Sandbox Event Analysis for Faster Attacker Group Inference
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity systems struggle to rapidly identify and respond to cyberattacks by inferring the attacker group, necessitating improved intrusion detection and incident response mechanisms.
Innovation Solution
A system that analyzes malicious code in isolated environments using a sandbox pool manager, event manager, and artificial intelligence model to infer attacker groups by comparing event patterns with predefined sigma rules, capturing direct and indirect system influences.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malicious code is analyzed in isolated sandbox environments to ensure security, then system reliability is improved, but analysis time and processing speed worsen
Solution Approach 1:
The system segments malicious code analysis into multiple independent sandbox environments, allowing parallel execution of analysis tasks. Each sandbox operates independently to maintain security isolation while the overall system processes multiple samples simultaneously, reducing total analysis time without compromising individual analysis reliability
Solution Approach 2:
The system performs preliminary setup of sandbox environments and pre-configures analysis parameters before actual malicious code analysis begins. This preliminary preparation ensures that when analysis starts, all security and computational resources are already in place, eliminating setup delays during the actual analysis process
2Measurement precision
If multiple analysis parameters and event types are collected to improve inference accuracy, then measurement precision is improved, but device complexity worsens
Solution Approach 1:
The system implements a universal event collection framework that handles multiple types of analysis parameters and event types through a single standardized interface. This multi-functional approach allows the system to collect diverse data (file operations, registry changes, network activities, process creations) without requiring separate complex handling mechanisms for each type, thus improving inference accuracy while managing system complexity
Solution Approach 2:
The system employs a nested architecture where specific event collection modules are organized within hierarchical layers of general-purpose collection and processing components. This nesting allows detailed event data to be captured while being processed and filtered through standardized intermediate layers, reducing overall system complexity while maintaining comprehensive data collection capabilities
3Productivity
If real-time event collection is implemented to improve response speed, then productivity is improved, but system complexity worsens
Solution Approach 1:
The system implements self-service mechanisms where the sandbox environments automatically generate and queue events for collection without requiring external intervention. Event sources register themselves with the collection system, and the system automatically processes and routes events through the analysis pipeline, enabling real-time collection while reducing the operational complexity of managing event streams
Data Source
AI summary
Provided are a device, system, method, and computer program for inferring an attacker group by analyzing malicious code. The system includes a sandbox pool manager configured to allocate analysis target files for inferring an attacker group to one or more nodes and separately execute the analysis target files in separate malicious code analysis environments by controlling each node, an event manager configured to determine in real time whether all events related to the analysis target files have been collected on the basis of running state information of each node and collect events which are recorded in the malicious code analysis environments of each of the nodes and related to the analysis target files, an attacker group inference part configured to infer an attacker group by analyzing the collected events, and an analysis result provider configured to provide information on the inferred attacker group.