Attack Similarity Quantification via Parameterized Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing targeted attack analysis systems only classify and present information, failing to provide a quantitative measure of similarity between attacks, which is essential for effective response and simulation exercises.
Innovation Solution
An attack analysis assistance apparatus and method that extracts comparison information from multiple targeted attacks based on set guidelines and calculates their similarity using units for comparison information extraction and similarity calculation, enabling quantitative presentation of attack similarities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If information regarding targeted attacks is classified and presented by type, then information organization is improved, but quantitative measurement of attack similarity is lost
Solution Approach 1:
The patent segments attack information into multiple dimensions including attack tactics, techniques, procedures, and impact categories. By dividing the comprehensive attack data into distinct segments, the system can simultaneously maintain organized classification while enabling precise similarity measurement across different attack aspects.
Solution Approach 2:
The patent transforms attack information from qualitative classification into quantitative parameters by assigning numerical values to attack characteristics, tactics, and impacts. This parameter transformation enables the calculation of similarity scores between attacks while preserving the organized structure through standardized parameter sets.
2Device complexity
If only classification of attack information is performed, then system complexity is reduced, but the ability to envision similar attacks for training is insufficient
Solution Approach 1:
The patent introduces an intermediary similarity calculation mechanism that bridges simple classification and complex attack simulation. This intermediary layer processes classified attack information and generates similarity metrics, enabling training scenario generation without requiring the full complexity of direct attack simulation systems.
Solution Approach 2:
The patent performs preliminary classification and organization of attack information before similarity calculation and simulation generation. By pre-processing attack data into structured categories and parameters, the system prepares the foundation for versatile attack envisioning while keeping the overall system complexity manageable through staged processing.
3Measurement precision
If detailed attack information is analyzed individually, then analysis precision is improved, but time consumption for comparing multiple attacks increases
Solution Approach 1:
The patent converts detailed attack information into standardized parameters and numerical representations, enabling efficient computational comparison. By transforming qualitative attack descriptions into quantifiable parameters, the system maintains high analysis precision while allowing rapid comparison across multiple attacks through mathematical operations rather than manual analysis.
Solution Approach 2:
The patent creates simplified copies or representations of attack information in the form of standardized parameter sets and similarity metrics. These copied representations preserve the essential characteristics needed for precise analysis while enabling fast comparison operations, reducing the time required to evaluate multiple attacks without losing critical analytical detail.
Data Source
AI summary
An attack analysis assistance apparatus includes: a comparison information extraction unit that extracts, from information regarding a plurality of targeted attacks, respective pieces of comparison information that are related to a set guideline and are to be used for comparison; and a similarity calculation unit that receives, as input, the pieces of comparison information extracted from the information regarding the plurality of targeted attacks, and calculates a similarity between the plurality of targeted attacks.