KR20230103275A - Apparatus for processing cyber threat information, method for processing cyber threat information, and medium for storing a program processing cyber threat information - Google Patents

Abstract

The disclosed embodiment provides a cybersecurity threat information processing device, a cybersecurity threat information processing method, and a storage medium for storing a program for processing cybersecurity threat information. The method includes the steps of: receiving a first user executable file analysis request signal; obtaining reconstructed disassembled code; processing the reconstructed disassembled code to convert the code into a hash function and converting the hash function into N-gram (N is a natural number) data; generating executable file analysis results; comparing the similarity between clustering data of a first user and a second user different from the executable file analysis result; and providing information related to the similarity to the second user.

Description

A storage medium for storing a cyber security threat information processing device, a cyber security threat information processing method, and a cyber security threat information processing program INFORMATION}

The disclosed embodiments relate to a cyber security threat information processing device, a cyber security threat information processing method, and a storage medium storing a cyber security threat information processing program.

The damage from cyber security threats, which are gradually becoming more sophisticated, centered on new or variant malicious codes, is increasing. In order to reduce such damage even a little and respond early, we are simultaneously advancing countermeasure technologies through multi-dimensional pattern construction and various complex analyses. However, recent cyber attacks tend to increase day by day, rather than respond appropriately within the control range. These cyberattacks go beyond the existing ICT (Information and Communication Technology) infrastructure and pose a threat to finance, transportation, environment, and health, which directly affect our lives.

One of the basic technologies for detecting and responding to most existing cyber security threats is to create a database of patterns for cyber attacks or malicious codes in advance and utilize appropriate monitoring technology where data flows are needed. Existing technologies have been developed based on a method of identifying and responding to a threat when a data flow or code matching a monitored pattern is detected. Such conventional technology has the advantage of being able to quickly and accurately detect if it matches a pattern secured in advance, but in the case of a new or variant threat that does not have a pattern secured or bypasses, detection itself is impossible or takes a very long time to analyze. There was a problem.

Conventional technologies are focused on a method of advancing a technology for detecting and analyzing malicious code itself even when artificial intelligence analysis is used. However, there is a problem in that fundamental technology for responding to cyber security threats does not exist, and thus it is difficult to respond to new malicious codes or variants of the malicious codes with only these methods, and there are limitations.

For example, a technique for detecting and analyzing already discovered malicious code itself has a problem in that it cannot respond to decoy information or fake information to deceive the detection or analysis system, and confusion occurs.

In the case of mass-produced malicious code with sufficient data to learn, sufficient information on its characteristics can be obtained, so that it is possible to distinguish whether it is malicious or not and the type of malicious code. However, in the case of APT (Advanced Persistent Threat) attacks, which are relatively small in number and sophisticated, often do not match learning data, and targeted attacks form the majority, so even if the existing technology is advanced, there are limitations. exist.

In addition, in the past, methods and expression techniques for explaining malicious codes, attack codes, or cyber threats differed depending on the analyst's position or analysis viewpoint. For example, since the method of describing malicious code and attack behavior is not standard worldwide, there is a problem in that even when the same incident or the same malicious code is detected, there is a problem of confusion due to different explanations by experts in the field. Even malicious code detection names are not unified, so even though it is the same malicious file, it is not identified exactly which attack was performed or it is organized differently. Therefore, there was a problem in that the identified attack technique could not be described in a normalized and standardized manner.

Conventional methods of detecting and analyzing malicious codes place emphasis on detecting malicious codes themselves, and in the case of malicious codes that perform very similar malicious behaviors, there is a problem in that attackers cannot be identified if different attackers are generated.

In connection with the above problems, the conventional method has a problem in that it is difficult to predict what kind of cyber threat attack will occur in the near future by such an individual case-focused detection method.

The purpose of the embodiments disclosed below is a cyber security threat information processing device capable of detecting and responding to malicious codes that do not exactly match data learned by artificial intelligence and responding to variants of malicious codes, cyber security threat information processing methods, and A storage medium for storing a program for processing cyber security threat information is provided.

Another object of the embodiment is to process cyber security threat information processing device, cyber security threat information processing method, and cyber security threat information that can identify malicious code, attack technique, attacker and attack prediction method in a very short time even if it is a variant of malicious code. A storage medium for storing the program is provided.

Another object of the embodiment is a cyber security threat information processing device and a cyber security threat information processing method capable of providing information on malicious codes for which malicious code detection names are not unified or cyber attack techniques are not accurately described in a normalized and standardized manner. and a storage medium storing a program for processing cyber security threat information.

Another object of the embodiment is a cyber security threat information processing device, a cyber security threat information processing method, and a cyber security threat capable of identifying other attackers who generate malicious codes performing very similar malicious actions and predicting what cyber threat attacks will occur in the future. It is to provide a storage medium for storing a program for processing information.

Accordingly, a cyber security threat information processing method according to embodiments includes receiving a first user executable file analysis request signal for analyzing an executable file, and disassembling the executable file according to the first user executable file analysis request signal. to obtain a disassembled code, reconstruct the disassembled code to obtain a reconstructed disassembled code, process the reconstructed disassembled code to convert it into a hash function, and convert the hash function to N-gram (N-gram, N is natural number) data, ensemble machine learning is performed on the block-level code of the converted N-gram data, and block-level identifier and block-level attack technique performed by the block-level code Generating an execution file analysis result by profiling with an identifier of an attacker who generated the code of, generating a first user clustering data based on the execution file analysis result, and generating clustering data of a second user different from the first user and the above Comparing similarities between execution file analysis results and, when the similarity is higher than a predetermined value, providing information related to the similarity to a second user.

An apparatus for processing cyber security threats according to embodiments includes one or more databases for each user storing clustering data for each user, an input unit for receiving a first user execution file analysis request signal for analyzing an execution file, and processing an execution file. It includes a processor that According to the first user executable file analysis request signal, the processor according to the embodiments disassembles the executable file through an application programming interface (API) to obtain a disassembled code and the disassembled code. It performs a disassembly module that reconstructs and obtains a reconstructed disassembled code, processes the reconstructed disassembled code to convert it into a hash function, and converts the hash function into N-gram (N-gram, where N is a natural number) data. The data conversion module is performed, and ensemble machine learning is performed on the block-level code of the converted N-gram data to determine the identifier of the attack technique performed by the block-level code and the block-level code. Performs a profiling module that generates an executable file analysis result by profiling with the identifier of the attacker who generated the code, generates first user clustering data based on the executable file analysis result, and identifies a second user different from the first user A similarity comparison module that compares the similarity between the clustering data and the execution file analysis result is performed, and when the similarity is higher than a preset value, information related to the similarity is provided to the second user.

A storage medium storing a program for processing cyber security threat information according to embodiments is disassembled by disassembling an executable file according to a first user execution file analysis request signal for analyzing a cyber security threat processing executable file Obtain the disassembled code, reconstruct the disassembled code to obtain the reconstructed disassembled code, process the reconstructed disassembled code to convert it into a hash function, and convert the hash function into N-gram (N is a natural number) data transform, and perform ensemble machine learning on the block-level code of the converted N-gram data to generate an identifier of an attack technique performed by the block-level code and block-level code An executable file analysis result is generated by profiling with an attacker's identifier, first user clustering data is generated based on the executable file analysis result, and similarity between the clustering data of the first user and another second user and the execution file analysis result is determined. comparison, and when the similarity is higher than a preset value, information related to the similarity is provided to the second user.

According to the embodiments disclosed below, it is possible to detect and respond to malicious codes that do not exactly match data learned through machine learning, and to respond to variants of malicious codes.

According to the embodiment, it is possible to identify a malicious code, an attack technique, and an attacker within a very short period of time even if it is a variant of malicious code, and furthermore, it is possible to predict an attack technique of a specific attacker in the future.

According to the embodiment, it is possible to accurately identify a cyber attack implementation method based on whether there is such a malicious code, an attack technique, an attack identifier, and an attacker, and provide it as a standardized model. According to the embodiment, it is possible to provide normalized and standardized information on malicious codes for which malicious code detection names, etc., or cyber attack techniques are not accurately described.

In addition, it can predict the possibility of creating previously unknown malicious code and the attackers who can develop it, and provide a means to predict what kind of cyber threat attack will occur in the future.

1 is a diagram illustrating an embodiment of a cyber security threat information processing method;
2 is a diagram illustrating an example of obtaining static analysis information in a process of generating analysis information according to the disclosed embodiment;
3 is a diagram illustrating an example of obtaining dynamic analysis information in a process of generating analysis information according to the disclosed embodiment;
4 is a diagram illustrating an example of obtaining in-depth analysis information in a process of generating analysis information according to the disclosed embodiment;
5 is a view illustrating an example of determining that a file contains malicious behavior by disassembling malicious code as an example of in-depth analysis;
6 is a diagram illustrating an example of calculating correlation analysis information in a process of generating analysis information according to an embodiment disclosed herein;
7 is a diagram illustrating an example of a process of obtaining correlation analysis information according to the disclosed embodiment;
8 is a diagram illustrating an example of generating prediction information of cyber threat information according to an embodiment.
9 is a diagram illustrating examples of malicious code queries for providing cyber threat information according to an embodiment.
10 is a diagram illustrating an embodiment of a cyber security threat information processing device
11 is a diagram showing an example for explaining in detail the function of a static analysis module in an analysis framework according to the disclosed embodiment;
12 is a diagram showing an example for explaining in detail the function of a dynamic analysis module in an analysis framework according to an embodiment disclosed herein;
13 is a diagram showing an example for explaining in detail the function of an in-depth analysis module in an analysis framework according to an embodiment disclosed herein;
14 is a diagram showing an example for explaining in detail the function of a correlation analysis module in an analysis framework according to the disclosed embodiment.
15 is a diagram showing an example for explaining in detail the function of a predictive information generating module of a predictive framework according to the disclosed embodiment.
16 is a diagram showing an example of performing static analysis according to the disclosed embodiment;
17 is a diagram showing an example of performing dynamic analysis according to the disclosed embodiment.
18 is a diagram showing an example of performing in-depth analysis according to the disclosed embodiment.
19 is a diagram showing an example of matching attack techniques with codes extracted from binary codes according to the disclosed embodiment;
20 is a diagram showing an example of matching a code set including an OP-CODE and an attack technique according to an embodiment disclosed herein;
21 is a diagram illustrating a flow of processing cyber threat information according to an embodiment disclosed herein;
22 is a diagram illustrating values obtained by converting OP-CODE and ASM-CODE into normalized codes according to the disclosed embodiment;
23 is a diagram illustrating vectorized values of OP-CODE and ASM-CODE according to the disclosed embodiment;
24 is a diagram illustrating an example of converting a block unit of code into a hash value according to the disclosed embodiment;
25 is a diagram showing an example of an ensemble machine learning model according to an embodiment disclosed herein;
26 is a diagram illustrating a flow of learning and classifying data by machine learning according to the disclosed embodiment;
27 is a diagram showing an example in which labeling is performed by identifying an attack identifier and an attacker with learning data according to the disclosed embodiment;
28 is a diagram showing a result of identifying an attack identifier according to an embodiment
29 is a diagram illustrating a gram data pattern according to an attack identifier according to an embodiment;
30 is a diagram illustrating the performance of an embodiment of processing disclosed cyber threat information;
31 is a diagram showing an example of providing detection names to detection engines of engines that detect cyber threat information;
32 is a diagram illustrating an example of a new malicious code and an attack method according to an embodiment;
33 is a diagram illustrating another embodiment of a cyber security threat information processing method;
34 is a diagram illustrating another embodiment of a cyber security threat information processing device;
35 is a block diagram illustrating the operation of a cyber security threat information processing device according to embodiments.
36 is a block diagram illustrating the operation of a cyber security threat information processing device according to embodiments.
37 is a flow diagram illustrating a cyber security threat information processing method according to embodiments.
38 is an example of a cyber security threat information processing device according to embodiments
39 is a flow diagram of a cyber security threat information processing method according to embodiments;

Hereinafter, an exemplary embodiment will be described in detail with reference to the accompanying drawings. In an embodiment, a framework, module, application program interface, etc. may be implemented as a device coupled to a physical device or may be implemented as software.

When the embodiment is implemented as software, it may be stored in a storage medium, installed in a computer, etc., and executed by a processor.

Exemplary embodiments of a cyber security threat information processing device and a cyber security threat information processing method are described in detail as follows.

1 is a diagram illustrating an embodiment of a cyber security threat information processing method. An embodiment of a method for processing cyber security threat information is as follows.

The cyber security threat information processing device performs pre-processing of the input file (S1000).

Identification information that can identify a file can be obtained through file preprocessing. An example of performing file preprocessing is as follows.

From the received file, you can obtain various meta-information including information about the origin of the file, collection information obtained from the file, and user information of the file. For example, if a file contains a URL (uniform resource locator) or is included in an e-mail, collection information about the file can be obtained. User information may include user information that has been created, uploaded, or finally stored in a file. In the pre-processing process, IP (internet protocol) information, country information based thereon, API (Application Programming Interface) key information, for example, API information of a user requesting analysis may be obtained as meta information of a file.

In the pre-processing process, the hash value of the file can be extracted. If the hash value is already known to the cyber security threat information processing device, the type or risk level of the file can be identified based on this.

If the file is not already known, analysis information for identifying the file type may be obtained by searching the hash value and file information in pre-stored information or, if necessary, an external reference website. For example, information according to file type can be obtained from sites such as the C-TAS (Cyber Threats Analysis System) operated by the Korea Internet & Security Agency, the operating system of the CTA (Cyber Threat Alliance), and VitusTotal as external reference websites.

For example, a file can be retrieved from a corresponding site by using the hash value of a hash function such as MD5 (Message-Digest algorithm 5), SHA1 (Secure Hash Algorithm 1), or SHA 256 of the file. And the file can be identified using the search result.

As an example of analyzing a file, when an input file is transmitted through a mobile network, a packet transmitted through network traffic uses a recombinant technology of network transmission packets to determine if the input file is a suspected mobile malicious code. can be saved Packet recombination technology reassembles a series of packets corresponding to one executable code from the collected network traffic, and if a file transmitted by the recombined packets is a mobile malicious suspicious code, this file is stored.

In this step, if the mobile suspicious code is not extracted from the transmission file, the mobile suspicious code may be downloaded and stored by directly accessing the download URL in the file.

Malicious activity analysis information related to the input file is generated (S2000).

The malicious behavior analysis information related to the input file may include static analysis information for analyzing information about the file itself or dynamic analysis information for determining malicious behavior by executing information obtained from the input file.

The analysis information of this step may include in-depth analysis information using information processed from an executable file related to an input file or memory analysis related to the file.

In-depth analysis may include artificial intelligence analysis to accurately identify malicious behavior.

Analysis information of this step may also include correlation analysis information capable of estimating a relationship with an attacker or an attacker by correlating previously stored analysis information or generated analysis information in relation to a file.

At this stage, multiple pieces of analysis information may be aggregated to provide an overall analysis result.

For example, static analysis information, dynamic analysis information, in-depth analysis information, correlation analysis information, etc. of one file can be integrated and analyzed to identify accurate attack techniques and attackers. Integrated analysis removes redundant parts between analysis information, and common information between analysis information can be used to increase accuracy.

For example, cyber threat indicators of compromise (IoCs) collected through various analyzes and paths can be normalized or standardized through enrichment.

In the embodiment of acquiring the analysis information, it is not necessary to necessarily calculate all the analysis information described above in sequence. For example, either static analysis information acquisition or dynamic analysis information acquisition may proceed, and dynamic analysis information may be performed before static analysis information.

In-depth analysis information does not necessarily need to be performed after performing static analysis or dynamic analysis, and correlation analysis may also be performed without in-depth analysis information.

Accordingly, the processing sequence of acquiring the above analysis information may be changed or selectively performed. In addition, the process of obtaining analysis information and the process of generating prediction information described above may be performed in parallel based on information obtained from a file. For example, correlation analysis information may be generated even if dynamic analysis is not completed. Likewise, performing dynamic analysis or performing in-depth analysis can be performed simultaneously.

In this case, the preprocessing process (S1000) exemplified above is for obtaining or identifying file information, so if static analysis, dynamic analysis, in-depth analysis, or association analysis is performed individually or in parallel, it will be performed as part of each analysis step. can

A detailed embodiment of this step will be described below.

Prediction information of malicious behavior related to the input file may be generated (S3000).

In order to increase the accuracy of analysis, predictive information on occurrence of malicious behavior, attack technique, attacker group, etc. can be generated using the data set of various information analyzed above.

The generation of predictive information can be performed through artificial intelligence analysis on already analyzed data sets. Generation of predictive information is not an essential step, and predictive information on future malicious attack behavior can be generated when a properly analyzed data set is prepared for AI analysis and conditions are satisfied.

The embodiment performs artificial intelligence-based machine learning based on various analysis information. An embodiment may generate predictive information based on a data set for the analyzed information. For example, additional analysis information is generated based on data learned by artificial intelligence, and the analysis information generated again can be used as input data for artificial intelligence as new learning data.

Here, the prediction information may include malicious code creator information, malicious code attack method information, malicious code attack group prediction, malicious code similarity prediction information, and malicious code spread prediction information.

The generated prediction information may include first prediction information for predicting the risk of the malicious code itself and second prediction information for predicting an attacker, attack group, similarity, spread, and the like of the malicious code.

Prediction analysis information including the first prediction information and the second prediction information may be stored in a server or a database.

A detailed embodiment thereof will be described below.

After post-processing the analysis information or prediction information, cyber threat information related to the input file is provided (S4000).

According to an embodiment, the type of malicious code and the risk level of the malicious code are determined based on analysis information or prediction information. And the embodiment generates profiling information about malicious codes. Thus, file analysis allows you to store the results of performing your own analysis of a file or performing additive and predictive analysis. Generated profiling information includes attack techniques for malicious code or labeling for attackers.

The cyber threat information may include information on which the above preprocessing has been performed, generated or identified analysis information, generated prediction information, or aggregation information of these information or information determined based on the information.

The provided cyber threat information may include information analyzed or predicted using analysis information stored in a database in relation to an input file or analyzed or predicted above.

According to the embodiment, when a user searches for cyber threat information on not only a malicious action on an input file but also a previously stored file or malicious action, information on this may be provided.

This integrated analysis information may be stored in a standardized format in a server or database corresponding to a corresponding file. This integrated analysis information is stored in a standardized format and can be used for searching or querying cyber threat information.

Additional examples against the inquiry of the user's cyber threat information will be described in detail below.

Figure 2 discloses an example of obtaining static analysis information in the process of generating analysis information according to the disclosed embodiment.

Obtaining static analysis information according to the disclosed embodiment may include obtaining and analyzing structure information of an input file (S2110).

The embodiment may analyze basic structure information of a file identified first in an environment in which the file is not executed. In this step, even if the file type is different, for example, ELF (Executable and Linkable Format), PE (Portable Executable), APK (Android Application Package), etc., the file structure above the file or information that can be extracted from the structure to obtain or analyze

For reference, identification of a file in the static analysis illustrated may be performed in the disclosed preprocessing step. In this case, the analysis step of step S210 may be performed together with the preprocessing step.

And pattern analysis of the input file can be performed (S2120).

In this case, the file pattern is analyzed for the identified file, and the file pattern can be obtained by checking several strings that can be extracted by opening the file itself without taking any action on the file.

Information related to the production of the input file may be obtained and analyzed (S2130).

In the embodiment, unique information or meta information possessed by a file, for example, file maker information, and codesigning information in the case of an executable file may be obtained.

Then, environment information of the input file may be analyzed (S2140).

Here, information such as system environment component information that the target file should have can be obtained.

Then, various other information related to the input file is analyzed and stored (S2150). Static information of the file itself can be stored in a specific file format, for example, a data format such as JSON (JavaScript Object Notation), without performing such a file.

An example of static analysis is to analyze the file itself, and it is possible to obtain the presence or absence of vulnerable items in the coding base, a problem with an interface or function call structure, or a binary structure of a file.

An example of analyzing the static information disclosed above is shown as a flow chart for convenience, but the above steps need not necessarily be performed in the order described above or indicated in the figures. Also, depending on the file, it is not necessary to perform all the steps disclosed in this figure, and some steps, such as structural government analysis, fabrication related information analysis, and environmental information analysis may be optionally performed to obtain static analysis information. That is, it may vary according to the selection of a person skilled in the art in the selection of the execution sequence and execution steps.

Briefly, examples of obtaining static analysis information according to the disclosed embodiment are as follows.

As an example of performing static analysis, when the hash value of an input file is extracted in a preprocessing process, the hash value of the extracted file is compared with the hash value already stored for malicious code, and the input file is malicious. code can be analyzed. Based on the analysis, it is possible to detect whether there is malicious code in the file.

If the input file is mobile data, code information of mobile malicious code is extracted from the input file. Here, the code information means information that can be extracted from the code itself without executing the mobile malicious code, for example, hash information, code size information, file header information, and identification included in the code. Possible string information and operating platform information may be included.

As described above, static analysis information obtained in this way may be stored corresponding to a corresponding file.

3 discloses an example of obtaining dynamic analysis information in a process of generating analysis information according to the disclosed embodiment.

Dynamic analysis information according to result data executed in an execution environment of a file identified based on at least one of file information or static analysis information identified from preprocessing may be obtained.

Acquiring dynamic analysis information according to the disclosed embodiment is a step of detecting a vulnerable or dangerous anomaly by analyzing various input/output data in an environment in which a file is being executed or by analyzing changes in interaction with an execution environment when a file is executed. . In general, files are directly executed in a virtualization environment to analyze abnormalities.

To perform dynamic analysis, the embodiment creates and prepares a dynamic analysis environment for executing an input file (S2210). When the type of the input file is identified, it is possible to know which execution environment is required according to the type of each file. For example, depending on the file, it can identify whether the file is executed in a Windows operating system, a Linux operating system, or a mobile device operating system.

In the prepared analysis environment, the acquired file is executed to determine whether it is a malicious code (S2220).

In order to obtain dynamic analysis information, a file may be executed in such an execution environment to collect events occurring in the corresponding system (S2230). For example, you can collect events about files themselves, processes, memory, registry, systems on the network, or events that change the settings of each system. Then, the collected events are analyzed individually or collectively.

After collecting the collected results, the environment for dynamic analysis is restored again (S2240).

The result obtained in this way may be stored as dynamic analysis information corresponding to the corresponding file.

Hereinafter, an example of collecting and analyzing dynamic analysis information according to an embodiment of obtaining such dynamic analysis information will be briefly described.

As an example of dynamic analysis, when an input file is identified as a file operating in a mobile device operating system, the file is directly executed in a mobile terminal or an emulator or virtualization environment configured the same as the mobile terminal environment. In addition, all changes that occur in the terminal after the suspected mobile malicious code is executed in the file, that is, behavior information, are extracted and recorded. Action information is different depending on the operating system (OS) environment of the terminal, but may typically include event information such as process, file, memory, and network information.

As another example of dynamic analysis, even if the hash value of the input file is not extracted in the preprocessing process and the hash value is extracted from the user terminal, the hash value of the file extracted from the terminal can be received through the intelligence platform. there is.

If the hash value of the file is not already stored in the database, the received file is executed in a virtual or real operating system, the actions occurring during execution are collected in real time, and the collected dynamic analysis information is compared with the information already stored in the database. can

As a result of the comparison, if the risk level already defined is exceeded, it can be determined that the input file contains malicious code, and the hash value of the corresponding file can be stored in a database and used for static analysis later.

Depending on the malicious code, the first process acting as a subject of action may cause a dangerous action to the system. However, in some cases, the behavior of the first process additionally creates a second process, which is a child process, and the second process performs a malicious action on the system.

In this case, an embodiment of the dynamic analysis stores events generated by the behavior of the first process in the execution system, and additionally extracts or identifies the second process, which is a child process of the first process, so that the second process It is also possible to store events of malicious actions according to the method. In this way, the dynamic analysis in this example comprehensively analyzes event information of the first process and the second and third processes to be connected thereto to determine whether the identified file contains malicious code.

Depending on the execution result of the input file, if there is no characteristic of unknown malicious code, it is difficult to detect even if it has the characteristic of malicious code. In this case, another embodiment of dynamic analysis may detect a malicious behavior of the executing process by monitoring and analyzing a network process that communicates with the outside when the identified file is executed.

For example, you can monitor network events that communicate with the outside world when an identified file is executed. Stores the Process IDentifier (PID) that created the local address object according to file execution. Further, when a network event related to the file execution occurs, local address object information may be extracted from Interior Router Protocol (IRP) information of the corresponding network event.

A dynamic analysis may be performed to determine a malicious behavior by comparing a local address object generated by the process ID with local address objects related to the network event. For example, it is possible to determine whether there is a malicious action by checking a pattern of packets transmitted and received according to the network event or a control and command (C&C) server that causes packet transmission.

As another example of dynamic analysis, ARP information may be monitored to prevent an Address Resolution Protocol (ARP) spoofing attack. In general, ARP or Neighbor Discovery Protocol (NDP) may be used for correspondence between an IP (internet protocol) address and a MAC (media access control) address of a device in a local area network.

ARP spoofing attack is performed when an attacker transmits an IP packet by sending an ARP message corresponding to his own MAC address, not the MAC address of the receiving network device. The network equipment receiving the transmitted message transmits the transmission packet to the attacker instead of the normal IP address.

The embodiment compares ARP information directly collected from network devices with ARP information in SNMP (Simple Network Management Protocol) information of network devices included in a virtual network in order to respond to such an attack, thereby determining whether an ARP spoofing attack has occurred. can

That is, in one embodiment of the dynamic analysis, the host transmits an ARP information request message to devices connected to the network, and the first ARP information included in the returned ARP response message and the SNMP information of the devices connected to the virtual network are included. When the first ARP information and the second ARP information are different from each other by comparing the second ARP information, it may be determined that an ARP spuning attack has occurred.

This embodiment can detect an ARP spoofing attack and prevent leakage of confidential information to be stored in a host device by using such a dynamic analysis method.

Another implementation of the dynamic analysis method is a method of analyzing a malicious code that avoids a virtual environment. Here, a terminal connected to the management server through a network may perform booting using a first OS (operating system) image stored in the management server. After the terminal boots and analyzes malicious codes based on the first OS, the terminal receives a second OS image from a management server and performs initialization using the received second OS image. Then, the terminal transmits the signature of which the malicious code has been analyzed to the management server. Therefore, even if there is a malicious behavior issued after analyzing the malicious code based on the first OS, the management server allows the terminal to delete the first OS from the terminal and boots the terminal based on the second OS identical to the original OS image. Malicious behavior can be prevented from occurring in the terminal.

Malicious code can communicate with an external server, issue additional commands, and receive files.

However, when a server capable of performing dynamic analysis is stopped, such dynamic analysis may take a very long time, and there are cases in which dynamic analysis cannot be performed even when a corresponding action is blocked in advance.

In order to analyze network behavior through dynamic analysis, a command control server (C&C server) used by malicious codes, a download server to download additional malicious codes, or communication packets that exchange information between malicious codes or with hackers, etc. information must be extracted and analyzed. However, such information cannot be extracted if the relevant server does not operate in this way.

According to another embodiment of the dynamic analysis method disclosed herein, dynamic analysis may be performed even when a server is stopped.

For example, dynamic analysis may be performed by having the device for inducing network access process an access request of a terminal between a client terminal infected with malicious code and a management server. The device for inducing network access may receive an access request from a terminal and transmit it to a C&C server that causes malicious code behavior. And, if the network connection inducing device does not receive a response packet from the C&C server within a certain time, the network connection inducing device transmits a separate virtual response packet and an access request together to the terminal.

Thereafter, data related to malicious code analysis received from the terminal may be extracted.

As an example of using a virtual response packet, a packet format for creating a virtual response packet TCP session is sufficient. A general Transmission Control Protocol (TCP) protocol used by malicious code may generate a data packet transmitted by the client terminal to create only a TCP session. In addition, important information required for dynamic analysis of malicious code can be extracted from the data packet. In this way, even if the management server does not operate, dynamic analysis can be performed using the operation of the network connection inducing device.

In this way, the embodiment may analyze an event issued by executing a received file and store dynamic analysis information in a database.

4 discloses an example of obtaining in-depth analysis information in a process of generating analysis information according to the disclosed embodiment.

Acquiring the psychological analysis information according to the disclosed embodiment includes a feature of identifying an attack technique or an attacker that causes malicious behavior by disassembling an executable file including the received file and analyzing it at the machine language level. do.

In-depth analysis information may be obtained using the results of the static analysis or dynamic analysis described above, or an executable file may be analyzed as a file causing malicious behavior according to an analysis standard of an analyzer.

Further, the in-depth analysis information may include analysis information of the file itself or information obtained by processing the file several times, and may be performed based on already stored information.

The in-depth analysis may include disassembling, disassembling machine language level code extraction, attack behavior (TTP) identification, attacker identification, and taint analysis.

A detailed example with reference to the drawings is as follows.

If the input file includes an executable file, in-depth analysis disassembles the executable file (S2410).

Disassembled assembly codes may include an operation code (OP-CODE) and an operand. An operation code (OP-CODE) represents a machine language instruction that can be called a command code, and an operand represents information necessary for an execution operation, that is, target data or a memory location of the machine language instruction.

Hereinafter, for convenience, the parts excluding the OP-CODE among the disassembled assembly codes are referred to as ASM-CODE. Therefore, below, ASM-CODE may include an operand part.

Through disassembly, an executable file in object code format is converted into a specific format, for example code in assembler language format or disassembled code. From these disassembled codes, OP-CODE (operation code) and ASM-CODE having a certain format can be extracted (S2420).

The extracted disassembled code can be converted into a certain type of data format. An example of conversion of a certain type of data format is disclosed below.

The in-depth analysis may identify an attack based on the extracted disassembled code or the data format converted to the predetermined format (S2430).

The OP-CODE in the disassembled code is a part of machine language instructions that specify the operation to be performed. Each attack activity may have a very similar value or format. Therefore, by analyzing these OP-CODEs and ASM-CODEs, specific attack behaviors can be distinguished.

Disassembled codes may be extracted from an executable file, and the extracted disassembled codes may be separated according to an execution function.

For example, the OP-CODE and ASM-CODE extracted from the disassembled code or the recombined code of the disassembled code is a hash value such as a fuzzy hash method or a context triggered piecewise hashes (CTPH) method, or It can be converted into a certain type of code.

The embodiment can identify the attack by converting the disassembled code of the executable file into a certain format and matching it with detailed elements of the attack that are commonly recognized by cyber security expert groups.

In addition, based on the database storing the already extracted disassembled codes and the matching relationship for each attack behavior (TTP), the attack behavior (TTP) can be identified. In this case, it is possible to perform high-speed matching of fuzzy hash values according to the CTPH algorithm of the extracted disassembled codes or data obtained by converting them into a certain format, and each attack behavior (TTP).

As an example of a database storing the attack behaviors of such a group of security experts, a database storing information such as MITER ATT&CK may be exemplified. MITER ATT&CK is one of the databases for actual security attack techniques or behaviors, and by displaying specific security attack techniques or behaviors as elements in a matrix form, attack techniques and behaviors can be identified in the form of a certain data set.

MITER ATT&CK categorizes the attack techniques of hackers or malicious codes by attack stage and expresses them in a matrix of CVE codes (Common Vulnerabilities and Exposures Code).

The embodiment analyzes the disassembled code to identify a specific attack behavior among various attack behaviors, but matches the identified type of attack behavior to the actual attack codes recognized by expert organizations, so that the identification of the attack behavior is specialized. It can be expressed as elements that are recognized in common.

Since the OP-CODE in the disassembled code is a machine language command that causes a specific action, OP-CODEs of files that cause the same attack action can be very similar. However, since the same attack behavior and the OP-CODE included in the file that causes it are not exactly the same, the embodiment can perform artificial intelligence-based machine learning on the disassembled code including the OP-CODE. there is. When machine learning is performed, whether an attack code having a similarity higher than a threshold value is included and an attack method of the attack code can be identified.

Accordingly, even if the disassembled codes of the files causing the same malicious behavior are not completely identical, the file performing the malicious behavior can be identified based on the disassembled code.

As a machine learning algorithm, algorithms such as Perceptron, Logistic Regression, Support Vector Machines, and Multilayer Perceptron may be used.

The similarity of the fuzzy hash values of the disassembled codes can be finally detected as malicious code by matching the similarity of the fuzzy hash values of the disassembled codes with the previously learned attack codes of attack techniques such as MITER ATT&CK using the AI algorithm.

Further, in the embodiment, by using the result of artificial intelligence machine learning, it is possible to more accurately and quickly identify an attacking behavior corresponding to the disassembled code or vulnerable elements of the attacking behavior.

Specific embodiments for this will be disclosed in detail with reference to the drawings below.

An embodiment of the in-depth analysis may also include identifying an attacker who causes a similar attack behavior using the disassembled code and artificial intelligence-based machine learning results (S2440). Similarly, specific examples of attacker identification will be described later.

In addition, an embodiment of the in-depth analysis may include taint analysis that can determine whether there is an attack behavior through memory analysis of the system at a specific point in time even in the case of fileless malicious code. (S2450).

In-depth analysis is based on processing the disassembled code of the executable file, and identification of attack techniques or attackers or taint analysis may be selectively performed.

The final in-depth analysis information performed in this way may be stored in a database as in-depth analysis information corresponding to a corresponding file.

5 discloses an example of disassembling malicious code and determining that the file contains malicious behavior as an example of in-depth analysis.

As described above, if the executable file is disassembled, OP-CODE and ASM-CODE, which are assembly language code formats, can be obtained.

For example, a specific function A in an EXE executable file may be converted into disassembled code including OP-CODE or disassembled code by passing through a disassembler.

If the EXE executable file is malicious code that causes malicious behavior, a disassembled code set that causes malicious behavior can be obtained by disassembling functions or code parts that cause such behavior.

The disassembled code set may include an OP-CODE set corresponding to the malicious behavior or malicious code or a combination of OP-CODE and ASM-CODE.

Even if the malicious behavior is the same, since the disassembling result of the algorithm or executable file of the malicious code to perform it is not exactly the same, artificial intelligence-based similarity analysis identifies whether the entered malicious code corresponds to a specific set of disassembled codes. can do.

In this way, the malicious behavior corresponding to a specific disassembled code set can be used to identify an attack technique (TTP) by responding to a specialized and common attack method or attack technique such as MITER ATT&CK.

Alternatively, an OP-CODE set in a specific disassembled code or a combination set of OP-CODE and ASM-CODE can be used to determine an attack technique by matching it with attack technique elements defined in MITER ATT&CK.

This figure shows an example of correspondence of attack techniques corresponding to attack technique elements in an executable file, a disassembled code set of the corresponding executable file, and MITER ATT&CK.

6 discloses an example of calculating correlation analysis information in a process of generating analysis information according to the disclosed embodiment.

The obtained various analysis information can be used as cyber threat infringement information, and based on the cyber threat infringement information, correlation analysis information indicating a relationship between an attacker or an attack technique is generated.

A cyber threat indicator of compromise (IoC) refers to a set of pieces of information that identifies actual or potential cyber security threats, attacks, or malicious behavior on a system or network. For example, cyber threat infringement information (IoC) indicates files that refer to these actions, various traces appearing on log information, files themselves, paths, etc., or information that allows these actions to be inferred.

Using the files identified such as static, dynamic, and in-depth analysis information that have already been analyzed, the relationship between the analysis information and the attack behavior (S2510), the relationship between the hostname of the website or included in the email (S2520), Associations of URLs (S2530) and codesigns of files (S2540) can be obtained.

The process of obtaining correlation analysis information exemplified here is an example and does not necessarily follow the exemplified sequence or analyze all correlations. For example, it is possible to obtain a relation to a related file by using only the relation of IP and URL between analysis information and an attack. This correlation analysis information can be used to accurately infer an attack technique or an attacker.

Even if an attacker or an attacker is not identified through static analysis, dynamic analysis, or in-depth analysis, information that can be used to estimate the attacker or attacker can be obtained by using the correlation between the analyzed information. A detailed description thereof will be described below with reference to the drawings.

The correlation analysis information may be continuously and cumulatively stored for the received file, and the stored correlation analysis information may be updated again whenever a new file is received in the future.

Based on the various analysis information analyzed above, cyber threat infringement information is obtained.

In addition, it is possible to obtain various relational information that can identify an attacker or an attacker using cyber threat infringement information (IoC) (S2550).

This cyber threat infringement information (IoC) can be used to obtain correlation analysis information that infers an attack technique later. Association analysis and an example in which an attacker can be tracked or an attack behavior can be inferred using the analysis will be described in detail below.

Also, the acquired correlation analysis information may be stored in a server or database again in correspondence with the corresponding file.

As described above, the analyzed information may be collected and standardized through a process of deduplication, standardization, and enrichment. For example, static analysis information, dynamic analysis information, in-depth analysis information, and correlation analysis information may be provided to users or stored in a standardized format to update or reproduce cyber threat information later.

Here, redundant or common analysis information of each piece of analysis information may remove overlapping portions, and enrichment of data of insufficient portions may be performed.

In addition, it may be provided as cyber threat information according to a user's query or service policy. The provision of cyber threat information will also be described in detail below.

Such cyber threat information may be provided directly to the user or may be provided according to the user's request or service after being generated as cyber threat prediction information described below.

7 is a diagram illustrating an example of a process of obtaining correlation analysis information according to the disclosed embodiment.

In this drawing, files A-1 (10), A-2 (20), and B-1 (30) refer to files that can cause malicious behavior, and the server (A) 110 and the server (B) 120 ) represents a C&C server that causes malicious behavior.

It is assumed that when the file of file A-1 (10) is received and dynamic analysis is performed according to the disclosed embodiment, it is confirmed that the server (A) 110 is accessed when the file A-1 (10) is executed. .

According to the embodiment, the stored analysis information of the file A-2 (20) similar to the file A-1 (10) can be obtained from a database storing various analysis information on malicious codes. From the analysis information of the file A-2 (20), it can be found that the server (A) 110, which is the same server, utilizes the file A-1 (10) and the file A-2 (20), and from this information, the server (a) ) 110 can be assumed to be a hacker using the same attack technique or the same server.

According to the embodiment, when the file A-2 (20), which is a file that has already been analyzed, connects not only to the server (A) 110 but also to the server (B) 120, the server ( B) The information of (120) can be stored.

If the file A-1 (10) and the file A-2 (20) are completely different files, but the analysis information of the file B-1 (30) stores the record of accessing the server (B) (120), the file format is Although different, server (A) 110 and server (B) 120 may be the same attacker group or an attacker group using the same technique.

Therefore, by analyzing the correlation of various analysis information related to files, grouping information on attackers and attack techniques that cause malicious behavior can be obtained, and this correlation analysis information is used to identify an attacker or attacker group. It can be.

Hereinafter, an example for explaining cyber threat prediction information will be disclosed.

Cyber threat prediction information may be generated based on at least one of the file identification information and the obtained analysis information, or based on a collected data set.

8 discloses an example of generating prediction information of cyber threat information according to an embodiment. An example of generating prediction information of cyber threat information will be described with reference to the drawings.

When a data set for analysis information is secured, it is possible to generate predictive information related to future attack behavior based on the data set.

By processing the data set according to the analysis information extracted as above into an artificial intelligence-based learning data set and performing artificial intelligence analysis based on the processed learning data set, it is possible to generate various predictive information related to an attack behavior.

The data set of prediction information generated in this way may be repeatedly generated or processed as a new training data set.

In the embodiment of this figure, the data set of the above analysis information is analyzed through artificial intelligence learning to obtain malicious code creator's prediction information (S3110), malicious code attack method prediction information (S3120), and malicious code attack group prediction information (S3130). , Malicious code similarity prediction information (S3140), malicious code spread prediction information (S3150), etc. are generated.

Here, the order of predictive information is an example, and the order of obtaining predictive information can be changed. For example, the order of the malicious code similarity prediction information (S3140) and the malicious code spread prediction information (S3150) may be changed, and the generation of the remaining prediction information does not necessarily follow the illustrated order.

In addition to the exemplified similarity prediction information, it is also possible to generate additional prediction information related to cyber threat information.

The generated malicious code prediction information is composed of risk prediction information that predicts its own risk, predictive information that predicts the attacker, attack group, similarity, spread, etc., or comprehensive prediction information of malicious code that comprehensively displays the prediction information. It can be divided and stored in a database.

Using the analysis information and prediction information of the above cyber threat information, it is possible to identify the type of malicious code related to the input file and determine the risk level thereof.

In addition, profiling information including a record of malicious code related to the input file may be created and stored. The analysis information, prediction information, risk level, or profiling information related to the stored malicious code is additionally provided so that the user can easily view it. can be processed.

An example of providing cyber threat information to a user is as follows.

Since various correlation analysis information may be generated based on a specific file, a very large amount of data communication may be required for cyber threat infringement information (IoC). In order to quickly respond to cyber security threats, the embodiment can share, store, inquire, and update such information within a short period of time.

Based on the analysis information as described above, when a security event occurs, the embodiment transmits the cyber threat breach information (IoC) related to the security event to the cyber threat breach information (IoC) storage server or other user terminals through encrypted socket communication. Inquiry can be requested using P2P socket communication. In addition, information that quickly receives cyber threat IoC among cyber threat IoC storage servers or other user terminals may be used as cyber threat IoC.

As another example of providing cyber threat information, when a terminal used by a user searches for information on the analyzed malicious code as described above, the searched information may be provided as follows.

For example, when a terminal used by a user calculates a hash value of a file, a query to inquire whether or not there is a malicious code may be transmitted to the server in a text format for the calculated hash value. The server that has received the hash value and the query transfers the hash value to the database storing the malicious code information as described above and receives a search result for the hash value. The server receiving the query result may return the result to the user terminal as a text value corresponding to the hash value.

Another example of providing cyber threat information according to a user's request based on stored malicious code information will be described with reference to the drawings.

9 discloses examples of malicious code queries for providing cyber threat information according to an embodiment.

An embodiment of cyber security threat information processing may store the malicious code identified based on the analysis information and prediction information calculated as above together with various meta information.

As described above, the user may request the exemplified inquiry to the database in which malicious code information is stored.

Referring to Query (A), the user may search the database storing cyber threat information according to the embodiment for a period related to malicious code, the quantity of specific malicious code, detection name, file type, distribution place, code sign, and Malicious code can be queried by category such as file size.

Then, the database storing cyber threat information returns cyber threat information or malicious code information corresponding to the query through the server.

As another example, as exemplified in Query (B) of this figure, the user may inquire about a specific date related to malicious code, quantity of specific malicious code, file type, distribution location, creation of child processes, and the like.

As exemplified in Query (C), the user can detect malicious code by using information on the period related to malicious code, quantity of specific malicious code, file type, distribution location information, file name information, attack behavior according to malicious code execution, and file size. You can query information about

An example of Query (D) may query information about malicious codes by using the period related to malicious codes, quantity of specific malicious codes, file type, distribution address, and statistical information of malicious codes.

As described above, in the embodiment of the cyber security threat information processing method, analysis information and prediction information are stored together with malicious code in a database in order to provide malicious code information corresponding to a user's query.

Accordingly, the server can obtain information on malicious code matching the query condition from the database and transmit it to the user.

As illustrated, the user can search malicious code information using various meta information of a file. The user can obtain in advance information to be protected or information that may cause damage or threat to the system by malicious code.

10 is a diagram illustrating an embodiment of a cyber security threat information processing device. The embodiment of this drawing conceptually exemplifies a cyber security threat information processing device. An embodiment of the cyber security threat information processing device will be described with reference to this drawing.

The disclosed cyber security threat information processing device includes a database and a server 2100 as a physical device 2000 and a platform (10000) including an application programming interface (API) running on the database 2200 and the physical device 2000. ). Hereinafter, the platform 10000 is referred to as a cyber threat intelligence platform (CTIP) or simply the intelligence platform 10000 .

The server 2100 includes an arithmetic unit such as a central processing unit (CPU) or a processor and may store or read data from the database 2200 .

The server 2100 calculates and processes input security-related data, executes files, generates various security events, and processes related data. In addition, the server 2100 may control input and output of various cyber security related data and store data processed by the intelligence platform 10000 in the database 2200 .

The server 2100 may include a network device for data input or a network security device. The central processing unit, processor or arithmetic unit of the server 2100 may perform a framework illustrated in the following drawings or a module within the framework.

The intelligence platform 10000 according to an embodiment provides an application programming interface (API) for processing cyber threat information. For example, the intelligence platform 10000 may receive files or data from a network security device connected to a network or cyber malicious behavior prevention programming software that scans and detects malicious behavior.

For example, the intelligence platform 10000 according to the embodiment includes a Security Information and Event Management (SIEM) API that provides security events, an Environmental Data Retrieval (EDR) API that provides data about an execution environment, and a defined security Functions such as a firewall API that monitors and controls according to policies can be provided. In addition, the intelligence platform 10000 may also provide an API of IPS (Intrusion Prevention Systems) that performs a role similar to a firewall between internal and external networks.

The application programming interface (API) 1100 of the intelligence platform 10000 according to the embodiment may receive files containing malicious codes that perform cyber security attacks from various client devices 1010, 1020, and 1030. there is.

The intelligence platform 10000 according to an embodiment may include a pre-processing unit (not shown), an analysis framework 1210, a prediction framework 1220, an AI engine 1230, and a post-processing unit (not shown).

The pre-processing unit of the intelligence platform 10000 performs pre-processing to analyze cyber threat information on various files received from the client devices 1010, 1020, and 1030.

For example, the pre-processing unit may process the received file and obtain various meta information including source information of the file, collection information obtained from the file, user information of the file, etc. from the file. For example, if a file contains a URL (uniform resource locator) or is included in an e-mail, collection information about the file can be obtained. User information may include user information that has been created, uploaded, or finally stored in a file. In the preprocessing process, IP (internet protocol) information, country information based thereon, API (Application Programming Interface) key information, etc. may be obtained as meta information of a file.

A pre-processing unit (not shown) of the intelligence platform 10000 may extract a hash value of an input file. If the hash value is already known to the cyber security threat information processing device, the type of file can be identified based on this.

If the file is not already known, identify the file type by searching the hash value and file information on reference Internet sites for cyber threat information such as C-TAS (Cyber Threats Analysis System), CTA (Cyber Threat Alliance) operating system, and VitusTotal. You can get analysis information for

As described above, the hash value of the input file may be a hash value of a hash function such as MD5 (Message-Digest algorithm 5), SHA1 (Secure Hash Algorithm 1), or SHA 256.

The analysis framework 1210 may generate analysis information on malicious code from an input file.

The analysis framework 1210 may include analysis modules according to various analysis methods, such as a static analysis module 1211, a dynamic analysis module 1213, an in-depth analysis module 1215, and a correlation analysis module 1217.

The static analysis module 1211 may analyze malicious code-related information about the file itself as analysis information of malicious behavior related to the input file.

The dynamic analysis module 1213 may analyze malicious code-related information by performing various actions based on various information obtained from an input file.

The in-depth analysis module 1215 may analyze malicious code-related information by using information obtained by processing an executable file related to an input file or by performing memory analysis related to an executable file. The in-depth analysis module 1215 may include artificial intelligence analysis to accurately identify malicious behavior.

The relational relation analysis module 1217 may include relational relational analysis information capable of estimating a relational relation to an attacker or an attacker by correlating already stored analysis information or generated analysis information in relation to an input file. .

The analysis framework 1210 uses the information analyzed from the static analysis module 1211, the dynamic analysis module 1213, the in-depth analysis module 1215, and the correlation analysis module 1217 to analyze the characteristics and behaviors of malicious code. may be combined with each other, and the combined final information may be provided to the user.

For example, the analysis framework 1210 may integrate and analyze static analysis information, dynamic analysis information, in-depth analysis information, correlation analysis information, etc. of one file to identify an accurate attack technique and an attacker. The analysis framework 1210 removes redundant parts between analysis information and uses common information between analysis information to increase accuracy.

The analysis framework 1210 can standardize the information provided, for example, normalizing or enriching indicators of compromise (IoCs) collected through various analyzes and paths. work In addition, analysis information on the final standardized malicious code or malicious behavior may be generated.

The static analysis module 1211, the dynamic analysis module 1213, the in-depth analysis module 1215, and the correlation analysis module 1217 of the analysis framework 1210 provide artificial intelligence to the data to be analyzed to increase the accuracy of the analyzed data. Machine learning or deep learning techniques can be performed according to the analysis.

The AI engine 1230 may perform an artificial intelligence analysis algorithm to generate analysis information of the analysis framework 1210 .

This information may be stored in the database 2200, and the server 2100 may provide analysis information on malicious codes or malicious behaviors stored in the database 2200 as cyber threat intelligence information according to a user or client request. .

The prediction framework 1220 may include a plurality of prediction information generation modules according to prediction information, such as a first prediction information generation module 1221 and a second prediction information generation module 1223. The prediction framework 1220 may generate prediction information about whether a malicious action has occurred, an attack technique, an attacker group, etc., using the analyzed data set of various information in order to increase analysis accuracy.

The prediction framework 1220 predicts malicious behavior related to the input file by performing an artificial intelligence analysis algorithm using the AI engine 1230 based on the data set for the analysis information analyzed by the analysis framework 1210. information can be generated.

The AI engine 1230 learns the data set for the analysis information through artificial intelligence-based machine learning to generate additional analysis information, and the additional analysis information is again used as input data for artificial intelligence as new learning data. there is.

The prediction information generated by the prediction framework 1220 may include malicious code creator information, malicious code attack method information, malicious code attack group prediction, malicious code similarity prediction information, and malicious code spread prediction information.

As described above, the prediction framework 1220 that generates prediction information related to various malicious codes or attacks may store the generated prediction information in the database 2200. In addition, prediction information generated according to a user's request or an attack symptom may be provided to the user.

As described above, the server 2100 may provide cyber threat information related to the input file after post-processing the analysis information or prediction information stored in the database 2200.

The processor of the server 2100 determines the type of malicious code and the risk level of the malicious code based on the generated analysis information or prediction information.

A processor of the server 2100 may generate profiling information about malicious code. The database 2200 may store a result of self-analysis on a file or a result of performing additional and predictive analysis through file analysis.

The cyber threat information provided to the user by the server 2100 includes information on which the described preprocessing has been performed, generated or identified analysis information, generated prediction information, or aggregation information of these information or information determined based on the information. can do.

The provided cyber threat information may include information analyzed or predicted using analysis information stored in a database in relation to an input file or analyzed or predicted above.

According to the embodiment, when a user searches for cyber threat information on not only a malicious action on an input file but also a previously stored file or malicious action, information on this may be provided.

This integrated analysis information may be stored in a standardized format in a server or database corresponding to a corresponding file. This integrated analysis information is stored in a standardized format and can be used to search or query cyber threat information.

11 illustrates an example for explaining in detail the function of a static analysis module in an analysis framework according to the disclosed embodiment. Referring to this figure, the execution process of the static analysis module is exemplified as follows.

As disclosed, the analysis framework 15000 of the intelligence platform 100 may include a static analysis module 15100.

The static analysis module 15100 may analyze the file itself, based on the file or meta information of the file, in relation to the file, such as the existence of coding-based vulnerable items, interface or function call structure problems, or the binary structure of the file. Information that can be related to malicious behavior can be obtained.

The static analysis module 15100 includes a file structure analysis module 15101, a file pattern analysis module 15103, a file production information analysis module 15105, a file environment analysis module 15107, and a file related analysis module 15109. can do.

Among the static analysis modules 15100, the file structure analysis module 15101 may analyze basic structural information of the identified file in an environment where the file is not executed.

The file structure analysis module 15101, even if the file type is different, for example, ELF (Executable and Linkable Format), PE (Portable Executable), APK (Android Application Package), etc., from the file structure above the file or its structure. Acquire or analyze extractable information.

The file pattern analysis module 15103 can perform file pattern analysis. The file pattern is obtained by checking various strings that can be extracted by opening the file itself without taking any action on the identified file. can

The file production information analysis module 15105 may obtain and analyze information related to production of an input file. The file production information analysis module 15105 can obtain unique information or meta information of a file, for example, file maker information, codesigning information in the case of an executable file, and the like.

The file environment analysis module 15107 may analyze environment information of an input file. The file environment analysis module 15107 can obtain information such as system environment component information that a target file should have.

The file related analysis module 15109 may also analyze various other meta information related to the input file.

The static analysis module 15100 may convert the static information of the file obtained as described and analyzed into a data format such as JSON (JavaScript Object Notation) and store it in the database 2200 without executing the input file.

The server 2100 may provide static analysis information on files stored in the database 2200 to the user.

The static analysis module 15100 of the analysis framework 15000 compares the hash value of the input file with the hash value already stored for malicious code in the database 2200 to determine whether the input file is malicious code. can be analyzed. Also, the information analyzed on the malicious code of the input file may be stored in the database 2200 .

If the input file is mobile data, the static analysis module 15100 of the analysis framework 15000 may extract code information of a suspected mobile malicious code from the input file. The code information of the suspected malicious code may include hash information, code size information, file header information, identifiable string information included in the code, operating platform information, and the like.

The static analysis module 15100 of the analysis framework 15000 may detect whether there is malicious code in a file based on the analyzed analysis information. In addition, static analysis information related to the detected malicious code may be stored in the database 2200 .

12 shows an example for explaining in detail the function of the dynamic analysis module in the analysis framework according to the disclosed embodiment. Referring to this drawing, the process of performing the dynamic analysis module is exemplified as follows.

The analysis framework 15000 of the illustrated intelligence platform 10000 may include a dynamic analysis module 15200. The dynamic analysis module 15200 may obtain dynamic analysis information according to result data executed in an execution environment of a file identified based on at least one of preprocessed file information and static analysis information.

The dynamic analysis module 15200 may detect a vulnerable or dangerous anomaly by analyzing various input/output data in an environment where a file is being executed or by analyzing a change in an interaction with an execution environment when a file is being executed. The dynamic analysis module 15200 may create a virtualized environment and directly execute a file in the created virtualized environment to analyze abnormalities.

The dynamic analysis module (15200) of the analysis framework (15000) includes an environment preparation module (15201), a file execution module (15203), an action collection module (15205), an analysis result collection module (15207), and an analysis environment recovery module (15209). ) may be included.

The environment preparation module 15201 creates and prepares a dynamic analysis environment for executing an executable file related to an input file. When the type of execution file is identified, the environment preparation module 15201 can identify which execution environment is required according to the type of each file. For example, depending on the file, it can identify whether the file is executed in a Windows operating system, a Linux operating system, or a mobile device operating system. The environment preparation module 15201 may prepare an identified environment for executing an executable file.

The file execution module 15203 executes the file in the analysis environment prepared by the environment preparation module 15201 to determine whether the executable file contains malicious code.

The behavior collection module 15205 may collect events occurring in the system during the execution of files executed in the execution environment in order to obtain dynamic analysis information. For example, the behavior collection module 15205 may collect events for files, processes, memories, registries, systems in the network, or events that change the settings of each system.

The analysis result collection module 15207 analyzes the events collected by the action collection module 15205 individually or collectively.

The analysis environment recovery module 15209 restores the environment for dynamic analysis after collecting the collected results.

The dynamic analysis module 15200 may store the obtained result in the database 2200 as dynamic analysis information corresponding to the corresponding file or malicious code of the file.

An example in which the dynamic analysis module 15200 collects and analyzes dynamic analysis information according to the above embodiment is briefly disclosed as follows.

As an example of dynamic analysis, the dynamic analysis module 15200 generates a mobile terminal or an emulator or virtualization environment configured identically to the mobile terminal environment for the file when the input file is identified as a file operating in the mobile device operating system. can do. And, the dynamic analysis module 15200 can directly execute the file in the created emulator or virtualization environment. The dynamic analysis module 15200 can extract and record all changes that occur in the terminal after the suspected mobile malicious code is executed in a file, that is, behavior information. The action information may include event information such as process, file, memory, and network information even when the operating system (OS) environment of the terminal is different.

As another example of dynamic analysis, the dynamic analysis module 15200 converts the hash value of the file extracted from the terminal to the intelligence platform (10000 ) can be received through

If the hash value of the corresponding file is not already stored in the database 2200, the dynamic analysis module 15200 executes the received file in a virtual or real operating system, collects actions occurring during execution in real time, and collects the collected dynamic Analysis information may be compared with information already stored in the database 2200 .

As a result of the comparison, if it exceeds a predefined risk level, it may be determined that the input file contains malicious code, and the dynamic analysis module 15200 may store the hash value of the file corresponding to the malicious code in the database 2200. there is. The stored malicious hash value can be used later for static analysis.

Malicious code can communicate with an external server, issue additional commands, and receive files.

However, when the platform and server capable of performing dynamic analysis are stopped, such dynamic analysis may take a very long time, and there are cases in which dynamic analysis cannot be performed even when the corresponding action is blocked in advance.

When the dynamic analysis module 15200 according to the embodiment analyzes network behavior, a command and control server (C&C server) used by malicious codes, a download server for downloading additional malicious codes, or information exchange between malicious codes or hackers It is possible to extract and analyze information such as communication packets exchanging information with and.

The dynamic analysis module 15200 disclosed herein may perform dynamic analysis even when the server 2100 is stopped.

For example, a network access inducer (not shown) may process a connection request of a terminal between a client terminal infected with malicious code and the intelligence platform 10000 or server 2100 to perform dynamic analysis.

A device for inducing network access (not shown) may receive an access request from a terminal and transmit it to a C&C server that causes malicious code behavior.

And, if the network connection inducing device does not receive a response packet from the C&C server within a certain time, the network connection inducing device transmits a separate virtual response packet and an access request together to the terminal.

Thereafter, data related to malicious code analysis received from the terminal may be extracted.

As an example of using a virtual response packet, a packet format for creating a virtual response packet TCP session is sufficient. A general Transmission Control Protocol (TCP) protocol used by malicious code may generate a data packet transmitted by the client terminal to create only a TCP session. In addition, important information required for dynamic analysis of malicious codes can be extracted from the data packet. In this way, even if the management server does not operate, dynamic analysis can be performed using the operation of the network connection inducing device.

13 shows an example for explaining in detail the function of an in-depth analysis module among analysis frameworks according to the disclosed embodiment. Referring to this drawing, the process of performing the in-depth analysis module is exemplified as follows.

The analysis framework 15000 of the intelligence platform 10000 may include an in-depth analysis module 15300. The in-depth analysis module 15300 may disassemble an executable file including the received file and analyze it at the machine language level to identify an attack technique or an attacker that causes malicious behavior.

The in-depth analysis module 15300 may obtain in-depth analysis information based on the static analysis or dynamic analysis described above, or may analyze an executable file according to an analysis standard by using a file that causes a malicious action.

The in-depth analysis module 15300 may include analysis information of the file itself or information obtained by processing the file several times, and may generate in-depth analysis information based on already stored information.

The in-depth analysis module 15300 also includes a disassembling module 15301, a machine language code extraction module 15303, an attack behavior (TTP) identification module 15305, an attacker identification module 15307, A taint analysis module 15309 may be included.

In the analysis framework 15000, the in-depth analysis module 15300 performs an artificial intelligence-based machine learning algorithm using the AI engine 1230, and as a result, in-depth analysis information can be obtained.

The disassembling module 15301 disassembles the executable file when the input file includes an executable file.

When an executable file is disassembled, it is converted into code in a specific form in object code format, for example in assembler language format.

The machine language code extraction module 15303 may extract OP-CODE (operation code) having a certain format and disassembled code including ASM-CODE. OP-CODE (operation code) having a certain format means the part of the OP-CODE related to the malicious code, and the disassembled code including the extracted OP-CODE refers to the part related to the malicious code or the malicious behavior.

The machine language code extraction module 15303 may convert the disassembled code into a certain data format. An example of conversion of a certain type of data format is disclosed below.

The attack can be identified by matching the disassembled code of the executable file with detailed attack action elements commonly recognized by cyber security expert groups.

The attack behavior (TTP) identification module 15305 can identify an attack behavior, an attack technique, and an attack process based on extracted disassembled code or data in a format converted into a certain format.

The attack behavior (TTP) identification module 15305 identifies the attack behavior by matching the fuzzy hash value based on the disassembled code of the executable file with the attack behavior details commonly recognized by cyber security expert groups. can

The Attack Behavior (TTP) identification module 15305 identifies the Attack Behavior (TTP) based on the database 2200 or an external reference database that stores the matching relationship between already extracted disassembled codes and each Attack Behavior (TTP). can do. The attack behavior (TTP) identification module 15305 performs matching similarity for each attack behavior (TTP) with the fuzzy hash value of the CTPH algorithm of the disassembled codes extracted using the machine learning of the AI engine 1230 at high speed. Attack behavior or attack technique can be classified.

The OP-CODE in the disassembled code is a part of machine language instructions that specify the operation to be performed, including OP-CODEs that cause cyber security attack techniques or attacks (TTP). The disassembled code to attack may have a very similar value or format for each attack. Therefore, by analyzing the disassembled code, which is a combination of OP-CODE and ASM-CODE, a specific type of attack can be distinguished.

For example, the attack behavior (TTP) identification module 15305 may convert the disassembled code extracted from the executable file into a hash value of a fuzzy hash method or a context triggered piecewise hashes (CTPH) method.

As a machine learning algorithm of the AI engine 1230 performed together with the TTP identification module 15305, algorithms such as Perceptron, Logistic Regression, Support Vector Machines, and Multilayer Perceptron may be used. In addition, an ensemble machine learning algorithm or natural language processing algorithm may be used as the AI engine 1230. An example for this is disclosed in detail below.

As an example of a database storing attack behaviors of a group of security experts, MITER ATT&CK is a database for actual security attack techniques or behaviors. The attack behavior (TTP) identification module (15305) is a disassembled The code allows the converted hash value to be identified as a certain data set format or identifier on MITER ATT&CK's database.

MITER ATT&CK expresses the vulnerable factors for attack techniques of hackers or malicious codes as a matrix of CVE codes (Common Vulnerabilities and Exposures Code).

The embodiment identifies a specific attack behavior among various attack behaviors by analyzing the disassembled code, but matches the identified type of attack behavior with the elements of the attack behavior recognized by expert organizations, so that the identification of the attack behavior is professional and It can be expressed with commonly recognized elements.

As described above, since OP-CODE is a machine language instruction that causes a specific action, disassembled codes of files that cause the same attack action can be very similar. However, since the attack behavior and the disassembled code of the file that causes it do not exactly match, there may be some differences in the code.

The attack behavior (TTP) identification module 15305 causes the AI engine 1230 to perform machine learning on the code converted from the extracted disassembled code into a certain format. Therefore, even if the OP-CODEs of the files that cause the same malicious behavior are not exactly the same, the attack behavior (TTP) identification module 15305 matches the fuzzy hash value based on machine learning and the extracted OP-CODE with the corresponding attack element to identify attack behavior.

The attack behavior (TTP) identification module 15305 may match the similarity of the disassembled codes to an attack technique such as MITER ATT&CK using an AI algorithm to finally detect that the corresponding file is malicious code.

A specific example of this will be described later.

The attacker identification module 15307 may also include a step of identifying an attacker causing a similar attack behavior using the extracted disassembled code and artificial intelligence-based machine learning results. Similarly, specific examples of attacker identification will be described later.

The taint analysis module 15309 can determine whether there is an attack behavior through system memory analysis at a specific point in time even in the case of fileless malicious code.

The deep analysis module 15300 may store in the database 2200 deep analysis information corresponding to a corresponding file or a malicious code identified from the file.

14 illustrates an example for explaining in detail the function of a correlation analysis module in an analysis framework according to the disclosed embodiment. Referring to this figure, the execution process of the association analysis module is exemplified as follows.

The analysis framework 15000 of the intelligence platform 10000 may include a correlation analysis module 15400. The correlation analysis module 15400 generates correlation analysis information so that various analysis information analyzed by the analysis framework 15000 is expressed as a relationship between an attacker or an attack technique based on cyber threat breach information (IoC). do.

The correlation analysis module 15400 includes a first correlation analysis module 15401 that analyzes the relationship between analysis information and IP information, and analyzes the relationship between hostnames included in e-mail or websites. A second correlation analysis module (15403), a third correlation analysis module (15405) analyzing a relationship between URLs, a fourth relationship analysis module (15407) analyzing a relationship between codesigns of files, A fifth correlation analysis module 15407 that analyzes correlation between attack techniques may be included.

The modules shown in this figure are just examples, and even if not shown in this figure, the correlation analysis module 15400 includes modules that can analyze various relationships between the attack technique and the analyzed information to determine the attacker. can include For example, the relationship analysis module 15400 may include an integrated analysis module that collects or integrates generated relationship information.

The correlation analysis module 15400 may generate correlation analysis information used to accurately infer an attacking technique or an attacker.

The correlation analysis module 15400 continuously and cumulatively stores analysis information on received files or malicious codes, and whenever a new file or malicious code is analyzed in the future, the related relationship analysis module 15400 re-updates the database 2220. save to

The correlation analysis module 15400 may obtain cyber threat infringement information based on various analysis information (static analysis information, dynamic analysis information, in-depth analysis information, etc.) analyzed above.

The correlation analysis module 15400 can obtain various correlation information that can identify an attack or an attacker using cyber threat breach information (IoC), and store the analyzed correlation information in the database 2200. can

As described above, the analysis framework 15000 of the intelligence platform 10000 may synthesize analyzed information and store standardized information in the database 2220 through deduplication, standardization, and enrichment processes.

The intelligence platform 10000 may store static analysis information, dynamic analysis information, in-depth analysis information, and correlation analysis information in the database 2200 in a standardized format to update or reproduce cyber threat information.

Here, the intelligence platform 10000 may remove redundant parts of analysis information or overlapping parts of common analysis information, and may perform an enrichment operation of insufficient data.

The intelligence platform 10000 may store standardized information through post-processing in a format such as STIX or TAXII, which is a standard designed to prevent cyber attacks.

The server 2100 may provide standardized cyber threat information, such as analysis information generated by the analysis framework 15000 according to a user's query or service policy. A method of providing cyber threat information will be described in detail below.

Such cyber threat information may be provided according to a user's request or service.

15 shows an example for explaining in detail the function of the predictive information generating module of the predictive framework according to the disclosed embodiment. Referring to this figure, the execution process of the prediction framework is exemplified as follows.

The prediction framework 17000 of the exemplified intelligence platform 10000 may include a prediction information generation module 17100. The prediction information generation module 17100 may include a plurality of information prediction modules according to the prediction information to be generated. In this example, the prediction information generation module 17100 includes the first information prediction module 1711, the second information prediction module 1713, the third information prediction module 1715, the fourth information prediction module 1717, and the fifth information prediction module 1717. An example including the information prediction module 1719 is shown.

The prediction framework 17000 may use analysis information generated by the previously exemplified analysis framework (not shown). The prediction framework 17000 processes a data set based on various analysis information into an artificial intelligence-based learning data set, and the AI engine 1230 may perform artificial intelligence analysis based on the processed learning data set. .

Through the execution of the prediction framework 17000 and the AI engine 1230, it is possible to generate various prediction information related to an attack behavior.

In this example, the first information prediction module 1711 may generate prediction information of a malicious code maker through artificial intelligence learning. The second information prediction module 1713 may generate prediction information of a malicious code attack method, and the third information prediction module 1715 may generate prediction information of a malicious code attack group. Further, the fourth information prediction module 1717 generates malicious code similarity prediction information, and the fifth information prediction module 1719 generates malicious code spread prediction information.

An example of generating specific prediction information will be described later.

The prediction framework 17000 may store generated prediction information in the database 2200.

For example, the prediction framework 17000 may generate and store malicious code risk level prediction information in the database 2200 by predicting the risk of the specific malicious code itself.

In addition, the prediction framework 17000 may store predicted information on the creator, attack method, attack group, similarity, and spread of a specific malicious code in the database 2200 .

As disclosed above, the intelligence platform 1000 may generate a type of malicious code and a degree of risk of the malicious code based on analysis information or prediction information. Also, the intelligence platform 10000 may generate profiling information on malicious codes.

The intelligence platform 10000 may store in the database 2200 a result of performing its own analysis on a file or a result of performing additional and predictive analysis through file analysis.

The cyber threat information provided by the intelligence platform 10000 may include the above pre-processed information, generated analysis information, generated prediction information, or aggregation information of these information or additionally processed information based on this information. can

Therefore, the cyber threat information provided includes integrated analysis in relation to the input file.

The integrated analysis information provided by the illustrative intelligence platform 10000 may be stored in a standardized format in the database 2200 by the server 2100 in response to an input file. This integrated analysis information is stored in a standardized format and can be used for searching or querying cyber threat information.

Hereinafter, detailed embodiments according to each processing step or module are disclosed.

16 shows an example of performing static analysis according to the disclosed embodiment. An example of a static analysis method according to an embodiment is described with reference to the drawings, and is as follows.

As described above, the type of file can be identified in the pre-processing stage or in the initial stage of static analysis before performing static analysis. This figure illustrates a case where ELF, EXE, and ARK files are identified as file types for convenience, but the application of the embodiment is not limited thereto.

Static analysis or detection of malicious code can be operated based on the process of comparing the characteristics of the above file itself with the previously identified pattern database.

The static information extractor can obtain structure information by parsing the structure of the input file.

A pattern in the structure of the parsed file may be compared with a pattern of malicious code already stored in the database (DB) 2200 .

The structure characteristics and patterns of the parsed file may become meta information of the parsed file.

Although not shown in the example disclosed above, a machine learning engine may also be used in the static analysis of the disclosed embodiment. The database 2200 may store a data set including learned characteristics of previously stored malicious code.

The AI engine can learn the meta information obtained from the above-described broken file through machine learning, and compare a data set already stored in the database 2200 to determine whether it is malicious code.

For files that have been analyzed as malicious code through static analysis, the structural characteristics of the file can be saved back as a data set related to malicious code.

17 shows an example of performing dynamic analysis according to the disclosed embodiment. An example of a dynamic analysis method according to an embodiment is described with reference to the drawings, and is as follows.

As described above, the type of file can be identified in the pre-processing stage or the initial stage of dynamic analysis before performing dynamic analysis. Similarly, in this example, ELF, EXE, and ARK files are identified as the type of file for convenience.

Through pre-processing, it is possible to identify file types that are subject to dynamic analysis. The identified file can be executed in a virtual environment according to the type and type of each file.

For example, if the identified file is an ELF file, it can be executed in the operating system of a Linux virtual machine (VM) through a standby queue (Que).

Events that occur when an ELF file is executed can be recorded in an action log.

In this way, a Windows, Linux, and mobile operating system system is virtually constructed for each type of identification file, and then an execution event of the virtual system is recorded.

In addition, execution events of malicious codes already stored in the database 2200 may be compared with recorded execution events. Although not exemplified above, even in the case of dynamic analysis, recorded execution events may be learned through machine learning, and it may be determined whether the learned data is similar to previously stored execution events of malicious code.

In the case of dynamic analysis, a virtual environment must be built according to the files, and accordingly, the size of the analysis and detection system can increase.

18 shows an example of performing in-depth analysis according to the disclosed embodiment. An example of an in-depth analysis method according to an embodiment is described with reference to the drawings, and is as follows.

As described above, the type of file can be identified in the pre-processing stage or the initial stage of in-depth analysis before performing in-depth analysis. The disclosed example illustrates an executable binary file in which the identified file is ELF, EXE, or ARK.

By disassembling an executable binary file, the structure of functions in the instruction set of a central processing unit (CPU) can be analyzed.

Unlike dynamic analysis, in-depth analysis operates based on code extracted by disassembling binary files, so it is possible to analyze the size of the system relatively simply. In-depth analysis can perform artificial intelligence analysis based on data created through the process of normalizing extracted codes without a separate engine.

In this figure, the disassembled code is expressed as a combination of OP-CODE and ASM-CODE.

The embodiment may combine two codes based on OP-CODE and ASM-CODE, and extract a meaningful code block from the combined codes.

The code block of the disassembled code, including OP-CODE and ASM-CODE, is converted into a certain format to identify whether the code is related to malicious code, which malicious code it is, or which attacker developed it. there is.

There are several processes for data conversion of code blocks to determine this. The data conversion process of the disassembled code can be selectively applied according to the data processing speed and accuracy, but only the normalization process and the vectorization process are shown in this figure.

A normalization process and a vectorization process may be performed on the extracted code block of the combination code of OP-CODE and ASM-CODE.

That is, after extracting a code block by combining OP-CODE and ASM-CODE of binary code, vectorizing the feature information of this code block, and comparing it with the data learned through various feature information, attack actions, etc. to identify

Since all of the extracted code blocks may be different even in the same executable file, the embodiment uses a machine learning or artificial intelligence (AI) method to determine and classify the extracted code blocks as malicious code. is available.

And the embodiment learns the final data on which normalization and vectorization processes have been performed through artificial intelligence. The learned data may be compared with an attack technique (TTP) already stored in the database 2200 and data of an attacker or attack group to obtain information such as malicious code.

In the embodiment, components that are core parts of malicious codes can be classified and classified based on the MITER ATT&CK model.

A specific embodiment for this is disclosed in more detail below.

19 illustrates an example of matching attack techniques with codes extracted from binary codes according to the disclosed embodiment. Here, an example of using a standardized model as an example of matching an attack technique is disclosed.

Here, the MITER ATT&CK® Framework is exemplified as a standardized model.

For example, in terms of cyber security, “malicious behavior” was often interpreted differently depending on the analyst's interpretation method and each person's insight.

Internationally, many efforts are being made among experts to standardize the “malicious behavior” that occurs on systems and to ensure that everyone has the same interpretation. MITRE (https://attack.mitre.org), a non-profit research and development organization that was supported by the US federal government and carried out national security-related tasks, studied the definition of “malicious behavior” and created the ATT&CK® Framework accordingly. announced. This framework is defined so that everyone can define the same “malicious behavior” for cyber threats or malware.

MITER ATT&CK® Framework (hereinafter referred to as MITER ATT&CK®) is an abbreviation of Adversarial Tactics, Techniques, and Common Knowledge, which summarizes attacker's latest attack technique information. MITER ATT&CK® observes actual cases of cyber attacks, analyzes attack tactics and techniques for adversary behaviors of attackers, classifies and lists information on attack techniques of various attack groups This is standardized data.

MITER ATT&CK® systematizes (patterns) threatening tactics and techniques to improve the detection of intelligent attacks, taking a slightly different perspective from the traditional cyber kill chain concept. Originally, ATT&CK started by documenting TTP such as tactics, techniques, and procedures for hacking attacks used in corporate environments using the Windows operating system at MITRE. Since then, ATT&CK has developed into a framework that can identify an attacker's behavior by mapping TTP information based on the analysis of consistent attack behavior patterns generated by the attacker.

Malicious behaviors mentioned in the disclosed embodiments can be expressed by matching malicious codes to attack techniques based on a standardized model such as MITER ATT&CK®. You can match an identifier.

An example of this figure conceptually shows how the malicious behavior of the malicious code and the attack technique are matched based on the MITER ATT&CK model.

The executable file EXE may include various functions (Function A, B, C, D, E, ..., N, ..., Z) that are executed when the file is executed. A function group including at least one of the functions may perform one attack strategy.

In the example of this figure, functions A, B, and C correspond to tactic A, and functions D, B, and F correspond to tactic B. Similarly, functions Z, R, and C correspond to tactics C, and functions K and F correspond to tactics D.

In an embodiment, a set of functions corresponding to each attack strategy may correspond to a part of a specific disassembled code. The database already stores attack identifiers (T-IDs) of Tactics, Techniques, and Procedures (TTP) that can correspond to disassembled codes learned by artificial intelligence.

The Attack Identifier (T-ID) of the Tactics, Techniques, and Procedures (TTP) follows a standardized model and the example in the figure here illustrates MITER ATT&CK® as a standardized model for cyber threat intelligence. did

Accordingly, the embodiment may match result data extracted from disassembled code in a binary file with a standardized attack identifier. A more specific method of matching the attack identifier is disclosed below.

20 illustrates an example of matching a code set including an OP-CODE and an attack technique according to the disclosed embodiment.

Most artificial intelligence engines identify malicious codes using a data set learned based on various characteristic information of malicious codes. Then, it is determined whether the malicious code is malicious or not, but it is difficult to explain why the malicious code is malicious in this method. However, as shown in the example, if the identifier of the standardized attack method (TTP) is matched, it is possible to identify the threat element of the corresponding malicious code. Accordingly, the embodiment can accurately deliver cyber threat information to the security manager and enable the security manager to manage the cyber threat information systematically and for a long period of time.

The embodiment not only distinguishes the identifier or labeling of the attack method (TTP) when generating a data set for artificial intelligence learning to identify the attack method (TTP) based on the disassembled code, but also how to implement the attack method (TTP) It can reflect the characteristics of whether or not it has been done as an important factor.

Even malicious codes that implement the same attack method (TTP), it is impossible to generate the same code depending on the developer. That is, the description of the attack method (TTP) is in the form of human oral language, but the implementation method and code writing method are not the same depending on the developer.

The difference in code writing depends on the developer's ability or the way or habit of implementing program logic, and this difference is represented by binary code or the difference between disassembled OP-CODE and ASM-CODE.

Therefore, it is difficult to accurately identify an attacker or group of attackers who generate malicious code simply by assigning or matching an attack identifier according to the type of resulting attack method (TTP).

Conversely, if modeling is performed by reflecting the characteristics of the disassembled OP-CODE and ASM-CODE as important variables, it is possible to identify the developer who developed a specific malicious code or attack tool, or even the automatically generated tool itself.

The disclosed embodiment can generate very important threat intelligence in modern cyber warfare according to the unique characteristics of the disassembled OP-CODE and ASM-CODE combined code. That is, based on these unique characteristics, the embodiment can identify how the attack code or malicious code operates, and who developed it and for what purpose.

In the future, it is possible to supplement vulnerable systems based on information about characteristics that attackers continue to attack, and to enable active and preemptive responses to cyber security threats.

On this concept, the embodiment simply provides completely different results in terms of performance and method of identifying an attack technique according to an attack result based on OP-CODE.

Embodiments can generate a data set of disassembled codes based on the combined characteristics of the disassembled OP-CODE and ASM-CODE to accurately identify and classify the coding technique used to implement the attack method (TTP). there is. Modeling to identify unique characteristics from the data set created in this way can identify not only the attack method (TTP) but also the developer's characteristic information, that is, who the developer (or automated production tool) is.

This figure shows an example of matching an OP-CODE data set modeled in the manner described above to an attack identifier.

In this example, the first OP-CODE set (OP-CODE set #1) matches the attack technique identifier T1011, and the second OP-CODE set (OP-CODE set #2) matches the attack technique identifier T2013. And the third OP-CODE set (OP-CODE set #3) can match the attack technique identifier T1488, and the Nth OP-CODE set (OP-CODE set #N) matches any attack technique identifier T1XXX indicates being MITER ATT&CK®, which is a standardized model, expresses attack technique identifiers in a matrix format for each element, but in an embodiment, an attacker or an attack tool may be additionally identified in addition to an attack technique identifier.

Although this figure is shown as an OP-CODE data set for convenience, identifying attack techniques with a data set of disassembled codes including OP-CODE and ASM-CODE is more effective than identifying attack techniques with only the OP-CODE data set. It is possible to identify detailed attack techniques.

According to an embodiment, when a combination of data sets of disassembled codes is analyzed, not only an attack technique identifier but also an attacker or an attack group may be identified.

Therefore, the embodiment can provide a more advanced technology than the existing technology in terms of acquiring intelligence information, and can solve problems that have not been solved in the conventional security area.

In such a complex environment, fast data processing and algorithms are required to secure accurate intelligence information. Hereinafter, additional embodiments related to this and performance thereof will be disclosed.

21 is a diagram illustrating a flow of processing cyber threat information according to the disclosed embodiment.

A case in which the file identified in this figure is an ELF, EXE, or ARK executable binary file will be described as an example. The processing of this step is related to the in-depth analysis described above.

First, a detailed example of a process of extracting a disassembled code including an OP-CODE code as a first step will be described below.

Compiling the source code creates an executable file.

The original source code is created as new data in a form suitable for machine processing by a compiler in each executable operating system (OS) environment. Since the newly formed binary data is in a form unsuitable for human reading, it is impossible for humans to understand the internal logic of a file made in the form of an executable file.

However, it is called the disassembly process as described in performing the interpretation or analysis of machine language by performing the reverse process for the vulnerability analysis of the security system and various purposes. The disassembly process may be performed according to the central processing unit (CPU) of a specific operating system and the number of processing bits (32 bits, 64 bits, etc.).

Disassembled assembly code can be obtained by disassembling the example ELF, EXE, and ARK executable files respectively.

The disassembled code may include a code in which OP-CODE and ASM-CODE are combined.

The embodiment may extract OP-CODE and ASM-CODE from the executable file by analyzing the executable file based on a disassembly tool.

The disclosed embodiment does not use the extracted OP-CODE and ASM-CODE as it is, but reconstructs the OP-CODE array by reconstructing each function. When the OP-CODE arrangement is rearranged, the data can be reconstructed so that the data analysis can be sufficiently performed by including the original binary data together. Through this rearrangement, the new combination of OP-CODE and ASM-CODE provides basic data to identify attackers as well as attack techniques.

The process of processing assembly data (ASM) in the second step will be described in detail.

The assembly data processing process is a process of separating only the OP-CODE and the necessary ASM-CODE, and then analyzing the similarity and extracting information based on the data reconstructed in a form that is easy for humans or computers to read.

Assembly data disassembled in this step can be converted into a certain data format.

Conversion of these data formats can be selectively applied without the need to apply all of the conversion methods described below to increase data processing speed and accurately analyze data.

Various functions can be extracted from the assembly data of the rearranged combination of OP-CODE and ASM-CODE.

Disassembling one executable file can contain about 7,000 to 12,000 functions on average, depending on the size of the program. Some of these functions are implemented as needed by the programmer, while others are provided by default in the operating system.

Analyzing the actual ASM-CODE, about 87% to 91% of the functions are basically provided by the operating system (OS supported), and about 10% of the ASM-CODE actually implemented by the programmer for the program logic. Functions provided by the operating system are functions (default functions) included in various DLLs and SO files that are basically installed when installing the operating system along with function names. These operating system-provided functions can already be analyzed and stored to filter from the data to be analyzed. By isolating only the code to be analyzed in this way, the processing speed and performance can be increased later.

In the embodiment, in order to accurately perform functional analysis of a program, OP-CODE can be separated and processed in units of functions. In the embodiment, the minimum unit of all semantic analysis may be performed based on functions included in assembly code.

In order to increase analysis performance and processing speed, the embodiment may filter out operator-level functions whose semantics are not accurate, and may also remove functions whose amount of information is smaller than a critical value from analysis targets. Whether or not to filter functions and the degree of filtering may be set differently according to embodiments.

The embodiment may remove annotation data provided by the disassembler when outputting from the OP-CODE organized according to the function. And the embodiment may rearrange the disassembled code.

For example, the disassembled code output by the disassembler may have the order of [ASM-CODE, OP-CODE, parameters].

In an embodiment, parameter data may be removed from assembly data, and disassembled codes in the above order may be rearranged or reconstructed in the order of [OP-CODE, ASM-CODE]. The reorganized disassembled code is easy to process by normalizing or vectorizing. And the processing speed can be significantly increased.

In particular, among the disassembled codes having a combination of [OP-CODE and ASM-CODE], it is not easy to compare ASM-CODE parts with different data lengths. Therefore, in order to confirm the uniqueness of the corresponding assembly data, data can be normalized into a data format of a specific size. For example, the embodiment is a data set of a specific length that is easy to normalize the data part in order to confirm the uniqueness of the disassembled code of the [OP-CODE, ASM-CODE] combination, for example, CRC (cyclic redundancy check) data can be converted to

As an example, in the disassembled code of [OP-CODE, ASM-CODE] combination, it is also possible to convert the OP-CODE part into CRC data of the first length and the ASM-CODE part into CRC data of the second length, respectively. .

The normalized data converted into OP-CODE and ASM-CODE enables the uniqueness of each code before the corresponding conversion to be maintained. In order to speed up the similarity determination of the normalized data converted with uniqueness, vectorization may be performed on the normalized data.

As described above, the normalization or vectorization process as a data conversion process may increase data processing speed and may be selectively applied for accurate analysis of data.

Detailed examples of the normalization process and the vectorization process are disclosed in detail again below.

As a third step, the data analysis process of analyzing the disassembled code will be described in detail.

Even in this process, conversion of various data formats can be used to increase data processing speed and accurately analyze data, and some of the conversion methods described below do not need to be applied, and some of them can be selectively applied.

This step is to analyze the degree of similarity with the malicious code based on the data set for each function in the converted disassembled code based on the converted data.

The embodiment may convert vectorized data sets of OP-CODE and ASM-CODE back into byte data in order to perform similarity between codes.

Based on the reconverted byte data, a hash value in block units can be extracted, and a hash value for all data can be generated based on a unique value in block units.

The hash value may be compared by extracting a hash value of a unit designated to extract a unique value of each block unit in order to efficiently perform comparison in block units, which are part of byte data.

In this way, a fuzzy hashing technique may be used to extract a hash value of a designated unit and compare similarities between two or more pieces of data. For example, in the embodiment, CTPH (Context Triggered Piecewise Hashing) method among fuzzy hashing is used to determine similarity by comparing hash values extracted in block units with hash values of some units of previously stored malicious codes. can

In summary, the embodiment is based on the fact that the combination code of OP-CODE and ASM-CODE implements a specific function in a function unit, in order to confirm the uniqueness of each specific function, the disassembled code of OP-CODE and ASM-CODE generate a unique value of Based on this unique value, similarity calculation can be performed by extracting the unique value of each block from the OP-CODE and ASM-CODE of the disassembled code.

A detailed example of extracting a hash value in block units will also be disclosed with reference to the drawings below.

As described, the embodiment may use a hash value in units of blocks when similarity calculation is performed.

The extracted block unit hash value is composed of String Data (Byte Data), and String Data (Byte Data) is a numerical value, and similarity between codes can be compared. If you perform byte comparisons of billions of disassembled code data sets, you can spend a lot of time getting a single similarity result.

Therefore, in the embodiment, String Data (Byte Data) can be converted into numerical values. Based on these numerical values, similarity analysis can be quickly performed using artificial intelligence technology.

In an embodiment, String Data (Byte Data) of hash values in units of extracted blocks may be vectorized based on N-gram data. The embodiment of this figure illustrates a case of performing vectorization of hash values in units of blocks into 2-gram data in order to increase the operation speed. However, in the embodiment, it is not necessary to convert the hash value in block units into 2-gram data, but 3-gram, 4-gram, ... , it is also possible to vectorize and convert to N-gram data. In N-gram data, as N increases, the characteristics of data can be accurately reflected, but the speed of data processing increases.

As described above, byte conversion, hash conversion, and N-gram conversion below can be selectively applied to increase data processing speed and accurately analyze data.

The illustrated 2-gram conversion data has a maximum dimension of 65,536. As the dimension of training data increases, the distribution of data becomes sparse, which may adversely affect classification performance. In addition, as the dimension of the training data increases, the time complexity and space complexity for learning the data increase.

In order to solve this problem, the embodiment can be processed with various natural language processing algorithms based on various text expressions. In this embodiment, a TF-IDF (Term Frequency-Inversed Document Frequency) technique will be described as an example of such an algorithm.

As an example for processing the similarity of the learning data in this step, TF-IDF (Term Frequency-Inversed Document) frequency) technique can be used. In general, the TF-IDF technique is used to find documents with high similarity in search engines, and the equations for calculating this are as follows.

는 특정 문서

에서 특정 단어

의 빈도율을 의미하고 그 단어가 반복적으로 나올수록 높은 값을 갖는다. here

is a specific document

specific words in

It means the frequency rate of and has a higher value as the word appears repeatedly.

는 특정 단어

를 포함하는 문서

의 비율의 역수 값으로, 단어가 여러 문서에서 흔하게 나타날수록 낮은 값을 갖는다.

is a specific word

document containing

The reciprocal value of the ratio of , the lower the value the more common the word appears in multiple documents.

는

와

를 곱한 값으로, 어떤 단어가 어떤 문서에 더 적합한지 수치화시킬 수 있다.

Is

and

, it is possible to quantify which word is more suitable for which document.

The TF-IDF method uses the frequency of words according to Equation 1 and the inverse document frequency (the reciprocal number specific to the frequency of documents) according to Equation 2 to reflect weights according to the importance of words in the document word matrix as shown in Equation 3 way of doing it.

In an embodiment, a document including a corresponding word may be inferred as an attack identifier (T-ID) based on a word characteristic or pattern on a block unit code. Therefore, if TF-IDF is calculated for the pattern extracted from the block-level code, a pattern that appears frequently within a specific attack identifier (T-ID) is extracted or a pattern that is not related to a specific attack identifier (T-ID) is extracted. The code can be removed.

For example, assuming that a specific pattern A is a pattern expressed in all attack identifiers (T-IDs), the TF-IDF value for the specific pattern A will be measured low. In addition, it may be determined that such a pattern is an unnecessary pattern in order to distinguish an actual attack identifier (T-ID). An algorithm for determining the similarity of natural language, such as TF-IDF, may be performed through learning of a machine learning algorithm.

The embodiment can reduce unnecessary calculations and reduce reasoning time by removing such unnecessary patterns.

In detail, the embodiment may perform a similarity algorithm based on text representations of various natural language processing on data of block-by-block code after conversion. Through the similarity algorithm, patterns of codes that are not related to the attack identifier can be removed, greatly shortening the algorithm performed below and the classification process according to machine learning.

The embodiment may perform classification modeling to classify patterns of attack identifiers based on features or patterns on code in units of blocks. The embodiment can learn whether a vectorized block-based code feature or pattern is a pattern of a known attack identifier, and classify it into an accurate attack technique or implementation method. The embodiment uses various ensemble machine learning models to classify an accurate attack implementation method, that is, an attack identifier and an attacker, for a code determined to have a code pattern similar to a malicious code.

Ensemble machine learning models are techniques that generate multiple classification nodes from prepared data and perform accurate predictions by combining predictions of the nodes for each classification node. As described above, ensemble machine learning models are performed to classify the characteristics or patterns of words in the code of each block as an attack implementation method, that is, an attack identifier or an attacker.

A threshold value for classification of prepared data may be set to prevent over- and false-positives when ensemble machine learning models are applied. Only data that exceeds the set detection threshold may be classified, and data that does not reach the set detection threshold may not be classified.

As described above, conversion of various data formats may be used to speed up data processing and accurately analyze data. Among the data conversion methods described above,

A specific embodiment of applying these ensemble machine learning models will be described in detail below.

As the fourth step, the profiling process of identifying and labeling attack techniques (TTP) is as follows.

An example of vectorization through feature extraction of disassembled code including OP-CODE and ASM-CODE of input binary data based on already analyzed attack code or malicious code has been described above.

After the vectorized data is learned through machine learning modeling, it is classified as a specific attack technique, and the classified codes are labeled with the classified data in a profiling process.

Labeling can be performed in two parts. One is to attach a unique index to the attack identifier defined in the standardized model, and the other is to write information about the user who wrote the attack code.

Labeling is assigned according to a standardized model, for example, an attack identifier (T-ID) reflected in MITER ATT&CK, so that accurate information can be delivered to users without additional work.

And labeling is given to distinguish not only the attack identifier but also the attacker who implemented the attack identifier. Therefore, it can be provided to identify not only the attack identifier but also the attacker and its implementation method.

In the embodiment, advanced profiling is possible based on data learned from a data set of previously classified disassembled codes (OP-CODE, ASM-CODE, or a combination thereof). In the embodiment, the data of the static analysis, dynamic analysis, or association analysis disclosed above may also be used as reference data for performing labeling. Therefore, even for data sets that have not been previously analyzed, profiling data can be obtained very quickly and efficiently by considering the results of static, dynamic, and association analysis together.

The process of learning a code having a pattern similar to the malicious code in step 3 above and classifying the learned data and the process of profiling the classified data in step 4 can be performed together by a machine learning algorithm.

A detailed example of this is disclosed below. In addition, an actual example of the profiled data set will be illustrated with reference to the drawings below.

22 is a diagram illustrating values obtained by converting OP-CODE and ASM-CODE of disassembled codes into normalized codes as an example of data conversion according to the disclosed embodiment.

As described above, if the execution file is disassembled, OP-CODE and ASM-CODE combined data is output.

The embodiment may remove annotation data output for each function from disassembled data and change the arrangement order of OP-CODE, ASM-CODE, and corresponding parameters to facilitate processing.

The reconstructed OP-CODE and ASM-CODE are changed into normalized code data, and the example in this figure illustrates CRC data as normalized code data.

For example, OP-CODE can be converted into CRC-16 and ASM-CODE can be converted into CRC-32.

In the first row of the illustrated table, the OP-CODE push function is changed to CRC-16 data of 0x45E9, and 55 of ASM-CODE is changed to CRC-32 data of 0xC9034AF6.

In the second row, the mov function of OP-CODE is changed to CRC-16 data of 0x10E3, and 8B EC of ASM-CODE is changed to CRC-32 data of 0x3012FD2C. In the third row, the lea function of OP-CODE is changed to CRC-16 data of 0xAACE, and 8D 45 0C of ASM-CODE is changed to CRC-32 data of 0x9214A6AA.

In the fourth row, it is exemplified that the push function of OP-CODE is changed to CRC-16 data of 0x45E9 and 50 of ASM-CODE is changed to CRC-32 data of 0xB969BE79.

Unlike this example, other normalization code data different from CRC data or code data having a different length may be used.

If the disassembled code is changed into a normalized code, the subsequent calculation, similarity calculation, and vectorization can be performed easily and quickly while securing the uniqueness of each code.

23 is a diagram illustrating vectorized values of OP-CODE and ASM-CODE of disassembled codes as an example of data conversion according to the disclosed embodiment.

In this figure, a result of vectorizing a normalized OP-CODE code (CRC-16 according to the above example) and a normalized ASM-CODE (CRC-32 according to the above example) is illustrated.

The vectorized value of the normalized OP-CODE code (OP-CODE Vector) and the vectorized value of the normalized ASM-CODE code (ASM-CODE Vector) are shown in tabular form in this figure.

The OP-CODE Vector value and the ASM-CODE Vector value of each row in this figure correspond to the OP-CODE normalization value and the ASM-CODE normalization value of each row in FIG. 22, respectively.

For example, the vectorized values of CRC data 0x45E9 and 0xB969BE79 in the fourth row of the table of FIG. 22 become 17897 and 185 105 121 44 of the fourth row of the table of this figure, respectively.

When vectorization is performed on the normalized data, the disassembled OP-CODE function and ASM-CODE are converted into vectorized values while including unique features.

24 is a diagram illustrating an example of converting a code block unit into a hash value as an example of data conversion according to the disclosed embodiment.

To perform similarity analysis, vectorized OP-CODE and ASM-CODE data sets are reconverted into byte data form. The reconverted byte data may be converted into a hash value in units of blocks. Then, a hash value of the entire reconverted byte data is generated based on the hash values in block units.

In the embodiment, hash values such as MD5 (Message-Digest algorithm 5), SHA1 (Secure Hash Algorithm 1), and SHA 256 may be used to calculate the reconverted hash value, which is a fuzzy hash for determining similarity between data ( Fuzzy Hash) function can be used.

In the table of this figure, the first row represents a human-readable character that may be included in the data. Among the reconverted byte data, values included in block units may include such readable characters.

Each character is 97, 98, 99, 100, … which is the ASCII value of the second row. ., 48, 49 may correspond.

Data including the character values of the first row can be segmented and divided into blocks that can be summed with ASCII values.

The third row of the table shows the sum of ASCII values corresponding to each character value within a block unit with 4 characters.

In the case of the first block, it can have a value of 394, which is the sum of ASCII values (ascii val) 97, 98, 99, and 100 corresponding to characters in the block.

And the last row shows the case where the sum of ASCII values in block units is converted to Base 64 expression. The letter K is the sum of the first block.

In this way, the signature Kaq6KaU can be obtained for the corresponding data.

Based on these signatures, it is possible to calculate the degree of similarity between two pieces of block unit data.

This embodiment can calculate hash values for block units included in codes among reconverted byte data using a fuzzy hash function for determining similarity, and determine similarity based on the calculated hash values. Although CTPH (Context Triggered Piecewise Hashing) is exemplified as a fuzzy hash function for determining similarity, it is also possible to use other fuzzy hash functions that can calculate the similarity of data.

25 is a diagram illustrating an example of an ensemble machine learning model according to the disclosed embodiment.

The embodiment can accurately classify the attack identifier (T-ID) of a file determined to be malicious code using an ensemble machine learning model.

Block units composed of String Data (Byte Data) are digitized based on N-gram feature information for hash values, and then similarity is evaluated using techniques such as TF-IDF to determine whether this is an attack identifier (T-ID) or a class to be classified. can be calculated

In order to improve the performance of attack technique identification by reducing unnecessary calculations, an embodiment may remove unnecessary patterns based on similarity among the hash values.

In addition, the attack identifier can be classified by modeling the data from which unnecessary patterns have been removed through ensemble machine learning.

There are methods such as voting, bagging, and boosting that combine the learning results of multiple classification nodes of an ensemble machine learning model. An ensemble machine learning model that properly combines these methods can contribute to improving the classification accuracy of

Here, as an example, a method of more accurately classifying an attack identifier will be described, taking a case in which a random forest method of a bagging method is applied.

The random forest method generates a large number of decision trees to reduce classification errors by a single decision tree and obtain generalized classification results. An embodiment may apply a random forest learning algorithm using at least one decision tree to prepared data. Here, the prepared data means data from which unnecessary patterns are removed from the fuzzy hash value in units of blocks.

To determine the similarity of hash values in block units, a decision tree model with at least one node is performed. Characteristic values that can distinguish one or more classes (attack identifier; T-ID) according to the degree of information gain of the decision tree (here, the number of occurrences of classification patterns based on hash values in block units) ), the comparison condition can be optimized.

To this end, a decision tree as illustrated in the drawing may be created.

In this figure, the upper rectangles 2510, 2520, 2530, and 2540 are in-terminal nodes, meaning conditions for classifying, and the lower rectangles 2610, 2620, and 2630 mean classes classified as terminal nodes. do.

For example, when a random forest model is applied as an ensemble machine learning model, it is a classification model using an ensemble technique using one or more decision trees. Various decision trees are constructed by differentiating the characteristics of the input data of the decision tree constituting the random forest model. Classification is performed on several generated Decision Tree models, and the final classification class is determined using a majority voting technique. The test of each node can be performed in parallel, resulting in high computational efficiency.

When classifying a class, a threshold value may be set to prevent over- and false-positives, values below the lower threshold value may be discarded, and classification may be performed with a data target above the detection threshold value.

26 is a diagram illustrating a flow of learning and classifying data through machine learning according to the disclosed embodiment.

Profiling of the input data may include a classification step (S2610) and a learning step (S2620).

In the embodiment, the learning step (S2620) is (a) hash value extraction process, (b) N-gram pattern extraction process, (c) natural language processing analysis (TF-IDF analysis) process, (d) pattern selection process, (e ) model learning process, etc.

In the embodiment, the classification step (S2610) may include (a) a hash value extraction process, (b) an N-gram pattern extraction process, (f) a pattern selection process, (g) a classification process by vectorization, and the like. .

The classification step (S2620) of the profiling step according to the embodiment is first described as follows.

It receives input data from a set of executable files or from processed files.

Input data is received from a set of executable files stored in the database, or input data including an executable file delivered from the process illustrated above is received. The input data may be vectorized data obtained by converting disassembled codes including OP-CODE and ASM-CODE codes.

A fuzzy hash value is extracted from the disassembled code, which is the input data (a), and N-gram pattern data for a specific function is extracted (b). At this time, among the existing semantic pattern sets, 2-gram pattern data including patterns determined to be similar to malicious codes can be selected (f).

The N-gram data of the selected pattern can be converted into vectorized data, and the vectorized data can be classified into a function whose meaning pattern is determined (g).

Among the profiling steps according to the embodiment, the learning step (S2610) is performed as follows.

If the input data is a new file, a fuzzy hash value is extracted from the disassembled code, which is the input data (a).

The extracted fuzzy hash value is vectorized into N-gram data (2-gram in this example) (b).

Perform natural language processing analysis such as TF-IDF on the extracted specific pattern (c)

Among the data sets having a pattern related to the existing attack identifier (T-ID), a data set with high similarity is selected and the rest is filtered (d). In this case, sample data sets including some or all characteristics of a data set having a pattern related to an attack identifier (T-ID) may be selected by comparing data sets stored in an existing semantic pattern set.

Based on the extracted sample data set, vectorized N-gram data can be learned (e).

N-gram vectorized data is input into the classification model to obtain probability for each attack identifier (T-ID). For example, it is possible to obtain a probability such that the probability that the vectorized data of the N-gram structure is a specific attack identifier (T-ID) T1027 is A%, and the probability that the attack identifier T1055 is (100-A)%.

The classification model may use an ensemble machine learning model such as a random forest including at least one decision tree.

(A) Here, based on the classification model, it is possible to determine which attack technique or attacker the vectorized N-gram data is.

Labeling is performed by classifying the input data according to the classification result of the classification model (e) or the selection result of the previously stored pattern (f) (g).

The result of the final labeling is exemplified with reference to the following figures.

27 is a diagram illustrating an example of labeling an attack identifier and an attacker by learning and classifying input data according to the disclosed embodiment.

This figure is a diagram showing attack identifiers, attackers or attack groups, purge hash values corresponding to assembly codes, and corresponding N-grams (here described as 2-gram data) in tabular form as a result of profiling.

According to the embodiment, when profiling is completed, classified data related to the implementation of the following attack method may be obtained.

According to the profiling according to the embodiment, an attack identifier (T-ID) and an attacker or attacker group may be respectively labeled.

Here, the attack identifier (T-ID) may follow the standardized model as described. In this example, the result of assigning the attack identifier (T-ID) provided by MITER ATT&CK® is exemplified.

Labeling may also be added to the identified attacker or attacker group as described above. This figure shows an example of identifying the attacker TA504 with the labeling of the attacker or attacker group.

SHA-256 (size) represents the fuzzy hash value and data size of malicious code corresponding to each attack identifier (T-ID) or attacker group (Attacker or Group). As described above, these malicious codes can correspond to rearrangement and combination of OP-CODE and ASM-CODE.

And the value of the section marked as N-gram is the N-gram pattern data corresponding to the attack identifier (T-ID) or the fuzzy hash value of the attacker group and malicious code. In this example, it is displayed as part of the 2-gram data.

As illustrated in this figure, purge hash values of malicious codes (OP-CODE and ASM-CODE) and attack identifiers (T-IDs) corresponding to N-gram pattern data or attacker groups can be labeled and stored.

The exemplified labeled data may be used as reference data for ensemble machine learning and may be used as reference data for classification models.

Performance results of the embodiments disclosed below are illustrated.

28 is a diagram showing a result of identifying an attack identifier according to an embodiment.

This figure illustrates a Euclidean Distance Matrix, which can represent the degree of similarity between two data sets.

In this figure, a bright part means that the two data sets have a low similarity, and a dark part means that the two data sets have a high similarity.

In this figure, T10XX means an attack identifier (T-ID), and characters T, K, and L in parentheses mean an attacker group that has created an attack technique according to the corresponding attack identifier (T-ID).

That is, the rows and columns mean attack identifiers (T-IDs) generated by each attacker group (T, K, and L), and the rows and columns have the same meaning. For example, T1055(K) means T1055 attack created by L attacker group, and T1055(K) means the same attack method T1055 created by K attacker group.

Since each sample in the data set includes its own sample, calculating the distance to other samples shows a distribution with high identity in the diagonal direction from top left to bottom right.

Looking at this figure, it can be confirmed that the same attack identifier (T-ID) shows similar characteristics even if the attacker group is different. For example, the attack identifier of T1027 may have a high degree of similarity if the attack technique is similar even if the attack group is T or K.

Therefore, when learning is performed based on the extracted data set as in the above embodiment, the characteristics of the same attack technique (T-ID) implemented by the same attacker are clearly identified (the darkest part), and It can be seen that the same attack technique (T-ID) has a high degree of similarity (middle dark part).

Therefore, if the attack technique is classified by extracting and applying the sample data based on the combination of OP-CODE and ASM-CODE in this way, even if the attacker is different, a specific attack technique or identifier (T-ID) can be definitely classified. can On the contrary, through the combination of OP-CODE and ASM-CODE, it is possible to clearly identify the specific code implemented inside the malicious code, as well as identify the attacker and the attack implementation method including the attack identifier.

29 is a diagram illustrating a gram data pattern according to an attack identifier according to an embodiment.

This figure illustrates patterns of gram data when different attack identifiers (T-IDs) are different. For example, if each malicious code including attack identifiers T1027 and T1055 is converted into 2-gram pattern data and classified according to the embodiment, each attack identifier (T-ID) shows a different gram pattern.

That is, according to the embodiment of identifying attack techniques in malicious code based on the combination of OP-CODE and ASM-CODE, the pattern of gram data can be divided for each attack identifier (T-ID).

This result means that according to the present embodiment, even if the attacker is the same, various attack identifiers (T-IDs) hidden in the malicious code can be clearly identified.

30 is a diagram illustrating the performance of the disclosed embodiment of processing cyber threat information.

This figure illustrates the performance of the attack identifier or the computational speed of classifying the attacker among the performances of the disclosed embodiment.

The horizontal axis represents the amount of data stored in the database, and the vertical axis represents the time required to classify the attack identifier.

If the number of fuzzy hash data stored in the database is increased, and each normal sample is compared N: 1 (N to 1), the processing time may increase exponentially according to the number of data. For example, simply comparing the similarity of hash values or fuzzy hash values (indicated by ssdeep), the time required greatly increases depending on the amount of data to be compared.

However, when the decision tree model of the ensemble machine learning model of the embodiment is used, the inference time for classifying the attack identifier does not increase even if the number of data increases.

That is, the decision tree model that generates an optimized comparison tree has the advantage of not being significantly affected by the calculation speed even if the number of data increases because nodes can be processed in parallel.

31 is a diagram illustrating an example of providing detection names to detection engines of engines that detect cyber threat information.

Various engines in the field of malicious code detection have been developed to detect cyber threat information. Even if the ability to detect malicious codes increases as artificial intelligence analysis increases, the effectiveness of this detection ability is very low if the detected malicious codes are not properly explained and information is provided.

This figure exemplifies foreign famous detection engines 3210 (left) provided by the VirusTotal site and detection names (right) of the same malicious code provided by each detection engine.

Since the same malicious code is not accurately identified and delivered, it is difficult to identify the reason why the corresponding malicious code was detected. Therefore, it was difficult for security personnel to find countermeasures on which object to take action based on the information, and it was difficult to respond to the risk of security threats.

However, the disclosed embodiment provides cyber threat information with a matrix element of an attack identifier provided by a standardized model such as MITER ATT&CK and its combination, and provides information on malicious code with a standardized identifier (T-ID), thereby increasing versatility and efficiency. can be very high.

Hereinafter, an example in which an attacker can be tracked and a new attack can be predicted based on the disclosed embodiment will be amplified and described.

32 is a diagram illustrating an example of a new malicious code and an attack method according to an embodiment.

Code developers tend to use their own customs, such as variable name declaration, function call structure, and parameter calling method, to create code. It is very difficult to completely change these habits because program development is driven by logic flow and experience.

Based on this basis, the embodiment can track an attacker by using such results on the code as the developer's fingerprinting.

When the learning data is configured based on the attack identifier (T-ID) of the malicious code, the developer can be identified using the above characteristic information. The disassembled code of the malicious code reflects the unique characteristics or habits of these developers.

In order to implement a specific attack technique, a specific hacker can use his/her own technique that he or she is not aware of, and as the complexity of the code increases, the possibility of specifying a specific developer increases.

In addition, combining OP-CODE and ASM-CODE code blocks for each attack identifier (T-ID) can be used to detect new or variant malicious codes that are not yet known.

This figure discloses an example of creating a combination of a new non-existent TTP through a combination of disassembled OP-CODE and ASM-CODE according to the following embodiment.

In this example, T1044, T1039, T1211,… , T-N respectively illustrate attack identifiers (T-IDs).

The set of OP-CODEs 1 to N corresponding to each attack identifier means a code set included in the malicious code of each attack identifier.

As exemplified here, the malware malicious code is a malicious code containing a combination of known attack identifiers such as OP-CODE 1 of T1044, OP-CODE2 of T1039, OP-CODE3 of T1211, and OP-CODE 1 of T-N. let's do it. Malicious malware including a set of combinations of these OP-CODEs may be known codes or unknown codes.

In a similar way, new attack techniques including OP-CODE 3 of T1044, OP-CODEN of T1039, OP-CODE 4 of T1211, and OP-CODE 2 of T-N can be found.

Alternatively, new and unknown attack techniques including OP-CODE 4 of T1044, OP-CODE 4 of T1039, OP-CODE 2 of T1211, and OP-CODE 3 of T-N may be found.

In the above, for convenience, an example of finding an attack technique using only a combination of OP-CODEs was disclosed, but if a disassembled code is generated by combining OP-CODE and ASM-CODE, not only an attack technique is found, but also an attacker or attack group can be identified. .

Similarly, a new code set can be created through recombination of disassembled codes including OP-CODE and ASM-CODE. OP-CODE corresponding to the function of the executable file as well as ASM-CODE representing the destination or storage location of the executable file can be reconstructed or reassembled disassembled code can be generated.

By learning this reconstructed disassembled code through machine learning and comparing it with previously analyzed malicious codes, it is possible to predict future attacks beyond identifying a new type of detailed attack technique and the attacker who created it.

The combination of new TTP and attack path can create a new cyber threat or malicious code attack method that did not exist until now. you can check if it does. Whether or not the code can be attacked can also be checked through tests such as dynamic analysis.

Therefore, the embodiment can provide information capable of responding to security threats in the future through a combination of disassembled code sets, so that a preemptive response to them is possible.

For example, based on the combined code, it is possible to generate a code that reflects values such as the frequency of use for each attack technique (TTP) or the probability of success when used.

Alternatively, an attack code or malicious code of a new code block combination with a high probability of success may be generated in advance through artificial intelligence learning. In addition, by reflecting this information, it is possible to create a pattern that existing security products can respond to, or to provide information that can strengthen the security of the weak part of the internal system.

33 is a diagram illustrating another embodiment of a cyber security threat information processing method.

The input executable file is disassembled to obtain a disassembled code, and the disassembled code is reconstructed to obtain a reconstructed disassembled code (S3110).

An example of obtaining and reconstructing the disassembled code has been described with reference to FIGS. 18 and 21 .

The reconstructed disassembled code is processed and converted into a hash function, and the hash function is converted into N-gram data (3120).

Examples of converting the reconstructed disassembled code into a data set of a certain format are illustrated in FIGS. 21 and 24 .

Ensemble machine learning is performed on the block-unit code of the converted N-gram data to generate an identifier of an attack technique performed by the block-unit code and the block-unit code Profiling with an attacker's identifier (S3130)

Examples of profiling the identifier of the attack technique and the identifier of the attacker in this step have been described with reference to FIGS. 19, 20, 21, 25, 26, and 27.

34 is a diagram illustrating another embodiment of a cyber security threat information processing device.

Another embodiment of the cyber security threat information processing device may include a server 2100 including a processor, a database 2200, and an intelligence platform 10000.

The intelligence platform 10000 may include an application programming interface 1100, a framework 18000, an analysis and prediction module 18100 that executes various algorithms and execution modules, and an AI engine 1230. there is.

The database 2200 may store previously classified malicious codes or pattern codes of malicious codes.

The processor of the server 2100 disassembles the executable file received from the application programming interface 1100 to obtain a disassembled code and reconstructs the disassembled code to obtain a reconstructed disassembled executable file. The first module 18101 for obtaining assembled code may be performed.

Examples of the execution process of the first module 18101 are illustrated in FIGS. 18 and 21 .

Further, the processor of the server 2100 may perform a second module 18103 of processing the reconstructed disassembled code to convert it into a hash function and converting the hash function into N-gram data.

Examples of the execution process of the second module 18103 are illustrated in FIGS. 21 and 24 .

The processor of the server 2100 performs ensemble machine learning on the block-unit code of the converted N-gram data to obtain an identifier of an attack technique performed by the block-unit code and A third module 18105 for profiling with an identifier of an attacker who generated the code in units of blocks may be performed.

Examples of the execution process of the third module 18105 have been described with reference to FIGS. 19, 20, 21, 25, 26, and 27.

Therefore, according to the disclosed embodiment, it is possible to detect and respond to malicious codes that do not exactly match data learned through machine learning, and respond to variants of malicious codes.

According to the embodiment, it is possible to identify a malicious code, an attack technique, and an attacker within a very short period of time even if it is a variant of malicious code, and furthermore, it is possible to predict an attack technique of a specific attacker in the future.

According to the embodiment, it is possible to accurately identify a cyber attack implementation method based on whether there is such a malicious code, an attack technique, an attack identifier, and an attacker, and provide it as a standardized model. According to the embodiment, it is possible to provide normalized and standardized information on malicious codes for which malicious code detection names, etc., or cyber attack techniques are not accurately described.

In addition, it can predict the possibility of creating previously unknown malicious code and the attackers who can develop it, and provide a means to predict what kind of cyber threat attack will occur in the future.

35 is a block diagram illustrating the operation of a cyber security threat information processing device according to embodiments.

A block diagram 3500 of FIG. 35 is an example of an operation in which the cyber security threat information processing apparatus described in FIGS. 1 to 34 collects and analyzes file characteristics according to a user's file analysis request signal to generate clustering for each user.

A cyber security threat information processing device according to embodiments receives a file analysis request signal 3510 from a user (User A). The user's file analysis request signal 3510 according to embodiments may be transmitted over a network.

The cyber security threat information processing device according to the embodiments analyzes the execution file according to the file analysis request signal (3520). A specific operation of the file analysis of the cyber security threat information processing device is as follows.

The cyber security threat information processing device according to the embodiments disassembles an execution file (EXE, EFL, APK, etc.) that is a user's analysis request target (3521). The disassembled assembly codes may include operation codes (OP-CODEs) and operands. An operation code (OP-CODE) represents a machine language instruction that can be called a command code, and an operand represents information necessary for an execution operation, that is, target data or a memory location of the machine language instruction. As described above, among disassembled assembly codes, parts other than OP-CODE are referred to as ASM-CODE, and ASM-CODE may include an operand part. Through disassembly, an executable file in object code format is converted into a specific format, for example code in assembler language format or disassembled code.

The apparatus for processing cyber security threat information according to embodiments extracts OP-CODE (operation code) and ASM-CODE having a certain format according to a user from the disassembled code (3522). The apparatus for processing cyber security threat information according to the embodiments may reconfigure the OP-CODE arrangement by reconstructing each function without using the extracted OP-CODE and ASM-CODE as they are. When the OP-CODE arrangement is rearranged, the data can be reconstructed so that the data analysis can be sufficiently performed by including the original binary data together. Therefore, in the cyber security threat information processing device according to the embodiments, the new combination of OP-CODE and ASM-CODE can provide not only an attack technique but also basic data capable of identifying an attacker. Since the combination method of OP-CODE and ASM-CODE is the same as that described in FIGS. 1 to 34, a detailed description thereof will be omitted. Combined OP-CODE and ASM-CODE are rearranged in order of [OP-CODE, ASM-CODE]. The disassembled code rearranged in this way can be easily processed by normalization or vectorization, so that data processing speed can be increased. Among the disassembled codes having a combination of [OP-CODE, ASM-CODE], it is not easy to compare the ASM-CODE parts with each other because the data length is different. Accordingly, the cyber security threat information processing device may normalize data into a data format of a specific size in order to confirm the uniqueness of corresponding assembly data. The normalized data converted to OP-CODE and ASM-CODE may maintain the uniqueness of each code before the corresponding conversion. The cyber security threat information processing device may vectorize the normalized data in order to speed up the similarity determination of the converted normalized data with uniqueness. A normalization and/or vectorization process according to embodiments may be selectively applied for data processing and analysis. Since the normalization and/or vectorization process is the same as that described in FIGS. 1 to 34, a detailed description thereof will be omitted. The cyber security threat information processing device may convert vectorized data sets of OP-CODE and ASM-CODE back into byte data. The cyber security threat information processing device may extract a hash value in units of blocks based on the reconverted byte data and generate a hash value of all data based on a unique value in units of blocks. The hash value is a value of a unit designated to extract a unique value of each block unit in order to efficiently perform comparison of block units, which are part of byte data. A fuzzy hashing technique may be used to extract the hash value. Hash value extraction and fuzzy hash techniques are the same as those described in FIGS. 1 to 34 . The cyber security threat information processing device may determine similarity by comparing the extracted hash value with the hash value of some units of previously stored malicious codes.

Since the hash value is composed of String Data (Byte Data), performing byte comparison of billions of disassembled code data sets can consume an enormous amount of time to obtain a single similarity result. Accordingly, the cyber security threat information processing device may vectorize String Data (Byte Data) based on N-gram data in order to speed up operation (3523). When the N value of N-gram conversion increases, the converted data can accurately reflect the characteristics of the original data, but the data conversion processing time may be delayed. In this example, 2-gram is described, but this is only an example, and 3-gram, 4-gram, ... , various vectorization transformations based on N-gram data can be applied. N-gram conversion is the same as that described in FIGS. 1 to 34, so a detailed description thereof will be omitted.

The cyber security threat information processing device may perform a similarity algorithm based on text expression of natural language processing on the converted data. Through the similarity algorithm, patterns of codes that are not related to the attack identifier can be removed. In addition, the cyber security threat information processing device may perform classification modeling to classify attack identifier patterns based on features or patterns on code in units of blocks. For example, the cyber security threat information processing device may learn whether a vectorized block-based code feature or pattern is a pattern of a known attack identifier, and classify it as an accurate attack technique or implementation method. The cyber security threat information processing apparatus according to embodiments may use various ensemble machine learning models to classify an accurate attack implementation method, that is, an attack identifier and an attacker, for a code determined to have a code pattern similar to a malicious code. Since descriptions of the machine learning models are the same as those described with reference to FIGS. 1 to 34 , detailed descriptions are omitted.

In addition, the cyber security threat information processing device generates a file analysis result by identifying and labeling the converted data as a specific attack technique (TTP). Labeling can be performed in two parts. One is to attach a unique index to the attack identifier defined in the standardized model, and the other is to write information about the user who wrote the attack code. Labeling is assigned according to a standardized model, for example, an attack identifier (T-ID) reflected in MITER ATT&CK, so that accurate information can be delivered to users without additional work. The labeling is given to distinguish not only the attack identifier, but also the attacker who implemented that attack identifier. Accordingly, the cyber security threat information processing device may provide not only an attack identifier but also information capable of identifying an attacker and an implementation method thereof. Labeling according to the embodiments is the same as that described with reference to FIGS. 1 to 34, so detailed descriptions thereof are omitted.

In addition, the cyber security threat information processing device may generate advanced profiling information based on data learned from a data set of previously classified disassembled codes (OP-CODE, ASM-CODE, or a combination thereof). Profiling information according to embodiments corresponds to a labeled attack identifier, an attacker or attack group, a fuzzy hash value of malicious code corresponding to an assembly code, an attack identifier (T-ID), or a fuzzy hash value of an attacker group and malicious code. It may include N-grams (eg, 2-gram data) that are As described above, the attack identifier (T-ID) according to the embodiments follows a standardized model (eg, the attack identifier (T-ID) provided by MITER ATT&CK® described above). Since the profiling information and generation method according to the embodiments are the same as those described in FIGS. 1 to 34, a detailed description thereof will be omitted.

The cyber security threat information processing device according to the embodiments provides a file analysis result (eg, labeling result information, profiling information, etc.) to the user (3530). A file analysis result according to embodiments may be provided in various formats such as text and image. In addition, the cyber security threat information processing device clusters profiling information for each user and stores the profiling information in a database. The clustered data for each user according to the embodiments is a data cluster generated by collecting characteristics of files that a user (eg, user A) mainly requests for analysis. That is, clustering can be created through labeling that assigns users (eg, user IDs, user identifiers, etc.). Also, clustered data can be stored and managed in a user-specific database. The cyber security threat information processing apparatus according to the embodiments may provide the user with only the file analysis result for the file analysis request target file or may provide clustered data (or clustered data result). Also, a user may directly access a database storing clustered data. In addition, the cyber security threat information processing device may provide clustered data through a network according to a user's request or without a request. The block diagram shown in FIG. 35 is only an example, and the operation of the cyber security threat information processing device is not limited to this example. In addition, the cyber security threat information processing apparatus according to embodiments may include at least one clustering database for each user that stores clustering data for each user and an input unit that receives an execution file analysis request signal.

36 is a block diagram illustrating the operation of a cyber security threat information processing device according to embodiments.

The block diagram 3600 of FIG. 36 shows that the cyber security threat information processing device described in FIGS. 1 to 35 analyzes a file according to a file analysis request signal from a user (eg, user A), and analyzes the characteristics of the file and other users. (For example, user B, user C) clustering data and similarity are compared to indicate user-friendly cyber threat information providing operation.

The cyber security threat information processing device receives an execution file analysis request signal (or called a file analysis request signal) requesting analysis of an execution file (new file “ABC.exe”) from a user (user A) (3610). An apparatus for processing cyber security threat information according to embodiments may analyze a file (eg, 3520 of FIG. 35 ). Since the file analysis operation of the cyber security threat information processing device is the same as that described in FIGS. 1 to 35, a detailed description thereof will be omitted.

The apparatus for processing cyber security threat information according to embodiments clusters new file analysis results (eg, ABC exe “feature” information) through labeling to assign users (eg, user identifiers) (3620). If there is a user A clustering database that stores clustered data generated according to user A's file analysis request, the clustered data of user A is stored and managed in the user A clustering database. Accordingly, the cyber security threat information processing device may store the file analysis result in the user A's clustering database. If there is no user A clustering database, the cyber security threat information processing apparatus may create a user A clustering database for storing and managing the generated clustering data of user A. A file analysis result according to embodiments may correspond to at least one or more of data labeled as a specific attack technique (TTP) and profiling information described in FIGS. 1 to 35 . Also, clustering according to embodiments and storage of user A's clustering database may be performed sequentially or simultaneously. Also, clustering and storage of the clustering database are not limited to this example.

The cyber security threat information processing device according to embodiments may provide new file analysis result information to a user who has not requested new file analysis based on a new file analysis result (eg, ABC exe “feature”. Cyber security threat information processing device). The security threat information processing device compares the similarity between the new file analysis result and the clustering data of the user who did not request the new file analysis, and if similar, provides the new file analysis result information and/or information related to the similarity even without the user's request. This is because if the similarity is high (or similar), it means that the new analysis target file has a high similarity with the target files that the user mainly requests for analysis. For the user, the new file analysis results and information related to similarity can be meaningful information for analyzing future cyber threats.In other words, the cyber security threat information processing device utilizes the previously analyzed clustering data for each user, making it more user-friendly. It can provide cyber threat information service.

Specifically, the cyber security threat information processing device stores the file analysis result (eg, ABC exe “characteristic” information) in a clustering database of at least one other user (eg, user B, user C) other than user A. It can be compared with the stored data (3630, 3631). As described above, the clustered data of other users is data generated through labeling that assigns a user (eg, user ID, identifier), and includes data composed of the same format and data type as the new file analysis result. In addition, clustered data for each user is stored and managed in a clustering database (DB) for each user. The cyber security threat information processing device compares the new file analysis result with the similarity of data in the clustering database for each user. If the similarity is higher than the preset similarity, the cyber security threat information processing device provides the new file analysis result and information related to the similarity to the corresponding user (for example, user C) (3640. New file analysis result and information related to the similarity). may be provided to the user in the form of an alarm message, etc., and the provision method, form, information provided, etc. are not limited to this example, and information related to a new file analysis result and similarity may include a file name and similarity. According to the user's request or regardless of the user's request, the cyber security threat information processing apparatus according to the embodiments may store new file analysis results and similarity-related information in the user's clustering DB. If small, the cyber security threat information processing device does not provide information related to the new file analysis result and similarity to the corresponding user (for example, user B) (3650) New file analysis result and similarity related information according to embodiments Information may be provided to the user regardless of similarity according to the user's request The block diagram shown in Fig. 36 is only an example, and the operation of the cyber security threat information processing device is not limited to this example.

37 is a flow diagram illustrating a cyber security threat information processing method according to embodiments.

A flow diagram 3700 of FIG. 37 is an example of the cyber security threat information processing method of the cyber security threat information processing device described in FIG. 36 .

The cyber security threat information processing device according to the embodiments receives a new file analysis request signal (3710). As described above, the new file analysis request signal may be received through a network as a request signal of a specific user.

The cyber security threat information processing device according to the embodiments analyzes an executable file according to a new file analysis request signal (3720). The cyber security threat information processing device disassembles the executable file, and the OP code and

After extracting and vectorizing the ASM code, 2-gram data can be extracted to create a file analysis result with an attack identifier and attacker identification information that implemented the attack identifier. Since the file analysis operation of the cyber security threat information processing device is the same as that described in FIGS. 1 to 36, a detailed description thereof will be omitted.

The cyber security threat information processing apparatus according to the embodiments performs clustering on the file analysis result (3730). For example, the cyber security threat information processing device may generate clustering data through labeling that assigns a user who requested file analysis (eg, user ID, user identifier) to the file analysis result. Since the method for generating clustering data is the same as that described in FIGS. 35 and 36, a detailed description thereof will be omitted.

The apparatus for processing cyber security threat information according to embodiments determines whether a user of clustering data and a user of a database (DB) storing clustering data for each existing user are different (3740). If the user is the same, the clustering data is stored in the clustering database of the corresponding user (3751). If the user is different, the cyber security threat information processing device compares the similarity between the clustering data and data stored in the clustering database of the corresponding user and other users (3752). The similarity comparison operation according to embodiments may be performed concurrently or sequentially with an operation of storing clustering data in a clustering database of a corresponding user.

The cyber security threat information processing device according to the embodiments determines whether the similarity is higher than a preset value (3760). The preset value can be set and changed by a manager or user of the cyber security threat information processing device.

If the similarity is higher than the predetermined value, the cyber security threat information processing device provides information related to the similarity to the user of the clustering database to be compared (3770). Information related to similarity according to embodiments includes a new file analysis result and similarity, and may be provided to a user in the form of an alarm message or the like. In addition, the method, form, and provision of information related to similarity are not limited to this example. The cyber security threat information processing device may store similarity-related information in the user's clustering database regardless of the user's request and/or setting or the user's request and/or setting.

When the similarity is lower than the predetermined value, the cyber security threat information processing device does not provide information related to the similarity to the user of the clustering database to be compared (3780). According to a user's request or setting, the cyber security threat information processing apparatus according to embodiments may provide similarity-related information even when the similarity is lower than a preset value.

The flow diagram shown in FIG. 37 is only an example, and the order of elements constituting the flow diagram is not limited to this example.

38 is an example of a cyber security threat information processing device according to embodiments.

An example 3800 of FIG. 38 is a block diagram of the cyber security threat information processing device described in FIGS. 1 to 37 . An apparatus for processing cyber security threat information according to embodiments includes an input unit 3810, a processor 3820 as a physical device, a database 3830, and a platform 3840 including an application programming interface (API) running on the physical device. can include 38 is an example of a cyber security threat information processing device, and the cyber security threat information processing device is not limited to this example. It may further include one or more elements not shown in .

The input unit 3810 according to embodiments receives an input signal (eg, a file analysis request signal) from a user. The processor 3820 according to embodiments may store or read data in the database 3830. In addition, the processor 3820 according to the embodiments is a platform 3840 based on the file analysis request signal input through the input unit 3810 of the server described in FIGS. 1 to 37 (for example, the server 2100 of FIG. 10). It can perform one or more modules included in. In addition, the processor 3820 processes information generated by the cyber security threat information processing device according to or regardless of the user input signal (eg, the file analysis results described in FIGS. 1 to 37, clustered data, similarity and related information, etc.) to the user. As described above, the format and type of information generated by the cyber security threat information processing device are not limited to examples. Although the processor 3820 according to the embodiments is shown as one block, one or more processors including an arithmetic device such as a central processing unit (CPU), a network device for data input, or a network security device. It can represent more processes. A description of the processor 3820 is omitted since it is the same as that described in FIGS. 1 to 37 .

The database 3830 according to the embodiments includes data generated by the cyber security threat information processing device under the control of the processor 3820 (eg, file analysis results described in FIGS. 1 to 37, clustered data, similarity and related information, etc.) Although the database 3830 according to embodiments is shown as one block, it may represent one or more user-specific databases as described above.

The platform 3840 according to embodiments (eg, the intelligence platform 10000 described in FIG. 10 ) may provide an application programming interface (API) for processing cyber threat information. The platform 3840 according to embodiments includes a file analysis module 3841 performed by the processor 3820, a clustering generation module 3842, and a similarity comparison module 3843. The file analysis module 3841 may perform the file analysis operation 3520 described in FIG. 35 . The file analysis module 3841 is shown as one block, but includes various modules described in FIGS. modules included in the engine 1230 and a post-processing unit (not shown)). The clustering generation module 3842 may generate clustering data by performing clustering on the file analysis result generated by the file analysis module 3841 (eg, clustering generation 3620 described in FIG. 36, clustering in FIG. 37). Perform (3730)). Since the method of generating clustering data is the same as that described in FIGS. 35 to 37, it is omitted. The similarity comparison module 3843 according to embodiments compares a similarity between a file analysis result and data stored in a clustering DB of a user requesting the file analysis result and another user (for example, the similarity comparison described in FIG. 36 (3630, 3631 ), similarity comparison described in FIG. 37 (3760)). Since the similarity comparison method is the same as that described in FIGS. 35 to 37, it is omitted. When the similarity is higher than a preset value, the processor 3820 according to embodiments generates similarity-related information and provides the similarity-related information to a corresponding user.

39 is a flow diagram of a cyber security threat information processing method according to embodiments.

The flow diagram 3900 of FIG. 39 shows the cyber security threat information processing performed by the cyber security threat information processing method of the cyber security threat information processing device described in FIGS. 1 to 38 or a program that processes cyber security threat information stored in a storage medium. An example of the method is shown.

The cyber security threat information processing device (for example, the input unit 3810 of FIG. 38 ) receives the first user execution file analysis request signal (for example, the new file ABC.exe input from user A described in FIG. 36 ) for analyzing the execution file. analysis request signal) is input (3910).

The cyber security threat information processing device (for example, the processor 3820 and the file analysis module 3841 of FIG. 38 ) disassembles the executable file according to the first user executable file analysis request signal to obtain the disassembled code Obtain and reconstruct the disassembled code to obtain a reconstructed disassembled code (3920). The disassembled code according to embodiments may include an OP-CODE corresponding to a function included in an executable file and an assembly code that is an operand of the function. The disassembly and the description of the disassembled code are the same as those described in FIGS. 1 to 38, so they are omitted.

The cyber security threat information processing device (for example, the processor 3820 and the file analysis module 3841 of FIG. 38) processes the reconstructed disassembled code to convert it into a hash function, and converts the hash function into N-grams (N-gram, N is a natural number) is converted into data (3930). The cyber security threat information processing device (for example, the processor 3820 and the file analysis module 3841 of FIG. 38) may convert the hash function into byte data and convert the byte data into 2-gram data. A description of N-gram data conversion according to the embodiments is the same as that described in FIGS. 1 to 38, so it is omitted.

The cyber security threat information processing device (for example, the processor 3820 and the file analysis module 3841 of FIG. 38 ) performs ensemble machine learning on the block unit code of the converted N-gram data to obtain a block An executable file analysis result is generated by profiling the unit code with an identifier of an attack technique performed by the block unit code and an attacker identifier who generated the block unit code (3940). The cyber security threat information processing device (for example, the processor 3820 and the file analysis module 3841 of FIG. 38 ) finds a similar pattern between the code in block units and the stored malicious code, and at least The identifier of the attack technique and the identifier of the attacker can be classified using a decision tree having one node. A description of profiling according to the embodiments is the same as that described in FIGS. 1 to 38, so it is omitted. The cyber security threat information processing device (for example, the processor 3820 and the file analysis module 3841 in FIG. 38 ) blocks the block-unit code of the converted N-gram data, and the block-unit code is a cyber attack. When it is determined whether the code includes an action, the degree of similarity between the block unit code and the stored malicious code may be determined according to a natural language processing method. A description of the method for determining the degree of similarity with the malicious code is the same as that described in FIGS. 1 to 38, so it will be omitted.

The cyber security threat information processing device (for example, the processor 3820 of FIG. 38, the clustering generation module 3842, and the similarity comparison module 3843) sends a first user (for example, FIG. 35 to FIG. User A) clustering data described in FIG. 38 is generated, and the similarity between the clustering data of the first user and the other second user (for example, user B described in FIGS. 35 to 38) and the execution file analysis result are compared (3940). ). The first user clustering data according to embodiments may be generated by performing labeling that assigns information representing the first user to an execution file analysis result. A description of the clustering data generation method is omitted since it is the same as that described in FIGS. 1 to 38 .

When the similarity is higher than a predetermined value, the cyber security threat information processing device (for example, the processor 3820 of FIG. 38 ) provides information related to the similarity to the second user (3950). Information related to similarity according to embodiments may include a file analysis result and similarity. The cyber security threat information processing device (for example, the processor 3820 of FIG. 38 ) does not provide information related to the similarity to the second user when the similarity is lower than a preset value. Description of similarity-related information is omitted since it is the same as that described in FIGS. 1 to 38 .

For convenience of description, each drawing has been divided and described, but it is also possible to design to implement a new embodiment by merging the embodiments described in each drawing. And, according to the needs of those skilled in the art, designing a computer-readable recording medium in which programs for executing the previously described embodiments are recorded falls within the scope of the embodiments. The apparatus and method according to the embodiments are not limited to the configuration and method of the embodiments described above, but all or part of each embodiment is selectively combined so that various modifications can be made. may be configured. Although illustrated and described with respect to a preferred example, the embodiments are not limited to the specific examples described above, and without departing from the gist of the embodiments claimed in the claims, by those of ordinary skill in the art to which the invention pertains. Of course, various modified implementations are possible, and these modified implementations should not be individually understood from the technical spirit or perspective of the embodiments. Descriptions of the device and method according to the embodiments may be applied complementary to each other.

Various components of the device according to embodiments may be configured by hardware, software, firmware, or a combination thereof. Various components of the embodiments may be implemented as one chip, for example, as one hardware circuit. According to embodiments, components according to the embodiments may be implemented as separate chips. At least one or more of the components of the device according to the embodiments may be composed of one or more processors capable of executing one or more programs, and the one or more programs may operate / operate according to the embodiments. Any one or more operations/methods of the methods may be performed, or instructions for performing them may be included. Executable instructions for performing methods/operations of an apparatus according to embodiments may be stored in a non-transitory CRM or other computer program products configured for execution by one or more processors, or may be stored in one or more may be stored in transitory CRM or other computer program products configured for execution by processors. In addition, the storage medium (or memory) according to the embodiments may be used as a concept including not only volatile memory (eg, RAM, etc.) but also non-volatile memory, flash memory, PROM, and the like. Also, those implemented in the form of a carrier wave such as transmission through the Internet may be included. In addition, the processor-readable recording medium is distributed in computer systems connected through a network, so that the processor-readable code can be stored and executed in a distributed manner.

In this document, “/” and “,” shall be interpreted as “and/or”. For example, “A/B” is interpreted as “A and/or B” and “A, B” is interpreted as “A and/or B”. Additionally, "A/B/C" means "at least one of A, B and/or C". Also, “A, B, C” means “at least one of A, B and/or C”. Additionally, “or” shall be construed as “and/or” in this document. For example, "A or B" could mean 1) only "A", 2) only "B", or 3) "A and B". In other words, “or” in this document may mean “additionally or alternatively”.

Terms such as first, second, etc. may be used to describe various components of the embodiments. However, interpretation of various components according to embodiments should not be limited by the above terms. These terms are only used to distinguish one component from another. only thing For example, a first user input signal may be referred to as a second user input signal. Similarly, the second user input signal may be referred to as the first user input signal. Use of these terms should be construed as not departing from the scope of the various embodiments. Although both the first user input signal and the second user input signal are user input signals, they do not mean the same user input signals unless clearly explained in context.

Terms used to describe the embodiments are used for the purpose of describing specific embodiments and are not intended to limit the embodiments. As used in the description of the embodiments and in the claims, the singular is intended to include the plural unless the context clearly dictates otherwise. and/or expressions are used in a sense that includes all possible combinations between the terms. The phrase includes describes that there are features, numbers, steps, elements, and/or components, and does not imply that additional features, numbers, steps, elements, and/or components are not included. . Conditional expressions such as when ~, when ~, etc. used to describe the embodiments are not construed as being limited to optional cases. When a specific condition is satisfied, a related action is performed in response to the specific condition, or a related definition is intended to be interpreted.

1010, 1020, 1030: Client
1100: application programming interface
1210, 150000: Analysis framework
1211, 15100: static analysis module
1213, 15200: dynamic analysis module
1215, 15300: In-depth analysis module
1217, 15400: correlation analysis module
1220,17000: prediction framework
1221: first prediction information generating module
1223: second prediction information generating module
1230: AI engine
2000: Physics
2200: database
2100: server
2510, 2520, 2530,2540, 2610, 2620,2630 Nodes in decision tree
10000: Intelligence Platform
15101: file structure analysis module
15103: file pattern analysis module
15105: file production information analysis module
15107: file environment analysis module
15109: File related analysis module
15201: Environment preparation module
15203: file execution module
15205: behavior collection module
15207: Analysis result collection module
15209: analysis environment recovery module
15301: disassembly module
15303: machine language code extraction module
15309: attack technique identification module
15307: Attacker Identification Module
15309: taint analysis module
15401: first association module
15403: second association module
15409: 3rd association module
15407: 4th correlation module
15409: 5th association module
17100: prediction information generation module
17101: first information prediction module
17103: second information prediction module
17105: third information prediction module
17107: 4th information prediction module
17109: Fifth information prediction module
18000: framework
18100: Analysis and prediction module
18101, 18103, 18105: first module, second module, third module

Claims (15)

receiving a first user executable file analysis request signal for analyzing an executable file;
disassembling the executable file according to the first user execution file analysis request signal to obtain a disassembled code and reconstructing the disassembled code to obtain a reconstructed disassembled code;
converting the reconstructed disassembled code into a hash function and converting the hash function into N-gram (N is a natural number) data;
Ensemble machine learning is performed on the block-unit code of the converted N-gram data to generate an identifier of an attack technique performed by the block-unit code and the block-unit code Profiling with an attacker's identifier to generate an executable file analysis result;
generating first user clustering data based on a result of analyzing the executable file, and comparing a similarity between the clustering data of a second user different from the first user and the result of analyzing the executable file; and
and providing information related to the similarity to the second user when the similarity is higher than a predetermined value. According to claim 1,
The method of processing cyber security threat information, wherein the information related to the degree of similarity includes a result of analyzing the file and the degree of similarity. According to claim 1,
Wherein the first user clustering data is generated by performing labeling that assigns information indicating the first user to the execution file analysis result. According to claim 1,
The disassembled code includes an OP-CODE corresponding to a function included in the executable file and an assembly code that is an operand of the function. According to claim 1
The profiling step is
finding a similar pattern between the block unit code and the stored malicious code; and
and classifying the identifier of the attack technique and the identifier of the attacker using a decision tree having at least one node for the similar pattern code in block units. According to claim 1,
Converting the hash function into N-gram data,
converting the hash function into byte data; and
A cyber security threat information processing method comprising converting the byte data into 2-gram data. According to claim 1,
When it is determined whether the block-unit code of the converted N-gram data is a code containing a cyber attack,
and determining the degree of similarity between the block-based code and the stored malicious code according to a natural language processing method. one or more user-specific databases that store clustering data for each user;
an input unit for receiving a first user executable file analysis request signal for analyzing an executable file; and
A cyber security threat information processing device including a processor for processing the executable file,
The processor disassembles the executable file through an application programming interface (API) according to the first user executable file analysis request signal to obtain a disassembled code and reconstructs the disassembled code to perform a disassembly module to obtain a reconstructed disassembled code;
Performing a data conversion module that processes the reconstructed disassembled code to convert it into a hash function and converts the hash function into N-gram (N-gram, where N is a natural number) data;
Ensemble machine learning is performed on the block-unit code of the converted N-gram data to generate an identifier of an attack technique performed by the block-unit code and the block-unit code Performs a profiling module that generates an executable file analysis result by profiling with an attacker's identifier,
Generating first user clustering data based on the execution file analysis result, and performing a similarity comparison module for comparing the similarity between the clustering data of a second user different from the first user and the execution file analysis result,
and providing information related to the similarity to the second user when the similarity is higher than a predetermined value. According to claim 8,
The information related to the similarity includes the file analysis result and the similarity, the cyber security threat information processing device. According to claim 8,
The first user clustering data is generated by performing labeling to assign information indicating the first user to the execution file analysis result, the cyber security threat information processing device. According to claim 8,
The disassembled code includes an OP-CODE corresponding to a function included in the executable file and an assembly code that is an operand of the function. According to claim 8,
The profiling module,
Find similar patterns between the code in block units and the stored malicious code;
The cyber security threat information processing device for classifying the identifier of the attack technique and the identifier of the attacker using a decision tree having at least one node for the block unit code that is the similar pattern. According to claim 8,
The data conversion module;
A cyber security threat information processing device that converts the hash function into byte data and converts the byte data into 2-gram data. According to claim 8,
The profiling module, when determining whether the block-unit code of the converted N-gram data contains a cyber attack, natural language processing of the block-unit code A cyber security threat information processing device that determines the degree of similarity with stored malicious codes according to the method. disassembling the executable file to obtain a disassembled code and reconstructing the disassembled code to obtain a reconstructed disassembled code according to a first user executable file analysis request signal for analyzing the executable file;
processing the reconstructed disassembled code to convert it into a hash function and convert the hash function into N-gram (N is a natural number) data;
Ensemble machine learning is performed on the block-unit code of the converted N-gram data to generate an identifier of an attack technique performed by the block-unit code and the block-unit code Profiling with an attacker's identifier to generate an executable file analysis result;
generating first user clustering data based on a result of analyzing the executable file, and comparing a similarity between clustering data of a second user different from the first user and a result of analyzing the executable file; and
providing information related to the similarity to the second user when the similarity is higher than a preset value; A storage medium that stores a program that processes cyber security threat information.

Images