Data pattern analysis system capable of preventing cyber security threat

Abstract

Disclosed is a data pattern analysis system capable of preventing a cyber security threat. The disclosed data pattern analysis system according to an embodiment comprises a pattern analysis engine that receives time series data and compares the time series data with a preset cyberattack pattern to determine a cyberattack according to the time series data.

Description

A data pattern analysis system that can prevent cybersecurity threats.

[0001] An embodiment of the present invention relates to a data pattern analysis technology capable of preventing cyber security threats.

[0002] Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), and Enterprise Security Management (ESM) systems are used to monitor network traffic for cyberattacks such as malicious traffic and Advanced Persistent Threats (APTs), identifying known malicious behavior and exploiting vulnerabilities within software. However, IDS and IPS suffer from the following signature-based detection shortcomings.

[0003] In other words, signature-based detection is a method of identifying threats by analyzing network packets to look for attack signatures (unique characteristics or behaviors associated with a specific threat), such as a series of codes that appear in specific malware. However, this method incurs operational overhead as threat intelligence must be updated regularly.

[0004] The disclosed embodiment is intended to provide a data pattern analysis system for identifying and avoiding cyber attacks such as abnormal access.

[0005] A data pattern analysis system according to a disclosed embodiment includes a pattern analysis engine that receives time series data, compares it with a preset cyber attack pattern, and determines a cyber attack based on the time series data.

[0006] The above data pattern analysis system further includes a data pattern DB that stores the set cyber attack pattern, and the data pattern DB can store the new cyber attack pattern in the data pattern storage unit when a new cyber attack pattern is generated as a result of analysis by the pattern analysis engine.

[0007] The above pattern analysis engine can calculate a correlation coefficient through correlation analysis between the time series data and the set cyber attack pattern, and if the calculated correlation coefficient exceeds a preset threshold, the time series data can be determined as a cyber attack.

[0008] According to the disclosed embodiment, correlations in data patterns that distinguish between general users and attackers are found through pattern recognition of attacker behavior based on a set of data patterns, and the identified patterns are compared with existing clustered data to perform tasks such as predicting cyberattacks. In addition, frequent attack types are searched for by specifying the occurrence and number of outliers occurring within a certain time window, and by comparing the correlation with reference data, attackers can be detected and responded to when the set conditions are met.

[0009] Figure 1 is a diagram schematically showing the configuration of a data pattern analysis system according to one embodiment of the present invention.

[0010] Figure 2 is a drawing showing a detailed configuration of a data pattern analysis system according to one embodiment of the present invention.

[0011] Figure 3 is a diagram showing an operation flow chart of a data pattern analysis system according to one embodiment of the present invention.

[0012] FIG. 4 is a block diagram illustrating a computing environment including a computing device suitable for use in exemplary embodiments.

[0013] Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. The following detailed description is provided to facilitate a comprehensive understanding of the methods, devices, and / or systems described herein. However, these are merely examples and the present invention is not limited thereto.

[0014] In describing embodiments of the present invention, if a detailed description of a known technology related to the present invention is judged to unnecessarily obscure the gist of the present invention, the detailed description will be omitted. In addition, the terms described below are terms defined in consideration of their functions in the present invention, and this may vary depending on the intention or custom of the user or operator. Therefore, the definitions should be made based on the contents throughout this specification. The terminology used in the detailed description is only for the purpose of describing embodiments of the present invention and should not be limited in any way. Unless clearly used otherwise, the singular form includes the plural form. In this description, expressions such as "comprises" or "having" are intended to indicate certain features, numbers, steps, operations, elements, parts or combinations thereof, and should not be construed to exclude the presence or possibility of one or more other features, numbers, steps, operations, elements, parts or combinations thereof other than those described.

[0015] An embodiment of the present invention relates to a method for identifying and avoiding cyberattacks, such as abnormal access, through data pattern analysis. To this end, a process is used to identify anomalies, patterns, and correlations in data sets between IoT devices and gateway devices.

[0016] The proposed data pattern analysis method measures data patterns between IoT devices and IoT gateway devices and derives a prediction model of the measured patterns to identify cyberattacks.

[0017] The most significant characteristic of Advanced Persistent Threat (APT) attacks is their persistence. Attackers continuously collect and utilize information about their targets, both internally and externally. This type of attack results in increased traffic, anomalies, and abnormal data patterns between IoT devices and gateways. This pattern analysis method allows for the detection of attacks without the attacker suspecting them and without affecting the actual system or equipment.

[0018] The present invention provides a method for detecting attacks and predicting similar attacks by analyzing the correlation between a user's typical usage patterns and the attacker's attack data patterns through patterns of attacker behavior. This method can be used to identify attacker behavior by identifying time-series data distribution patterns for data transmissions by general users or systems, and using data generation rates and data transmission bandwidth as baseline data.

[0019] FIG. 1 is a diagram schematically showing the configuration of a data pattern analysis system according to one embodiment of the present invention.

[0020] Referring to Fig. 1, the data pattern analysis system is configured to include raw data (200), data pattern DB (300), and pattern analysis engine (400).

[0021] Raw data (200) is data linked to an IoT device, an edge device, or a gateway, and the linked data can be analyzed for patterns in a pattern analysis engine (400) module and the results can be stored in a data pattern DB (300).

[0022] In the pattern analysis engine (400), when a pattern whose correlation with the reference data pattern is outside the set value range appears, it transmits it to the data pattern DB (300) and stores the pattern.

[0023] FIG. 2 is a drawing showing a detailed configuration of a data pattern analysis system according to one embodiment of the present invention.

[0024] Referring to FIG. 2, the data pattern database (DB) (300) is composed of a DB management module (310), a data pattern storage unit (320), and a pattern information synchronization (330) function.

[0025] The DB management module (310) manages data in the data pattern DB (300) and, when a new attack pattern analyzed by the pattern analysis engine (400) occurs, instructs storage in the data pattern storage unit (320).

[0026] The data pattern storage unit (320) stores a cyber attack pattern generated by the instruction of the DB management module (310) and issues a synchronization instruction to the pattern information synchronization module (330) to synchronize it with the pattern analysis engine (400).

[0027] Pattern information synchronization (330) has a function of synchronizing the cyber attack pattern information currently held by the pattern information synchronization module (410) of the pattern analysis engine (400).

[0028] The pattern analysis engine (400) receives raw data (200) based on the cyber attack pattern received from the pattern information synchronization (330) (data receiving unit (420)), compares the time series data with the cyber attack pattern, and analyzes and determines it in the attack judgment module (430). The attack pattern transmission module (440) has a function of transmitting a new cyber attack pattern to the DB management module (310) when it occurs.

[0029] The attack pattern judgment in the pattern analysis engine (400) is a sample of a probability process recorded at regular time intervals using time series data using the following formula 1, and a correlation coefficient set by the user through correlation analysis is judged as an attack when it exceeds the threshold.

[0030] (Equation 1)

[0031]

[0032] Here, the correlation coefficient r has a value between -1 and +1, and the greater the negative correlation and the greater the correlation, the stronger the negative dependence, and vice versa. The correlation coefficient (r) can be calculated using the following mathematical formula 2.

[0033] (Equation 2)

[0034]

[0035] FIG. 3 is a diagram showing an operation flow chart of a data pattern analysis system according to one embodiment of the present invention.

[0036] Referring to FIG. 3, time series data (200) between an IoT device and a gateway can be received by the data receiving unit (410) of the pattern analysis engine (400).

[0037] When an attack is detected (430) by finding an abnormality in the data that exceeds the threshold of the correlation coefficient set through correlation analysis of the received pattern in the pattern information synchronization module (330) of the data pattern DB (300), the attack occurrence is reported to the system administrator.

[0038] The DB management module (310) has the function of storing and managing anomalies and cyber attack patterns analyzed by the pattern analysis engine (400).

[0039] The data pattern storage unit (320) manages metadata of time series data patterns that store patterns determined to be cyber attacks analyzed by the pattern analysis engine (400).

[0040] The pattern information synchronization (330) function manages synchronization between the pattern in the stored data pattern storage unit (320) and the pattern analysis engine (400).

[0041] As used herein, the term "module" may refer to a functional and structural combination of hardware for implementing the technical concepts of the present invention and software for operating the hardware. For example, the term "module" may refer to a logical unit of a given code and hardware resources for executing the given code, and does not necessarily refer to physically connected code or a single type of hardware.

[0042] FIG. 4 is a block diagram illustrating a computing environment (10) including a computing device suitable for use in exemplary embodiments. In the illustrated embodiment, each component may have different functions and capabilities other than those described below, and may include additional components other than those described below.

[0043] The illustrated computing environment (10) includes a computing device (12). In one embodiment, the computing device (12) may be a device for data pattern analysis. In one embodiment, the computing device (12) may include a data pattern DB (300) and a pattern analysis engine (400).

[0044] A computing device (12) includes at least one processor (14), a computer-readable storage medium (16), and a communication bus (18). The processor (14) may cause the computing device (12) to operate according to the exemplary embodiments mentioned above. For example, the processor (14) may execute one or more programs stored in the computer-readable storage medium (16). The one or more programs may include one or more computer-executable instructions, which, when executed by the processor (14), may be configured to cause the computing device (12) to perform operations according to the exemplary embodiments.

[0045] A computer-readable storage medium (16) is configured to store computer-executable instructions or program code, program data, and / or other suitable forms of information. A program (20) stored in the computer-readable storage medium (16) includes a set of instructions executable by the processor (14). In one embodiment, the computer-readable storage medium (16) may be a memory (volatile memory such as random access memory, non-volatile memory, or a suitable combination thereof), one or more magnetic disk storage devices, optical disk storage devices, flash memory devices, any other form of storage medium that can be accessed by the computing device (12) and store desired information, or a suitable combination thereof.

[0046] A communication bus (18) interconnects various other components of the computing device (12), including the processor (14) and computer-readable storage media (16).

[0047] The computing device (12) may also include one or more input / output interfaces (22) that provide interfaces for one or more input / output devices (24) and one or more network communication interfaces (26). The input / output interfaces (22) and the network communication interfaces (26) are connected to the communication bus (18). The input / output devices (24) may be connected to other components of the computing device (12) via the input / output interfaces (22). Exemplary input / output devices (24) may include input devices such as pointing devices (such as a mouse or a trackpad), a keyboard, a touch input device (such as a touchpad or a touchscreen), a voice or sound input device, various types of sensor devices and / or photographing devices, and / or output devices such as display devices, printers, speakers and / or network cards. The exemplary input / output devices (24) may be included within the computing device (12) as a component constituting the computing device (12), or may be connected to the computing device (12) as a separate device distinct from the computing device (12).

[0048] While representative embodiments of the present invention have been described in detail above, those skilled in the art will appreciate that various modifications to the above-described embodiments are possible without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined not only by the claims set forth below but also by equivalents thereof.

Claims

1. As a data pattern analysis system, A data pattern analysis system comprising a pattern analysis engine that receives time series data, compares it with a preset cyber attack pattern, and determines a cyber attack based on the time series data.

2. In claim 1, The above data pattern analysis system, It further includes a data pattern DB that stores the above-mentioned cyber attack patterns, The above data pattern DB is a data pattern analysis system that stores a new cyber attack pattern in a data pattern storage unit when a new cyber attack pattern is generated as a result of analysis by the pattern analysis engine.

3. In claim 1, The above pattern analysis engine, A data pattern analysis system that calculates a correlation coefficient through correlation analysis between the above time series data and the above set cyber attack pattern, and determines the time series data as a cyber attack if the calculated correlation coefficient exceeds a preset threshold.

Images