Behavior Event Correlation for Multi-Domain Cyber-Attack Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cyber-attack detection systems are hindered by advanced attackers using bypassing security systems and anti-forensics, making it difficult to investigate breaches effectively.
Innovation Solution
Collecting behavior events from multiple domains, mapping them onto metadata standards, generating relationship data, and counting suspected behavior events to calculate scores for efficient cyber-attack tracking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional breach investigation methods are used after cyber-attacks occur, then investigation can be conducted with existing tools, but attackers can bypass security systems and hide their traces making investigation difficult
Solution Approach 1:
The system performs preliminary action by collecting and storing behavior events from multiple domains before attacks can be executed. Behavior events are continuously gathered from hosts, networks, and cloud services, creating a comprehensive baseline of normal and suspicious activities that enables detection even when attackers attempt to hide their traces
Solution Approach 2:
The system introduces behavior events as an intermediary element that mediates between raw security data and investigation analysis. These standardized behavior events serve as a common language across different domains (host, network, cloud), enabling unified analysis and making it difficult for attackers to bypass detection by obscuring their activities across multiple layers
2Loss of information
If behavior events are collected from large-scale hosts across multiple domains, then comprehensive attack tracking is enabled, but data complexity and processing difficulty increase
Solution Approach 1:
The system segments the complex multi-domain security data into discrete, standardized behavior events. Each behavior event represents a specific atomic action (e.g., file access, network connection, process execution) with standardized attributes, allowing the system to manage and analyze large volumes of data from hosts, networks, and cloud services without being overwhelmed by complexity
Solution Approach 2:
The system applies parameter changes by transforming raw security data from multiple domains into a standardized parameter structure. Behavior events consistently use the same parameter names and data types across different sources, enabling uniform processing and analysis while preserving the completeness of information from diverse domains
3Measurement precision
If relationship data is generated by mapping behavior events to standardized metadata, then attack behavior identification is improved, but processing time and computational resources increase
Solution Approach 1:
The system applies universality by creating a standardized metadata structure that serves multiple functions simultaneously. The same metadata fields (e.g., event type, process action, file specification) are used across all behavior events from different domains, enabling the system to generate relationship data efficiently while maintaining high precision in attack behavior identification through consistent comparison and analysis
Data Source
AI summary
Proposed is a method for tracking a cyber-attack to be performed by a cyber-attack tracking device including a memory and a processor. The method may include determining a plurality of behavior events performed by network devices in one or more domains, and mapping the plurality of the behavior events onto metadata of preset standards. The method may also include generating relationship data indicating a relationship between behavior events mapped onto metadata designated as a preset group based on the metadata mapped onto the behavior events. The method may further include counting a number of behavior events related to a preset suspected behavior among behavior events having a relationship data same as a relationship data of a first behavior event to calculate score for the relationship data including the first behavior event.