Attack Group Classification via ML Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods face challenges in accurately identifying and classifying attack groups, especially when custom malware is used or false patterns are designed, making it difficult to analyze sophisticated cyberattacks.
Innovation Solution
An apparatus and method that extracts features from documents of specific formats, such as e-mail and executable files, using a machine learning algorithm to generate a classification model for identifying attack groups, incorporating features like location, language, time, and system information, and applying a K-fold cross-validation algorithm for accurate classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional forensic analysis methods are used to identify attackers, then the analysis process becomes time-consuming and labor-intensive, but the accuracy may be insufficient when attackers use custom malware or false patterns
Solution Approach 1:
The system performs preliminary actions by collecting and preprocessing attack data in advance, extracting relevant features and storing them in a structured format. This preparation work is done before actual classification needs to occur, so when new attacks need to be identified, the system can quickly compare against pre-processed data without performing time-consuming analysis from scratch.
Solution Approach 2:
The patent replaces manual forensic analysis (mechanical human effort) with an automated machine learning classification system. The classifier automatically processes attack data, extracts features, and identifies attack groups without human intervention, dramatically reducing analysis time while maintaining or improving accuracy through consistent application of classification algorithms.
2Ease of manufacture
If analysts rely on fragmentary information and manual knowledge for specifying attackers, then the process is simple to implement, but it becomes ineffective when attackers use sophisticated techniques like custom malware or re-used malware from different groups
Solution Approach 1:
The classification system is designed to be universal and adaptable to various attack types and methodologies. Rather than relying on specific manual knowledge of particular attack patterns, the system uses generalizable machine learning algorithms that can process diverse attack data and identify patterns across different attack groups, making it reliable against sophisticated and evolving threats.
Solution Approach 2:
The system changes the parameters used for identification from simple, manual criteria to comprehensive multi-dimensional features extracted through automated processing. By analyzing multiple parameters simultaneously (such as malware characteristics, attack patterns, temporal information), the system achieves more reliable attack group specification even when attackers use sophisticated techniques.
3Measurement precision
If comprehensive features are extracted from attack data for accurate classification, then the identification accuracy improves, but the complexity of the analysis system increases
Solution Approach 1:
The system segments the complex feature extraction process into distinct, modular components. Each component handles a specific aspect of feature extraction (such as malware analysis, pattern recognition, temporal analysis), making the overall complex system manageable through division into smaller, specialized units that can be developed and maintained independently.
Data Source
AI summary
The present disclosure relates to an attack group classifying apparatus. The apparatus includes a feature extracting unit configured to extract, from a data set including documents of specific formats, features for identifying attack groups using the documents of the specific formats and an information generating unit configured to generate a machine learning data set based on the extracted features. Further, the apparatus further includes a learning model unit configured to execute a machine learning algorithm on the machine learning data set to generate a classification model for identifying the attack groups.