depth analysis, mild-dynamic analysis, etc. based on an input file using an AI engine. Here, any module that performs such analysis or prediction is indicated as the Nth module (1219).

[1050] When the framework (1100) receives a file from the client (1010), it can obtain binary data at the assembly level through disassembly. Based on this, the framework (1100) can perform analysis of functions related to whether or not they are malicious, analysis of attack behavior or attack techniques, and analysis of attack groups (see FIGS. 1 to 16), and analysis of the CFG instruction sequence of functions (see FIGS. 17 to 29).

[1051] If the input file is a non-executable file such as a document file, the framework (1100) can analyze whether the file is malicious, the attack behavior or attack technique, and the attack group (see FIGS. 30 to 46).

[1052] The server (2100), whether an on-premise server or a cloud server, performs crawling to collect web pages on the Internet, and the framework (1100) can perform analysis of whether the collected web pages are malicious, attack behavior or attack techniques, and attack groups (see FIGS. 47 to 59).

[1053] The database (2200) can classify and store the results of analysis by the framework (1100) of the intelligence platform, for example, functions of assembly codes generated in the process of analyzing files, whether the functions are malicious, hash codes, CFG instruction sequences, static analysis, dynamic analysis, mild-dynamic analysis, and predictive analysis results, whether partial tags of web pages are malicious, attack techniques corresponding to MITRE ATT&CK, information on attack behavior and attack groups, attack campaigns related to files, attack countries, and attack industries.

[1054] Meanwhile, when a client (1010) makes a CTI natural language query along with a request for analysis of cyber threat information (CTI) for a specific file, web page, etc., the query module (1217) of the framework (1100) transmits the CTI natural language query to an artificial intelligence-based natural language processing model (30000). The natural language processing model (30000) may be a natural language model (NLP) or a large language model (LLM).

[1055] A client (1010) may request CTI analysis or prediction related to a file, or may request a general natural language CTI query unrelated to the file. Accordingly, the query module (1217) generates a CTI query or supplementary query based on the cyber threat information (CTI) analyzed by the framework (1100) and transmits it to the natural language processing model (30000).

[1056] If a client (1010) requests a CTI query unrelated to a file, the query module (1217) transmits the CTI query to the natural language processing model (30000).

[1057] The CTI query language processing unit (30100) can analyze a CTI query using the syntax analysis technology included in the CTI query. An example of the CTI query language processing unit (30100) is illustrated above.

[1058] The CTI query processed in the CTI query language processing unit (30100) is transmitted to the CTI query interpretation unit (30200).

[1059] The CTI query interpretation unit (30200) can perform the function of distinguishing questions based on the sentence structure and meaning of the CTI query processed by the CTI query language processing unit (30100) and recognizing sub-question types and relationships between sub-questions.

[1060]

[1061] The CTI query interpretation unit (30200) may include a CTI query decomposition unit (30210) and a CTI query analysis unit (30220).

[1062] The CTI query decomposition unit (30210) can perform the function of classifying questions based on the sentence structure and meaning included in the CTI query, classifying sub-question types, and recognizing relationships between classified sub-questions.

[1063] The CTI query analysis unit (30220) can classify the types of distinct sub-questions. Furthermore, the CTI query analysis unit (30220) can recognize the core of a question based on the reliability of words or phrases that can be replaced by candidate answers, based on the classified types of sub-questions.

[1064] If the CTI query analysis unit (30220) has a reliability that cannot recognize the core of the question, the CTI query decomposition unit (30210) can be made to reclassify the sub-question types.

[1065] By repeating the processing of the CTI query decomposition unit (30210) and the CTI query analysis unit (30220), the CTI query analysis unit (30220) can detect and confirm the subject of a CTI-related question.

[1066] The CTI question and answer generation unit (30300) can generate all possible answer candidates from structured or unstructured resources based on CTI question and question classification information. The CTI question and answer generation unit (30300) may include a CTI answer candidate group generation unit (30310), a CTI answer verification unit (30320), and a CTI answer provision unit (30330).

[1067] The CTI answer candidate generation unit (30310) can perform index and search functions from a database containing cyber threat information (CTI) and generate candidate answers based on the search results.The CTI answer candidate generation unit (30310) generates all possible answer candidates from a database containing cyber threat information (CTI) based on question and question classification information. The database containing CTI includes the intelligence platform database (2200). The CTI answer candidate generation unit (30310) can also collect evidence for answer candidates from the database containing CTI. This will be described further below.

[1068] The CTI answer verification unit (30320) performs the functions of the answer inference and generation module and can determine and generate the best answer. The CTI answer verification unit (30320) measures the reliability of answer candidates based on filtered answer candidates and inferred answer candidates, thereby determining the ranking of answer candidates.

[1069] The CTI answer verification unit (30320) can filter answer candidates using inductive, deductive, or abductive reasoning based on the similarity between a query and answer candidates. Furthermore, the CTI answer verification unit (30320) can compare the reliability ratios of answer candidates with a threshold value to reorder the answer candidates, thereby selecting the optimal CTI answer.

[1070] The CTI answer provision study (30330) transmits the CTI answer verified by the CTI answer verification department (30320) to the intelligence platform to provide natural language explanation information for the CTI question answer.

[1071] When a client (1010) queries cyber threat information (CTI) together with or separately from a request for cyber threat information (CTI) related to a file, the intelligence platform can provide information about information related to the CTI file (whether malicious, hash value, attack technique, attack group, attack campaign, etc.), its natural language description, and evidence collected as the basis therefor.

[1072] For example, if a client (1010) makes a query related to the analysis request result of a specific file, the information regarding which MITRE ATT&CK attack technique by which attack group the malicious activity caused by the file is, and which attack campaign (a series of mechanisms of one or more attacks) it is connected to can be provided as visualization information as exemplified above. In addition, the intelligence platform can provide a natural language explanation generated by a natural language model along with the visualization information, and can provide valid digital analysis evidence for the analysis result and natural language explanation analysis evidence for the digital analysis evidence.

[1073] When a client (1010) queries cyber threat information (CTI) unrelated to a file, an answer to the CTI query, a natural language explanation of the CTI query generated by the natural language model, and evidence collected as a basis for the same can be provided.

[1074] The intelligence platform can provide the client (1010) with natural language answers or explanations for questions about cyber threat information (CTI) analyzed or predicted by the framework (1100) and the cyber threat information (CTI) provided by the language processing model (30000).

[1075] A physical device (2000), which is a computing device providing an intelligence platform, may include a server (2100) including a database (2200) and a processor.

[1076] The processor may receive a request for cyber threat information (CTI) analysis on data related to a file from a client, analyze the requested cyber threat information (CTI), and transmit a first cyber threat information (CTI) query generated based on the analyzed cyber threat information (CTI) to a natural language model.

[1077] And the processor can provide the analyzed cyber threat information (CTI) and the description information of the analyzed cyber threat information (CTI) generated by the natural language model.

[1078] When the processor of the server receives a second cyber threat information (CTI) query from a client, the processor may transmit the second cyber threat information (CTI) query to a natural language model and provide explanatory information for the cyber threat information (CTI) query generated by the natural language model.

[1079] The operations performed by the above physical devices may also be executed by a program that implements the embodiments in software.

[1080]

[1081] Figure 64 illustrates an example of a flowchart in which the disclosed intelligence platform provides cyber threat information (CTI) in natural language using a natural language model.

[1082] A request for cyber threat information (CTI) analysis or a cyber threat information (CTI) query for data related to a file may be received (S87100).

[1083] Data associated with a file may include the document or a script contained in the document, an executable or non-executable file, assembly code into which the file is converted, or function information within that code.

[1084] CTI's information analysis request may include a request for information on whether data contained within a file is malicious, an attack technique and attack group based on the data, and an attack campaign, or a request for visualization information of the information.

[1085] It is also possible to receive only Cyber ​​Threat Intelligence (CTI) queries from clients without inputting a Cyber ​​Threat Intelligence (CTI) file.

[1086] The requested cyber threat information (CTI) can be analyzed, and a CTI query generated based on the analyzed CTI information or the received CTI query can be transmitted to a natural language model (S87200).

[1087] The cyber threat information (CTI) analyzed here includes whether the document or the script contained in the document, the executable or non-executable file, the assembly code into which the file is converted, or the function information or CFG instruction sequence within the code is malicious, a hash value indicating whether it is malicious, an attack technique, an attack group, an attack campaign, an attack country, or an attack industry. The analyzed cyber threat information (CTI) includes visualization information of the above analysis information.

[1088] When analyzing cyber threat information (CTI) requested by a client, the intelligence platform can generate a CTI query based on the analyzed CTI and provide it to the natural language model. If the client requests a CTI query unrelated to a file, the intelligence platform can provide the CTI query requested by the client to the natural language model.

[1089] The above-mentioned analyzed cyber threat information (CTI) and the explanation information of the analyzed cyber threat information (CTI) generated by the natural language model, or the explanation information of the CTI query generated by the natural language model, may be provided (S87300). The explanation information of the analyzed cyber threat information (CTI) refers to a natural language explanation of the analyzed cyber threat information (CTI). A detailed explanation thereof is exemplified in detail below.

[1090]

[1091] Figure 65 illustrates another example of an intelligence platform that provides cyber threat information (CTI) in natural language using a natural language model.

[1092] The application programming interface (API) (1100) of the intelligence platform can receive a request for analysis of a file, cyber threat information (CTI) related to a file, or a query related to CTI from a client (1010).

[1093] The functions of the modules within the framework (1100) of the application programming interface (API) (1100) and the crawling function of the server (2100) are as described above.

[1094] The database (2200) can classify and store the results of analysis by the framework (1100) of the intelligence platform, for example, functions of assembly codes generated in the process of analyzing files, whether the functions are malicious, hash codes, CFG instruction sequences, static analysis, dynamic analysis, mild-dynamic analysis, and predictive analysis results, whether partial tags of web pages are malicious, attack techniques corresponding to MITRE ATT&CK, information on attack behavior and attack groups, attack campaigns related to files, attack countries, and attack industries.

[1095] Meanwhile, when a client (1010) makes a CTI natural language query along with a request for analysis of cyber threat information (CTI), the query module (1217) of the framework (1100) transmits the CTI natural language query to an artificial intelligence-based natural language processing model (30000). The natural language processing model (30000) may be a natural language model (NLP) or a large language model (LLM).

[1096] A client (1010) may request CTI analysis or prediction related to a file, or may request a general natural language CTI query unrelated to the file.Accordingly, the query module (1217) generates a CTI query or supplementary query based on the cyber threat information (CTI) analyzed by the framework (1100) and transmits it to the natural language processing model (30000).

[1097] If a client (1010) requests a CTI query unrelated to a file, the query module (1217) transmits the CTI query to the natural language processing model (30000).

[1098] The CTI query language processing unit (30100) can analyze a CTI query using the syntax analysis technology included in the CTI query.

[1099] The example of the CTI query analysis unit (30220) detecting and confirming the subject of a CTI-related question through the repeated processing of the CTI query decomposition unit (30210) and the CTI query analysis unit (30220) is exemplified above.

[1100] The CTI question and answer generation unit (30300) can generate all possible answer candidates from structured or unstructured resources based on CTI question and question classification information. The CTI question and answer generation unit (30300) may include a CTI answer candidate group generation unit (30310), a CTI answer verification unit (30320), and a CTI answer provision unit (30330).

[1101] The CTI answer candidate generation unit (30310) can perform indexing and search functions on a database containing cyber threat information (CTI) and generate candidate answers based on the search results. The CTI answer candidate generation unit (30310) generates all possible answer candidates from the database containing cyber threat information (CTI) based on questions and question classification information.

[1102] Here, the database containing cyber threat information (CTI) includes the database (2200) of the intelligence platform.

[1103] The CTI answer candidate generation unit (30310) can also collect evidence on answer candidates from a database (2200) where cyber threat information (CTI) is stored.

[1104] The CTI answer candidate generation unit (30310) performs indexing and search functions for multiple document files. The CTI answer candidate generation unit (30310) generates candidate answers from an input query using search results from multiple knowledge databases, including the database (2200).

[1105] The CTI answer candidate generation unit (30310) generates all possible answer candidates from various resources including the database (2200) based on the question and question classification information. Then, the CTI answer candidate generation unit (30310) selects candidate answers using deductive or inductive evidence of the answer type and / or self-evident principles that can restrict the answers based on the evidence collected from the resources. That is, the CTI answer candidate generation unit (30310) can collect evidence for answers from the resources including the database (2200) and verify self-evident principles for the context to verify the answer candidates and generate answers. In this way, the CTI answer candidate generation unit (30310) can search for answers to CTI queries in the database (2200) and collect digital evidence or grounds for CTI query answers.

[1106] Since the database (2200) classifies and stores already analyzed cyber threat information (CTI), when the CTI answer candidate group generation unit (30310) generates a group of answer candidates, it can provide search data for generating the group of candidates. In addition, when the CTI answer candidate group generation unit (30310) selects an answer candidate from the group of answer candidates, the database (2200) can provide evidence or basis for the answer candidate based on the stored cyber threat information (CTI).

[1107] The CTI Answer Verification Unit (30320) performs the functions of the Answer Inference and Generation Module and can determine and generate the best answer. The CTI Answer Verification Unit (30320) measures the reliability of the answer candidates based on the filtered answer candidates and the inferred answer candidates and determines the ranking of the answer candidates.

[1108] The CTI answer verification unit (30320) can filter answer candidates using inductive, deductive, or abductive reasoning based on the similarity between a query and answer candidates. Furthermore, the CTI answer verification unit (30320) can compare the reliability ratios of answer candidates with a threshold value to reorder the answer candidates, thereby selecting the optimal CTI answer.

[1109] The CTI answer provision study (30330) transmits the CTI answer verified by the CTI answer verification department (30320) to the intelligence platform to provide natural language explanation information for the CTI question answer.

[1110] Examples of the intelligence platform providing natural language explanation information for requested CTI analysis results and CTI query answers, or providing natural language explanation information for CTI queries, are disclosed above.

[1111] A physical device (2000), which is a computing device providing an intelligence platform, may include a server (2100) including a database (2200) and a processor.

[1112] The processor may receive a request for cyber threat intelligence (CTI) analysis on data related to a file.

[1113] The processor can analyze the requested cyber threat information (CTI) and search for a candidate set of answers to a CTI query generated based on the analyzed cyber threat information (CTI) from the cyber threat information (CTI) database.

[1114] Based on the searched results, the processor can determine a candidate group for the answer, and provide a natural language explanation for the 1st cyber threat information (CTI) query based on the first candidate (optimal candidate) among the determined candidate groups.

[1115] When the processor receives a second cyber threat information (CTI) query from a client, it may search for a candidate set of answers to the cyber threat information (CTI) query from the cyber threat information (CTI) database. In addition, the processor may provide descriptive information for the cyber threat information (CTI) query generated by the natural language model.

[1116] The operations performed by the above physical devices may also be executed by a program that implements the embodiments in software.

[1117]

[1118] Figure 66 illustrates an example of a flowchart in which the disclosed intelligence platform provides cyber threat information (CTI) in natural language using a natural language model.

[1119] A request for cyber threat information (CTI) analysis or CTI query for data related to a file may be received (S88100).

[1120] Data associated with a file may include a document or a script contained in the document, an executable or non-executable file, assembly code into which the file is converted, or function information within that code.

[1121] CTI's information analysis request may include a request for information on whether data contained within a file is malicious, an attack technique and attack group based on the data, and an attack campaign, or a request for visualization information of the information.

[1122] It is also possible to receive only CTI-related queries separately from the client, regardless of the CTI file input.

[1123] The requested cyber threat information (CTI) is analyzed, and a CTI query generated based on the analyzed CTI information, or a candidate group of answers to the received CTI query is searched from the CTI database (S88200).

[1124] Evidence on answer candidates can also be collected from a database (2200) where cyber threat information (CTI) is stored.

[1125] In this case, indexing and search functions are performed on multiple document files. Candidate answers are generated from input queries using search results from multiple knowledge databases, including the database of the disclosed intelligence platform.

[1126] Based on the question and question classification information, all possible answer candidates are generated from various resources, including the intelligence platform database. Then, based on the evidence collected from the aforementioned resources, the candidate answers are selected using deductive or inductive evidence of the answer type and / or self-evident truths that can constrain the answers. Answers can be generated by collecting evidence for the answers from resources, including the intelligence platform database, and verifying self-evident truths about the context to verify the answer candidates.

[1127] The Intelligence Platform database classifies and stores previously analyzed cyber threat information (CTI). Therefore, when generating a set of possible answers, search data from the Intelligence Platform database can be used to generate those candidates.

[1128] Therefore, it is possible to provide evidence or basis for the answer candidate based on the stored cyber threat information (CTI) in the database of the intelligence platform.

[1129] Based on the search results, a candidate set of answers is determined (S88300). A detailed example of determining CTI answer candidates is disclosed above.

[1130] A natural language explanation for the CTI query based on the optimal candidate among the above-determined candidate groups is provided (S88400).

[1131] When providing a natural language description of the CTI query, CTI analysis information of the requested file may also be provided. An example of providing the CTI analysis results of a file when a client requests a cyber threat information (CTI) analysis of the file is disclosed above.

[1132] For example, the analyzed cyber threat information (CTI) may include at least one of: whether a document or a script included in the document, an executable or non-executable file, an assembly code converted into a file or function information within the code, or a hash value indicating whether the document is malicious based on the CFG instruction sequence; an attack technique; an attack group; an attack campaign; an attack country; or an attack industry. In addition, the analyzed cyber threat information (CTI) may include visualization information of the included CTI analysis information.

[1133] When providing a natural language description of the above CTI query, evidence retrieved from the CTI database may also be provided. If the CTI database is an external resource, nearby sources, such as links to external resources, may also be provided.

[1134]

[1135] The YARA generation technique is a rule generation method for existing malware detection. It can identify simple malware and includes rules for classifying malware as either normal or malicious. However, the existing YARA generation technique lacks criteria (rules) for profiling attack techniques, attack groups, and threat types.

[1136] To solve this problem, the present invention proposes an automatic rule generation method for profiling various attack information such as attack techniques, attack groups, and threat types.

[1137] In particular, the present invention discloses a cyber threat information processing device and method that enables profiling of attack information using a ViT (Vision Transformer) model.

[1138] Here, the ViT model is one of the deep learning models for image processing, and corresponds to the latest artificial intelligence model utilizing the Transformer model, which was primarily used in natural language processing (NLP) in the past. By applying the Transformer structure to image processing, the ViT model is an effective model for learning not only local characteristics of an image but also characteristics across the entire image.

[1139] The way the ViT model processes images is as follows.

[1140] (1) The image is divided into several small patches. Each patch represents a part of the image, and these patches can be considered as independent groups of pixels.

[1141] (2) Each patch is expanded into a one-dimensional vector, and each patch is represented as a pixel sequence in vector form.

[1142] (3) Add position information to the one-dimensional vector. Here, the position information corresponds to information indicating where each patch is located in the original image. This information can be added in the form of a position embedding.

[1143] (4) The patch vector with added position embedding is input to the ViT model.

[1144] (5) The ViT model can learn the relationship between input patches and extract information necessary for performing image classification or other image-related tasks.

[1145] Hereinafter, an embodiment of a cyber threat information providing device and method of the present invention that provides cyber threat information to a client using a ViT model will be described.

[1146]

[1147] Figure 67 discloses an embodiment linking cyber threat intelligence and the ViT model.

[1148] In one embodiment, it may include an intelligence platform (10000), a physical device (2000) which is a computing device, and a ViT model (40000).

[1149] The intelligence platform (10000) includes an application programming interface (API) (1100) that receives various requests for cyber threat information from client A (1010) and a framework (1200) that processes cyber threat information.

[1150] The framework (1200) includes several modules (1211, 1213, 1215, 1217, ..., 1219) that process cyber threat information based on a physical device (2000) and an AI engine (1230). Various examples of this have been disclosed above.

[1151] For example, client A (1010) may request or inquire about the intelligence platform (10000) to determine whether executable files such as EXE, ELF, PE, APK, and document files, script files, emails, or non-executable files that may include executable files are malicious, or may inquire about cyber threat information related to the files.

[1152] The application programming interface (API) (1100) receives files or cyber threat information requested by client A (1010). The framework (1200) uses modules (1211, 1213, 1215, ...) that perform various analyses such as static analysis, dynamic analysis, and in-depth analysis, and an AI engine (1230) to provide the user with the received files or analyzed or predicted cyber threat information (CTI).

[1153] The physical device (2000) includes an on-premise or cloud server (2100) including a processor and a database (2200) storing various types of data related to cyber threat information.

[1154] The server (2100) can use a processor to perform processes of modules (1211, 1213, 1215, ...) within the framework (1200), or collect various cyber threat information data on the Internet through crawling.

[1155] The database (2200) can store analyzed or collected cyber threat information, or store cyber threat information based on MITRE ATT&CK.

[1156] The ViT model (40000) can receive files requested by the client through the intelligence platform (10000).In this regard, the ViT model (40000) can provide the intelligence platform (10000) with attention characteristics for the file inquired by the client.

[1157] In this drawing, the DRP (Deep Rule Profiler) module (a) of the intelligence platform (10000) can create, convert, or provide a file or cyber threat information requested by a client into a patch that can be processed by the ViT model (40000).

[1158] In addition, the DRP module (1221) of the intelligence platform (10000) can generate an attention feature rule by receiving the attention feature as a result of processing by the ViT model (40000). Thereafter, the intelligence platform (10000) can detect and classify malicious codes more precisely than existing rule generation methods by using the attention feature rule generated by the DRP module (1221). This will be described in detail in the drawings below.

[1159] The ViT model (40000) may be included in the intelligence platform (10000), or may be a separate model that is not included in the intelligence platform (10000), but may transmit and receive data to each other to jointly process cyber threat information or provide cyber threat information.

[1160] Below, examples of processing cyber threat information requested by a user through linkage between an intelligence platform (10000) and a ViT model (40000) are disclosed.

[1161]

[1162] Figure 68 discloses an embodiment of an intelligence platform including a ViT model processing cyber threat information.

[1163] In one embodiment, the AI ​​engine (1230) of the intelligence platform (10000) may include a ViT model (40000).The client (1010) can provide input data (including executable and non-executable files) to the intelligence platform (10000) and receive cyber threat information from the intelligence platform (10000).

[1164] To this end, the intelligence platform (10000) can perform profiling on various attack information (including attack group information, attack technique information, and threat type information) by utilizing the attention feature rule generated through the DRP module (1221).

[1165] The intelligence platform (10000) can receive files and analyze them in the modules of the framework (1200). An example of the modules of the framework (1200) performing malicious behavior analysis on files or collected web data is as described above.

[1166] More specifically, the intelligence platform (10000) can disassemble an executable file and identify functions (feature information) included in the executable file through the embodiments of FIGS. 17 to 29. In addition, the intelligence platform (10000) can extract feature information from a non-executable file through the embodiments of FIGS. 30 to 46. In addition, the intelligence platform (10000) can extract feature information from web page data through the embodiments of FIGS. 47 to 53. In this drawing, several analysis modules that perform the above-described embodiments can be represented as the Nth module (1219).

[1167] The N module (1219) can transmit the analyzed information to the DRP module (1221). For example, when a malicious code executable file is received through the intelligence platform (10000), the malicious code executable file can be disassembled through the N module (1219) and transmitted to the DRP module (1221).

[1168] The DRP module (1221) can directly disassemble a malicious code executable file or receive disassembled information through the N module (1219). That is, the DRP module (1221) can extract characteristic information of the file. Here, the characteristic information can include an OP-CODE and an API function name sequence. This is as described above.

[1169] The DRP module (1221) can visualize the malware executable file as an image (Malware image) based on the extracted feature information and pass it to the ViT model. This will be described in detail later.

[1170] Afterwards, the ViT model of the AI ​​engine (1230) can extract the characteristics of the malware based on the received malware image and generate an attention feature rule using the extracted characteristics. That is, the framework (1200) of the intelligence platform (10000) can analyze the file using the generated attention feature rule, detect the malware, and provide the user with cyber threat information.

[1171] This has the advantage of improving the pattern non-identification rate and malware non-detection probability compared to the existing method.

[1172]

[1173] Figure 69 discloses an embodiment in which the disclosed intelligence platform generates attention feature rules using a ViT model.

[1174] As described above, disassembling an executable file yields OP-CODE and ASM-CODE, which are codes in the form of assembly language.If the executable file is malicious code that causes malicious behavior, disassembling the function or code section that causes the behavior can yield a disassembled code set that causes the malicious behavior. The disassembled code set may include a set of OP-CODEs corresponding to the malicious behavior or malicious code, or a set of OP-CODEs and ASM-CODEs combined.

[1175] Even if the malicious behavior is the same, the algorithm of the malicious code that performs it or the disassembly result of the executable file are not exactly the same, so it is possible to identify whether the input malicious code corresponds to a specific set of disassembled codes through artificial intelligence-based similarity analysis.

[1176] The malware detection unit (YARA) can detect data within a web page based on patterns according to YARA rules, identify malicious and attack tools within the data, and identify the attacker's signature pattern.

[1177] Through this, the AI ​​engine can determine whether the data delivered by the AI-based malware detection unit (YARA) is malicious or normal based on the AI ​​algorithm.

[1178] At this time, the existing YARA rule detects whether the entire code is malicious through one-to-one matching based on binary information, but the binary information used here has the problem that it is not intuitive for humans to view.

[1179] Accordingly, the present invention proposes a method for generating rules using OP-CODE and API function names included in an ASM file.

[1180] For this purpose, the DRP module (1221) of the framework (1200) of the intelligence platform (10000) of the present invention is characterized by using a ViT model.

[1181] More specifically, the DRP module (1221) may include a feature extraction unit (12211), a visualization unit (12213), an attention pixel location extraction unit (12215), and an attention feature extraction unit (12217).

[1182] Here, the feature extraction unit (12211) can extract feature information by disassembling the malicious code executable file through the Nth module (1219). Here, the feature information can include an OP-CODE and an API function name sequence.

[1183] The visualization unit (12213) can visualize the feature information extracted through the feature extraction unit (12211) as a malware image.

[1184] The DRP module (1221) can input a visualized malware image into the ViT model of the AI ​​engine (1230) and receive a classification result and an attention map as output values ​​from the ViT model.

[1185] The attention pixel location extraction unit (12215) can extract the location of a pixel within the attention map using the received attention map.

[1186] The attention feature extraction unit (12217) can extract attention features based on the pixel locations of the attention map extracted through the attention pixel location extraction unit (12215).

[1187] Afterwards, the DRP module (1221) can generate an attention feature rule using the extracted attention features, and can more accurately detect malicious code using the attention feature rule. The method by which the DRP module (1221) generates an attention feature rule using the ViT module of the AI ​​engine (1230) will be described again in the following drawing.

[1188]

[1189] Figure 70 discloses an embodiment in which the disclosed intelligence platform generates attention feature rules using a ViT model.

[1190] The present invention aims to address the "black box" problem of AI models that handle classification problems by using matched rules as the basis for the AI ​​model's inference. The "black box" problem refers to the inability of existing deep learning models to provide the basis for their inferences.

[1191] To this end, the present invention will be described in detail as follows.

[1192] The intelligence platform can analyze a file through the N module (1219) and transmit it to the DRP module (1221). Alternatively, the DRP module (1221) can directly analyze the file through the feature extraction unit (12211). That is, the feature extraction unit (12211) of the DRP module (1221) can be included as part of the N module (1219).

[1193] The DRP module (1221) can extract features by disassembling a malicious code file through the feature extraction unit (12211).

[1194] The visualization unit (12213) can generate a malware image (2701) based on disassembled features.

[1195] The DRP module (1221) can transmit the visualized malware image (2701) to the ViT model of the AI ​​engine (1230). Thereafter, the ViT model can learn to classify at least one of maliciousness, attack technique, attack group, and threat type using the malware image (2701) including the extracted features.The ViT model can repeatedly learn malware images (2701) and return the learning results, which are classification results and attention maps (2702), to the DRP module (1221).

[1196] Here, the attention map (2702) corresponds to a map indicating an attention value for at least one of the maliciousness, attack technique, attack group, and threat type that are the classification targets while the ViT model learns through malware images (2701). Here, the attention value corresponds to a value that the ViT model focuses on to classify a target within the input image. That is, the ViT model can indicate, as an attention value, which area in the input image it focused on to classify it as a target. At this time, the attention value can be represented as a single area (including one pixel) of the image. That is, the attention map (2702) output by the ViT model can correspond to the attention map (2702) output by a general ViT model in a classification experiment.

[1197] In one embodiment, the attention pixel location extraction unit (12215) can extract the attention value of a feature based on the classification result and the attention map (2702) received from the ViT model, and extract the pixel location of the highest attention value. Thereafter, the attention pixel location extraction unit (12215) can transfer the pixel location of the extracted attention value to the attention feature extraction unit (12217).

[1198] The attention feature extraction unit (12217) can generate an attention feature rule (2703) based on the pixel location of the received attention value.

[1199] More specifically, the attention feature extraction unit (12217) can extract an attention sequence using at least one of the pixel location of the received attention value, the malware image (2701), the size of the malware image (2701), the Nth module (1219) or the feature extraction unit (12211). In particular, in one embodiment, the attention feature extraction unit (12217) is characterized in that it extracts an attention sequence using all of the pixel location of the received attention value, the malware image (2701), the size of the malware image (2701), the Nth module (1219) or the feature extraction unit (12211).

[1200] The attention feature extraction unit (12217) can define the extracted sequence as an attention feature rule (2703). In one embodiment, the attention feature extraction unit (12217) can extract a sequence as long as a predefined sequence length and then define it as an attention feature rule.

[1201] Afterwards, the intelligence platform can classify untrained samples using the defined attention feature rules (2703). For example, when a new executable file is received, the intelligence platform can generate a malware image (2701) and input it into the ViT model to classify at least one of maliciousness, attack technique, attack group, and threat type using the defined attention feature rules (2703).

[1202] Through this, the cyber threat information processing method and device of the present invention can generate attention feature rules for identifying whether a file is malicious, an attack group, an attack technique, and a threat type, and the generated rules can provide valid digital analysis evidence for the analysis results together with a natural language explanation generated by the above-described natural language model.

[1203]

[1204] Figure 71 discloses the attention feature rule generated by the disclosed intelligence platform.

[1205] This drawing illustrates, but is not limited to, examples of four attack groups using attention feature rules generated by the intelligence platform described above.

[1206] The intelligence platform can generate a first attention feature rule using the DRP module and ViT model described above from a malicious code file whose attack group is “APT 17”. Here, the first attention feature rule is composed of an attention sequence with a size of 200 and can include an OP-CODE and API function name such as “call getlasterror call pop jmp mov geteprocaddress tag retn”.

[1207] Similarly, the intelligence platform can generate a second attention feature rule using the DRP module and the ViT model from a malware file whose attack group is “APT 32.” Here, the second attention feature rule is composed of an attention sequence of size 200 and can include OP-CODE and API function names such as “ror mov rol jmp jz jnz pop push.”

[1208] That is, the intelligence platform can generate an attention sequence of a preset size using the DRP module and ViT model from malicious code files of various attack groups, and can define an attention feature rule through this.

[1209] Below, an example of detecting malicious code using the attention feature rule generated in this manner will be described.

[1210]

[1211] Figure 72 discloses an embodiment of detecting malicious code using attention feature rules generated by the disclosed intelligence platform.

[1212] This drawing explains the result of detecting malicious code through sequence matching with actual malicious code using the above-described attention feature rule.

[1213] In an embodiment, the intelligence platform can perform sequence matching with actual malware using the attention feature rule defined using the embodiment described above.

[1214] Compared to the existing malware detection rule YarGen (YARA Rule Generation), the attention feature rule of the present invention reduced the non-detection rate of actual malware by 46%, increased the detection accuracy of actual malware by 49.2%, and increased the detection accuracy excluding non-detected malware by 16.8%.

[1215] That is, when using the attention feature rule generated using the DRP module and ViT model provided by the intelligence platform of the present invention, it can be seen that the performance is greatly improved compared to malware detection using the existing YARA generation technique.

[1216]

[1217] Figure 73 discloses the results of detecting malicious code using the attention feature rule generated by the disclosed intelligence platform.

[1218] This drawing is a table showing the malware detection results of YaraGen, an existing malware detection rule, and the malware detection results of the attention feature rule of the present invention.

[1219] The first table shows the confusion matrix of YaraGen.

[1220] When using YaraGen, there were 39 cases where YaraGen correctly predicted that the malware file belonging to the actual attack group was APT 17, 1 case where it incorrectly predicted that it was APT 32, 1 case where it incorrectly predicted that it was Lazarus, and 7 cases where it incorrectly predicted that it was Patchwork.

[1221] There were 1 case where YaraGen incorrectly predicted that the malware file belonging to the actual attack group APT 32 was APT 17, 26 cases where it correctly predicted that it was APT 32, 6 cases where it incorrectly predicted that it was Larazus, and 0 cases where it incorrectly predicted that it was Patchwork.

[1222] YaraGen incorrectly predicted the malware file as belonging to APT 17 in 8 cases, APT 32 in 7 cases, Larazus in 31 cases, and Patchwork in 2 cases when the actual attack group was Lazarus.

[1223] YaraGen incorrectly predicted 5 cases where the malware file was actually attributed to Patchwork as being from APT 17, 1 case where it incorrectly predicted APT 32, 0 cases where it incorrectly predicted Larazus, and 29 cases where it correctly predicted Patchwork.

[1224] On the other hand, the second table shows the confusion matrix of the attention feature rule of the present invention.

[1225] When the attention feature rule of the present invention was used, there were 132 cases where the intelligence platform correctly predicted that the actual attack group was APT 17, 2 cases where it incorrectly predicted that the malware file was APT 32, 8 cases where it incorrectly predicted that it was Lazarus, and 4 cases where it incorrectly predicted that it was Patchwork.

[1226] When the attention feature rule of the present invention was used, there were 0 cases where the intelligence platform incorrectly predicted that the actual attack group of the malware file was APT 32, and 75 cases where it correctly predicted that the attack group was APT 17, 1 case where it incorrectly predicted that the malware file was Larazus, and 0 cases where it incorrectly predicted that the malware file was Patchwork.

[1227] When the attention feature rule of the present invention was used, there was 1 case where the intelligence platform incorrectly predicted that the malicious code file belonging to the actual attack group Lazarus was APT 17, 3 cases where it incorrectly predicted that the malicious code file belonging to APT 32 was APT 32, 56 cases where it correctly predicted that the malicious code file belonging to Lazarus was Larazus, and 0 cases where it incorrectly predicted that the malicious code file belonging to Patchwork was APT 17.

[1228] When the attention feature rule of the present invention was used, there were 1 case where the intelligence platform incorrectly predicted that the actual attack group of the malicious code file was APT 17, 1 case where it incorrectly predicted that the attack group was APT 32, 2 cases where it incorrectly predicted that the malicious code file was Larazus, and 72 cases where it correctly predicted that the malicious code file was Patchwork.

[1229] In this way, it can be seen that the attention feature rule proposed by the present invention can better classify attack groups of actual malicious codes compared to the generation technique of the existing YaraGen.

[1230] That is, the performance of Yara rules, which show low accuracy in classifying various attack information of malware (attack group, attack technique, and threat type, etc.), can be improved.

[1231]

[1232] Figure 74 discloses the results of detecting malicious code using the attention feature rule generated by the disclosed intelligence platform.

[1233] Features can be extracted by disassembling the file (S89100).

[1234] The intelligence platform may receive a request from a client to analyze a file for cyber threat information. Accordingly, the intelligence platform may disassemble the received file to extract features. Here, the process of the intelligence platform disassembling the file to extract features may utilize the Nth module and the DRP module within the intelligence platform. This is as described above with reference to FIGS. 67 and 68.

[1235] A malware image can be created based on the extracted features (S89200).

[1236] The intelligence platform can generate malware images based on the extracted features. More specifically, the ViT model utilized in the present invention is one of the latest deep learning models specialized in image processing, and is particularly excellent in classifying input images into objects. Accordingly, by inputting an image into the ViT model, the intelligence platform can generate malware images corresponding to the extracted features in order to obtain classifications for desired objects (such as attack groups, attack techniques, and threat information).

[1237] An attention map corresponding to the malware image can be generated by inputting a malware image into a ViT model (S89300).

[1238] The intelligence platform can input the generated malware image into the ViT model and receive an attention map corresponding to the malware image from the ViT model. Here, the method by which the ViT model generates an attention map from the malware image is as described above with reference to FIGS. 69 and 70. That is, the ViT model is trained to focus (attention) on a specific region of the image in order to classify the malware image according to the target, and the ViT model provides an attention value to a feature region for classifying the malware image. The map in which this attention value appears corresponds to the attention map.

[1239] The pixel location of the attention value included in the attention map can be extracted from the attention map (S89400).

[1240] The intelligence platform can extract the pixel locations of the attention values ​​included in the attention map generated by the ViT model. The ViT model can provide different attention values ​​to each region (pixel) within the malware image to classify the malware image, and the intelligence platform can extract the pixel location with the highest attention value within the attention map.

[1241] An attention sequence can be extracted through at least one of a feature, a malware image, a size of the malware image, and a pixel location of an attention value (S89500).

[1242] The intelligence platform can extract an attention sequence using at least one of the features extracted in step (S89100), the malware image generated in step (S89200), the size of the malware image, and the pixel location of the highest attention value extracted in step (S89400). For details, refer to FIGS. 70 and 71.

[1243] An attention feature rule can be generated based on an attention sequence (S89600).

[1244] The intelligence platform can generate attention feature rules based on attention sequences. The intelligence platform can use the generated attention feature rules to detect malicious code in files requested by a user. When detecting malicious code using the attention feature rules of the present invention, since the attention feature rules indicate whether the code is malicious, the attack group, the attack technique, and threat information, profiling with clear evidence of the detected malicious code is possible.< / iframe>

Claims

1. Step of extracting features by disassembling the first file; A step of generating a malware image based on the extracted features; A step of inputting the above malware image into a ViT (Vision Transformer) model to generate an attention map corresponding to the above malware image; A step of extracting the pixel location of the attention value included in the attention map from the attention map; A step of extracting an attention sequence using at least one of the above features, the malware image, the size of the malware image, and the pixel location of the attention value; and A method for providing cyber threat information, comprising a step of generating an attention feature rule based on the above attention sequence.

2. In paragraph 1, A step of receiving a request for analysis of a second file from a user; A step of classifying at least one of the maliciousness, attack group, attack technique, and threat type of the second file using the generated attention feature rule; and A method for providing cyber threat information, comprising the step of providing the classification result to the user.

3. A database that stores data; and Processor; including, The above processor, Disassemble the first file to extract features, Create a malware image based on the extracted features, By inputting the above malware image into the ViT (Vision Transformer) model, an attention map corresponding to the above malware image is generated, Extract the pixel location of the attention value included in the attention map from the above attention map, An attention sequence is extracted using at least one of the above features, the malware image, the size of the malware image, and the pixel location of the attention value, A cyber threat information providing device that generates an attention feature rule based on the above attention sequence.

4. In paragraph 3, The above processor, Receive a request for analysis of a second file from a user, Using the above-generated attention feature rule, classify at least one of the maliciousness, attack group, attack technique, and threat type of the second file, A cyber threat information providing device that provides the above classification results to the above user.

5. Step of disassembling the first file to extract features; A step of generating a malware image based on the extracted features; A step of inputting the above malware image into a ViT (Vision Transformer) model to generate an attention map corresponding to the above malware image; A step of extracting the pixel location of the attention value included in the attention map from the attention map; A step of extracting an attention sequence using at least one of the above features, the malware image, the size of the malware image, and the pixel location of the attention value; and A storage medium storing a computer-executable cyber threat information providing program that performs a step of generating an attention feature rule based on the above attention sequence.

Images