Malware Meta Information Collection for Attack Group Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to accurately collect and classify application programming interface (API) information related to malicious code due to its vast volume across various channels, limiting the effectiveness of malicious code analysis.
Innovation Solution
An apparatus and method for collecting malicious code meta information that includes an API key setting unit, collection channel access unit, execution command interpretation unit, and meta information management unit to extract and manage meta information in JSON format from channels like VirusTotal, Abuse.ch—Malware Bazaar, and OTX, utilizing IOC values and types for improved analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If API information from multiple collection channels is collected to improve malicious code analysis accuracy, then the quantity and variety of data increase, but the complexity of data classification and management increases
Solution Approach 1:
The patent segments the collection process by creating separate collection channel access units for different data sources (VirusTotal, Abuse.ch-Malware Bazaar, OTX, Github). Each unit is responsible for collecting data from a specific channel, and the data is organized into distinct categories (IOC information, repository information, API information) with dedicated storage structures, making the overall complex system manageable through modular segmentation
Solution Approach 2:
The patent introduces an execution command interpretation unit as an intermediary between the collection channel access units and the meta information management unit. This intermediary parses execution commands, identifies target parameters (IOC values, repository names), and generates appropriate request values for different collection channels, thereby simplifying the complexity of directly managing multiple data sources
2Loss of information
If comprehensive API information is collected from various channels to improve analysis capability, then the information completeness increases, but the time required to process and manage the data increases
Solution Approach 1:
The patent performs preliminary actions by pre-registering as a member of multiple collection channels and obtaining API keys in advance. The collection channel access units are pre-configured with authentication credentials, and the system maintains ready-to-use access to multiple data sources, eliminating the need for time-consuming authentication processes during actual data collection operations
Solution Approach 2:
The patent implements continuous data collection by running multiple collection channel access units simultaneously to gather information from different sources (VirusTotal, Abuse.ch-Malware Bazaar, OTX, Github) in parallel. The system continuously monitors and collects IOC information, repository information, and API information without interruption, ensuring complete information gathering while optimizing processing time through concurrent operations
3Ease of operation
If specific meta information for attack groups is extracted and managed in structured format, then the usability for incident response improves, but the complexity of information extraction and organization increases
Solution Approach 1:
The patent transforms unstructured or semi-structured API information from collection channels into structured meta information with specific parameters (attack group identifiers, IOC values, repository names, URLs). The meta information management unit organizes this data into a standardized format with defined fields and data types, changing the parameter structure to enhance usability for incident response while managing extraction complexity through systematic organization
Data Source
AI summary
An apparatus for collecting meta data related to malicious code meta information, includes: an application programming interface (API) key setting unit configured to register as a member of a collection channel related to malicious code of cyber attacks, and set the API key as an initialization input; a collection channel access unit configured to, upon input of the set API key, access the collection channel; an execution command interpretation unit configured to, subsequent to accessing the collection channel, upon input of an execution command, interpret the input execution command; and a meta information management unit configured to, based on API information provided from the collection channel according to the interpreted execution command, extract at least one piece of meta information for identifying an attack group, and manage the at least one piece of meta information in a JSON format for each attack group.