Attack Reproduction Support Apparatus for Realistic Targeted Attack Simulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for reproducing targeted attacks cannot realistically replicate the communication with servers and the timing of attacks, making it difficult to accurately understand and analyze attack traces.
Innovation Solution
An attack reproduction support apparatus and method that sets and transmits attack information and sequence information to an attack reproduction apparatus, allowing for realistic reproduction of targeted attacks, including C&C communication and dynamic attack timing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a batch file is used to reproduce targeted attacks, then the attack procedure can be reproduced, but the communication with servers and dynamic attack timing cannot be realistically reproduced
Solution Approach 1:
The patent segments the attack reproduction system into multiple independent components: attack information storage unit, sequence information storage unit, request reception unit, and attack information transmission unit. This segmentation allows each component to handle specific aspects of attack reproduction independently, enabling realistic C&C communication and dynamic timing while maintaining system manageability.
Solution Approach 2:
The patent introduces dynamic elements by using sequence information to control the timing and order of attack information transmission. The system can dynamically adjust attack timing and reproduce C&C communication patterns based on received requests, rather than executing fixed batch file commands. This makes the attack reproduction realistic and adaptable.
2Measurement precision
If attack information is transmitted based on fixed sequence, then reproduction accuracy is improved, but flexibility in handling different attack scenarios is reduced
Solution Approach 1:
The patent prepares attack information and sequence information in advance and stores them in dedicated storage units. This preliminary action allows the system to quickly retrieve and transmit appropriate attack information when requests are received, ensuring both accuracy in reproduction and flexibility to handle different attack scenarios by selecting from pre-prepared information sets.
Solution Approach 2:
The patent uses sequence information as a controllable parameter to adjust the transmission timing and order of attack information. By changing sequence parameters, the system can accurately reproduce different attack scenarios and timing patterns while maintaining adaptability to various attack types through parameter adjustment rather than structural changes.
Data Source
AI summary
An attack reproduction support apparatus includes: a setting unit configured to set a plurality of pieces of attack information for causing an attack reproduction apparatus that reproduces a targeted attack to reproduce a targeted attack, and sequence information indicating a sequence of transmitting the plurality of pieces of attack information to the attack reproduction apparatus; and a responding unit configured to, upon receiving a request for transmitting the attack information from the attack reproduction apparatus, transmitting the attack information to the attack reproduction apparatus based on the sequence information, in order to respond to the request.